Incident Response Blog Posts

Platform
- - - Platform
      
      The Smart SOAR platform delivers the automation capabilities you need to outpace and outthink cyber threats.
      
      Smart SOAR for Enterprise
      
      Smart SOAR for MSSP
    - Get started with D3 Security
      
      Want to see us in action? You can get started with SOAR today.
      
      Get Started
Why D3 Security?
- - - Why Smart SOAR?
      
      D3 Security is the leader in security automation and incident response.
      
      Smart SOAR for Enterprise
      
      Smart SOAR for MSSP
    - Get started with D3 Security
      
      Want to see us in action? You can get started with SOAR today.
      
      Get Started
Solutions
- - - Solutions
      
      Next-generation SOAR technology with flexibility and expertise tailored to the needs of your organization.
    - SOAR Implementation Service
    - SOAR Replacement Service
    - Get started with D3 Security
      
      Want to see us in action? You can get started with SOAR today.
      
      Get Started
Partners
- - - Partners
      
      See how D3 Security works with our partners to enable seamless multi-vendor security orchestration and incident response.
    - Integrations
    - Sales Channel
    - Become a Partner
    - Get started with D3 Security
      
      Want to see us in action? You can get started with SOAR today.
      
      Get Started
Resources
- - - Resources
      
      The source for the latest D3 Security content and SOAR reports, including case studies, data sheets, and webinars.
    - Gartner SOAR Market Guide
      
      Learn what Gartner says about SOAR strategies and vendors.
      
      GET NOW
Company
- - - Company
      
      Get a behind-the-scenes look at D3 Security . Learn about our mission, leadership and careers. We’re hiring!
    - Get started with D3 Security
      
      Want to see us in action? You can get started with SOAR today.
      
      Get Started
Get Started

Defending Against Valid Account Threats: A Holistic Workflow with CrowdStrike, Okta, Elastic, and Recorded Future

Incident Response ,
SOAR

by Pierre Noujeim - May 18, 2023

As organizations seek to bolster their cyber defense strategies, the MITRE ATT&CK framework has emerged as a valuable resource for understanding and categorizing real-world threats. This globally-accessible knowledge base offers a comprehensive and structured approach to enumerating the tactics,...

Cyber Incident Response and Beyond: 6 Ways D3 Helps You Manage the Full Scope of an Incident

Compliance ,
Forensics
Human Resources
Incident Response
SOAR

by Walker Banerd - September 21, 2020

Many SOAR platforms do a good job automating actions through playbooks that cover the basic security tasks needed to remediate simple threats. However, D3 has been in the incident response game since long before the acronym SOAR was even coined, and we have learned in our years of working with many ...

D3 Offers COVID-19 Pandemic Response Tool

Events ,
Incident Response
News

by Alex MacLachlan - March 25, 2020

D3 can help. The Coronavirus or COVID-19 pandemic is a challenge that is evolving rapidly for our customers, and for every organization worldwide. We know that you are facing the disruption and uncertainty head-on. That’s why at D3, we have marshaled our resources and created a solution to hel...

Sherlock in the SOC—SecurityWeek

Incident Response

by Walker Banerd - August 19, 2019

A new article by Stan Engelbrecht, Director of D3’s Cyber Security Practice, is currently featured on SecurityWeek. The character Sherlock Holmes once said, “There is a strong family resemblance about misdeeds, and if you have all the details of a thousand at your finger ends, it is odd if you can&#...

SANS Automation & Integration Survey: Closer Collaboration Enables More Automation

Incident Response ,
SOAR

by Walker Banerd - June 20, 2019

D3 recently sponsored the 2019 SANS Security Automation & SOC Integration Survey. The detailed survey compiled responses from 218 professionals involved in cybersecurity practices. The survey is an excellent resource that provides insight into how security automation is perceived, how organizati...

How D3 Uses the MITRE Framework to Enhance Phishing Investigations

Incident Response ,
SOAR

by Walker Banerd - May 31, 2019

To empower organizations in the fight against advance persistent threats and sophisticated adversaries, SOAR platforms must evolve beyond the linear process of ingesting alerts and automating simple response actions. This is why D3 has fully embedded the MITRE ATT&CK framework into its SOAR plat...

D3 Supports Every Tier of SOC Analysts

Incident Response ,
SOAR

by Walker Banerd - May 17, 2019

In a security operation center (SOC), analysts are often categorized into four tiers, each with different roles and responsibilities. The definition of each tier varies a bit, depending on who you ask, but a generally accepted description of a Tier 1 analyst would be someone who monitors alerts from...

Moving from Event-Based to Intent-Based SOAR Using the MITRE ATT&CK Framework

Incident Response ,
SOAR

by Walker Banerd - March 28, 2019

We recently published a whitepaper detailing D3’s vision for the future of SOAR, and how we’re making it a reality. We’re calling it SOAR 2.0, and while that might sound grandiose, we think it reflects how important this step in the evolution of SOAR could be. You can download the whitepaper here to...

OSFI Incident Reporting Requirements: What You Need to Know

Compliance ,
Data Breach
Incident Response

by Walker Banerd - March 19, 2019

The Office of the Superintendent of Financial Institutions, a Canadian banking regulator, recently published an advisory regarding cyber security incident reporting, specifically, the imminent implementation of new rules around how and when technology and cyber security incidents must be reported. T...

SOAR Trends and Questions from RSAC 2019

Events ,
Incident Response
Industry
SOAR

by Alex MacLachlan - March 13, 2019

Just like at RSA Conference 2018, and 2017, it was great to connect with clients and partners at our booth and on the show floor this year, 2019. Some of the main differences this year were the sheer volume of clients we saw—which makes sense, since we closed deals with more than 50 Fortune 500 [&he...

Connect with D3’s SOAR Experts at RSA Conference 2019

Events ,
Incident Response
SOAR

by Alex MacLachlan - February 11, 2019

RSA Conference 2019, one of the cybersecurity world’s biggest events, is just a couple of weeks away, and our team is excited to return to San Francisco to show off our SOAR technology on the world stage. You can speak with our security orchestration experts and demo the D3 SOAR Platform at Booth #6...

Don’t Search for a Needle in a Haystack — SecurityWeek

Incident Response ,
SOAR

by Walker Banerd - February 8, 2019

A new article by Stan Engelbrecht, Director of D3’s Cyber Security Practice, is currently featured on SecurityWeek. The importance of threat intelligence to security operations is growing, as SOAR platforms and other tools get better and better at rapidly aggregating complex data from myriad sources...

5 Trend Reports Every SOC Should Track

Incident Response ,
Industry
SOAR

by Walker Banerd - January 14, 2019

By tracking specific metrics over time, trend reporting can establish a historical view of threats encountered, quantify SOC performance, and support smarter, more agile, and more data-driven incident response. Analyzing these reports can act as an early warning system to help identify threats and b...

What Makes D3 Playbooks Different

Incident Response ,
SOAR

by Walker Banerd - December 20, 2018

What Makes D3 Playbooks Different Incident response playbooks are needed to help enterprises respond effectively, consistently, and in line with security and compliance obligations. For many years, these playbooks were sets of manual, print-based documents. This often led to inconsistencies and the ...

D3 Security Integrates with McAfee Enterprise Security Manager (ESM)

Incident Response ,
News
SOAR

by Alex MacLachlan - December 4, 2018

VANCOUVER, British Columbia – D3 Security, an innovator in Security Orchestration, Automation and Response (SOAR) technology, today announced that it has achieved technical integration of the D3 SOAR Platform with the McAfee® Enterprise Security Manager (ESM), enabling accelerated threat detec...

Back to Basics: Incident Response Planning 101

Incident Response ,
SOAR

by Walker Banerd - November 5, 2018

A recent survey of 4,100 cybersecurity pros by the international insurance company Hiscox reported that 73% of organizations are unprepared for a cyberattack. That’s a startling statistic because the global enactment of strict regulations requires organizations to quickly identify security incidents...

Seven Security Activities You Should Automate — SecurityWeek

Incident Response ,
SOAR

by Walker Banerd - October 17, 2018

A new article by Stan Engelbrecht, Director of D3’s Cyber Security Practice, is currently featured on SecurityWeek. Security automation is often sold based on the promise of helping security teams save time and act faster. While these benefits are real, there are also many other use cases for automa...

D3 Named Top Security Automation Solution

Incident Response ,
News
SOAR

by Alex MacLachlan - October 2, 2018

VANCOUVER, British Columbia – D3 Security, a developer of award-winning security orchestration, automation and response (SOAR) solutions, today announced that they have been named CyberSecurity Breakthrough’s 2018 Security Automation Solution of the Year. This year’s competition drew over 3,00...

Preparing for SOAR: Join the Webinar from D3 and EMA

Incident Response ,
SOAR

by Walker Banerd - September 19, 2018

Security orchestration and automation aren’t just the future of security operations; they’re the present. If you aren’t already using these powerful technologies in your SOC, you’ll need to implement them soon. Are you prepared? Join experts from D3 and EMA for an exclusive webinar on how to prepare...

How Automation Helps Security Managers—SecurityWeek

Incident Response ,
SOAR

by Walker Banerd - September 12, 2018

A new article by Stan Engelbrecht, Director of D3’s Cyber Security Practice, is currently featured on SecurityWeek. It’s often discussed how automation benefits analysts , making them faster and better informed in their work. What gets talked about less is that security managers also get significant...

Getting off the Ground with SOAR—SecurityWeek

Incident Response ,
SOAR

by Walker Banerd - August 17, 2018

A new article by Stan Engelbrecht, Director of D3’s Cyber Security Practice, is currently featured on SecurityWeek. Something we often hear from prospective customers is that they don’t have any substantial incident response program in place and are apprehensive about jumping straight into implement...

The Evolution of SOAR Platforms — SecurityWeek

Incident Response ,
SOAR

by Walker Banerd - July 30, 2018

A new article by Stan Engelbrecht, Director of D3’s Cyber Security Practice, is currently featured on SecurityWeek. D3 is part of an evolution in security operations platforms that is now commonly referred to as SOAR (security orchestration, automation, and response). Demand for SOAR is undeniably a...

Threat Intelligence Use Cases

Incident Response ,
SOAR

by Walker Banerd - July 18, 2018

Threat intelligence is becoming an increasingly prominent element of security operations. In fact, Gartner predicts a 15x increase in the number of large enterprises using commercial threat intelligence by 2020. Threat intelligence comes in many forms, with numerous vendors and several distinct use ...

SOAR Like An Eagle: The Key to Fast and Full-Lifecycle Incident Response

Incident Response ,
SOAR

by Alex MacLachlan - June 28, 2018

Senior Principal Analyst and ESG Fellow, Jon Oltsik, recently reported on security orchestration, automation and response (SOAR) platforms in two articles for CSO Magazine. You can read them here and here. Notably, Jon found that platforms like D3 Security are driving SOAR’s evolution, by combining ...

How Much Does a Data Breach Really Cost You?

Compliance ,
Data Breach
Incident Response
Industry
SOAR

by Alex MacLachlan - June 25, 2018

“If you protect your paper clips and diamonds with equal vigor, you will soon have more paper clips and fewer diamonds.” – Dean Rusk, former US Secretary of State Do you know how much your organization stands to lose if it were to suffer a data breach? Even the legendary Warren Buffet h...

How SOAR Makes a Security Analyst More Impactful

Incident Response ,
SOAR

by Walker Banerd - June 20, 2018

Security orchestration, automation, and response (SOAR) solutions are valuable for everyone on a security team, from people on the front lines to managers and executives tracking reports and metrics from a birds-eye view, or even compliance and legal personnel working outside the SOC. Of all the rol...

Infosec Europe 2018 Recap

Incident Response ,
SOAR

by Stan Engelbrecht - June 13, 2018

Last week, D3 sponsored the InfoSecurity Europe trade show at the Olympia in London. “InfoSec” is Europe’s top cyber security trade show, with every imaginable product and service represented, including our award-winning Security Orchestration, Automation, and Incident Response platform, known as SO...

Why Modern Manufacturers Need Cyber Incident Response

Forensics ,
Incident Response
Industry
SOAR

by Walker Banerd - June 12, 2018

Despite the constant news about cyber threats and the growth in major breaches, many companies are overly focused on prevention, while overlooking incident response and handling practices. With today’s environment of an increasing attack surface, numerous security tools, overworked analysts, and a n...

5 Strategies for Extending SOAR Beyond the SOC —SecurityWeek

Incident Response ,
SOAR

by Walker Banerd - June 11, 2018

A new article by Stan Engelbrecht, Director of D3’s Cyber Security Practice, is currently featured on SecurityWeek. Automation and orchestration are top of mind for much of the security industry these days, and the past few years have seen great advances in how they can be applied to the rapid analy...

D3 at Infosecurity Europe 2018

Compliance ,
Data Breach
Incident Response
SOAR

by Alex MacLachlan - May 31, 2018

The D3 team is getting ready to fly to the UK for Infosecurity Europe 2018, taking place June 5-7 in London. It’s the largest information security event in Europe, so we’re excited to show off our latest innovations, connect with security professionals from around the world, and learn about how info...

Why Companies Need to Centralize Security Operations: Part 2

Compliance ,
Data Breach
Forensics
Incident Response
Industry
SOAR

by Walker Banerd - May 10, 2018

In Part 1, we looked at the status quo of security systems as they are used in organizations, the reality that automation should be a baseline rather than a novelty in today’s security landscape, and we explored why centralization is essential. In Part 2 below, let’s look at how and why organization...

2018 GDPR Compliance Report

Compliance ,
Data Breach
Incident Response

by Alex MacLachlan - May 3, 2018

D3 Security is a sponsor of the newly released 2018 GDPR Compliance Report. The report was produced by Cybersecurity Insiders, and comprises results from a survey of more than 500 IT, cybersecurity, and compliance professionals about how their organizations are readying themselves for GDPR, which ta...

Why Companies Need to Centralize Security Operations: Part 1

Compliance ,
Data Breach
Incident Response
Industry
SOAR

by Walker Banerd - May 2, 2018

Enterprises need a centralized security solution: a system that connects the infrastructure to allow seamless bidirectional data flow between each system and the enterprise security control center. Despite digital applications permeating nearly every aspect of our lives, many enterprises’ daily proc...

RSA 2018 Recap: Show Me the Orchestration (and the Metrics)

Events ,
Incident Response
SOAR

by Stan Engelbrecht - April 24, 2018

In the cybersecurity world, it’s hard to think of an event more important than each year’s RSA conference. No other event gives us the chance to engage with customers, prospects, partners and industry analysts, the way RSA does. From our perspective as a vendor, it seems that each year has a bit of ...

Why Mass Transit Could Be the Next Big Cyber Target — SecurityWeek

Data Breach ,
Incident Response
Industry

by Walker Banerd - April 17, 2018

A new article by Stan Engelbrecht, Director of D3’s Cyber Security Practice, is currently featured on SecurityWeek. Cyber attacks can cluster around certain industries for a period of time, once a particular method of attack has proven to be successful. Examples in recent years include ransomware in...

How IR Platforms Can Help You Meet GDPR Reporting Timelines

Compliance ,
Data Breach
Incident Response

by Walker Banerd - March 20, 2018

With the dawn of the GDPR era just weeks away, impacted organizations around the world are scrambling to determine the tools they need to achieve compliance and dodge massive fines. As a developer of incident response solutions, we’ve been digging into GDPR to see how we can help. We’ve determined t...

Winning Best Security Automation Platform Was Just the Beginning

Incident Response ,
Industry
SOAR

by Alex MacLachlan - March 8, 2018

While it might not be as glamorous as the Oscars, the cybersecurity industry has its own awards season, culminating in the red-carpet SC Awards during the RSA conference in April. So far in 2018, D3 Security has had a remarkable awards season, with our Incident Response Automation Platform earning t...

D3 Cyber Incident Response Product Guide

Incident Response ,
SOAR

by Walker Banerd - March 5, 2018

D3 has a truly unique cyber incident response offering, which makes it hard to classify—let alone do justice with a quick explanation. This is why we’ve written a comprehensive guide that takes you through the entire product journey. D3’s full-lifecycle capabilities are what sets it apart, so the pr...

What Are the Incident Response Phases?

Incident Response

by Walker Banerd - February 22, 2018

In our line of work, we find that IT and security professionals often forget that incident response (IR) is a process, and not a singular action. Not building and coordinating the steps of incident response correctly within your IR plan will render it useless, making serious incidents like ransomwar...

High Tensions Often Cause Incident Response to be Derailed — SecurityWeek

Incident Response

by Walker Banerd - February 19, 2018

The latest article in the series written by Stan Engelbrecht, Director of D3’s Cyber Security Practice, is currently featured on SecurityWeek. Stan’s three-part series covers the important incident response steps that many companies overlook. In this excerpt from the article, Stan describes the impo...

D3 Security Launches Guided Case Management

Forensics ,
Incident Response
News

by Walker Banerd - February 13, 2018

One of the things that sets D3 apart is the deep case management functionality we provide as part of our full-lifecycle incident response solution. We are excited to announce that we have built on that strength with a totally reimagined Guided Case Management module, which will bring unprecedented l...

Strong Incident Response Starts with Careful Preparation- SecurityWeek

Incident Response

by Stan Engelbrecht - January 19, 2018

An article written by the Director of D3’s Cyber Security Practice, Stan Engelbrecht, is currently featured on SecurityWeek. Stan’s article is the first in a three-part series on often-overlooked steps in the incident response process. The following is a brief excerpt from the article. H...

Incident Response: What to Automate (and Why)

Incident Response ,
SOAR

by Walker Banerd - January 11, 2018

Let’s get one thing straight: Security automation and orchestration are at the heart of D3’s Incident Management Platform. Our platform’s security automation features streamline the investigation and context-gathering aspects of response, and also provide automated actions, such as blocking IPs and ...

Managing Financial Crime with D3

Forensics ,
Incident Response
Industry

by Walker Banerd - December 14, 2017

The Challenge: Dealing with crime is nothing new for financial institutions. The lucrative target they present has always inspired innovation and persistence among thieves, fraudsters, and other criminals, but the digital era is increasing the potential attack surface to a previously unthinkable deg...

Key Findings from Five Major Cybersecurity Reports

Compliance ,
Data Breach
Incident Response
Industry
SOAR

by Walker Banerd - November 29, 2017

At D3, we are always evolving our products to meet the needs of our customers and stay on the forefront of cyber incident response technology. This requires us to always be informed on the latest industry research, in order to understand the present and future of incident response, and where our sol...

Trump’s Twitter Disabled: Protecting Against Insider Threats

Data Breach ,
Incident Response

by Walker Banerd - November 6, 2017

For a few minutes on November 2nd, the most famous Twitter account in the world went offline. The account in question was of course @realdonaldtrump. Twitter was quick to attribute the incident to nonspecific “human error”, but soon after clarified that a rogue customer support employee deliberately...

See Your Response Plan in Action with D3’s Visual Playbook Editor

Incident Response ,
SOAR

by Walker Banerd - October 23, 2017

There are immediate benefits to simply having visual representations of your response plans. Incident response is complex. It often requires involvement from several internal groups, and by its nature, tends to be needed most during crises or other chaotic situations. Having visual playbooks helps y...

Next-Generation Threat Management: White Paper and Webinar

Incident Response ,
SOAR

by Walker Banerd - October 16, 2017

We recently produced two significant pieces of thought leadership in collaboration with the Chertoff Group, which are both now available. The pieces—a white paper and a webinar—focus on the future of the incident response industry, looking at how vendors can evolve their solutions to support the cha...

New Report Details the Fight Against Ransomware

Incident Response ,
Industry
SOAR

by Walker Banerd - October 5, 2017

The 2017 Ransomware Report, a comprehensive study produced in partnership with D3 Security, was published on September 26. The report compiles survey answers collected by Crowd Research Partners from over 500 cybersecurity professionals to create a complete picture of ransomware in 2017, including h...

Why D3 is the “Perfect” Incident Response Platform for Splunk Users

Incident Response ,
SOAR

by Stan Engelbrecht - September 25, 2017

D3 is excited to support our partner Splunk as a Mega-level sponsor of .conf2017: The 8th Annual Splunk Conference. The conference—running from September 25-28 in Washington, DC—consistently draws some of the most innovative folks in the security business, and it’s one of our favorite places to con...

Avoiding Rigidity in Incident Response Automation

Incident Response ,
SOAR

by Walker Banerd - September 20, 2017

The idea that many analysts and CISOs are concerned about automating and orchestrating security actions should come as no surprise. After all, human decision-making leverages years of relevant experience and training, plus it can pivot on a dime, bringing valuable agility to the SOC. But the fact is...

How to Get More Value from Your Junior Security Analysts

Incident Response ,
SOAR

by Walker Banerd - September 14, 2017

There’s nothing better for your incident response program than an experienced security analyst. But these days, you’re lucky if you have more than one or two on your team, and with such high demand for their skills, it might not be feasible budget-wise to hire as many as you’d like. So if an all-sta...

The Equifax Breach: How Companies Can Respond to Major Security Incidents

Forensics ,
Incident Response

by Walker Banerd - September 8, 2017

The Most Damaging Data Breach Ever? Equifax, one of the largest American credit reporting agencies, announced yesterday that a data breach had exposed the personal data of 143 million customers. While not the largest data breach ever in terms of the number of records—that ignominious honor still goe...

Saving Valuable Time with Security Automation

Incident Response ,
SOAR

by Walker Banerd - September 6, 2017

Being chronically understaffed means that SOC and IR teams are hit doubly hard by sudden increases in the volume and sophistication of security alerts. Analysts on these teams must contend with dozens of systems and data sources, and largely manual investigative processes. This forces analysts to s...

Involving “Legal” in Incident Response: The Three Pillars

Compliance ,
Data Breach
Forensics
Incident Response

by Walker Banerd - August 30, 2017

As cybersecurity has become one of the defining issues of our era, it has intertwined with legal concerns to the point that the two can no longer be completely separated. Where it was once possible for security and legal teams to have minimal interaction, current laws, regulations, and the growing s...

D3 is the Most Popular Incident Management Software – ASIS Survey

Incident Response ,
Industry
Physical Security

by Alex MacLachlan - August 23, 2017

In ASIS International’s recently published Global Security Operations Communications Center (GSOCC) survey, almost half of respondents (41%) said they used D3 for incident management. The next most popular solution was used by 29%. This is an exciting result for us. ASIS is the leading professional ...

The Importance of Full-Lifecycle IR to Support Automation

Incident Response ,
SOAR

by Walker Banerd - August 15, 2017

Automation and orchestration have quickly become an integral part of incident response (IR), and grabbed the industry’s attention in the process. That’s because SOC and IR teams have long needed a way to keep up with daily barrages of advanced threats and alerts. But the shine of the spotlight has a...

5 Common Incident Response Problems that SOAR can Help Solve

Incident Response ,
SOAR

by Stan Engelbrecht - July 31, 2017

Most companies that are struggling with their incident response program fall into two categories: They don’t realize what their problems are, because they’ve always done things a certain way They know exactly what their problems are, but don’t have the resources to fix them Whichever category your c...

Cybersecurity Incident Response Buyer’s Guide

Incident Response ,
SOAR

by Walker Banerd - July 20, 2017

Sometimes it seems like you need to be a CISSP just to understand the variety of incident response platforms (IRPs) on the market. Cybersecurity incident response is still a relatively young industry, and the solutions on offer comprise a wide range of different functionality and technology. Compoun...

How to Avoid HIPAA’s Wall of Shame: Protecting Against Ransomware

Compliance ,
Data Breach
Incident Response
Industry

by Alex MacLachlan - July 13, 2017

The healthcare industry is a lucrative target for cybercriminals. Healthcare organizations are often laggards in adopting cybersecurity and data management best practices, a vulnerability that criminals have been quick to exploit. In the first half of 2017, 149 breaches have compromised nearly 2.7 m...

Understanding Automated Incident Response

Incident Response ,
SOAR

by Walker Banerd - July 7, 2017

If you’ve spent time evaluating cyber incident response platforms (IRPs), you’ve undoubtedly felt the hype surrounding automation and orchestration. And rightfully so. When applied correctly, automation and orchestration can drastically reduce incident response times and eliminate manual tasks—big p...

4 Ways Your IRP Can Help Reduce False Positives

Incident Response ,
SOAR

by Walker Banerd - June 30, 2017

False positives are to the security analyst what cats in trees are to the fire brigade: wasted time and a distraction from the real emergencies. So imagine if a firefighter had to deal with tens of thousands of cats in trees, the way an analyst does with false positives! There would be a lot of [&he...

Why Are Ransomware Attacks So Successful?

Incident Response ,
SOAR

by Alex MacLachlan - June 21, 2017

Ransomware helped cyber criminals pad their Bitcoin wallets with $1B in 2016, according to the FBI. The threat has continued unabated in 2017, with major attacks dominating the headlines and driving profits in excess of $5B. Compared to 2015 when “only” $325M was generated, ransomware has quickly m...

Delivering (and Measuring) Incident Response ROI

Incident Response ,
SOAR

by Walker Banerd - June 20, 2017

Let’s be honest: every vendor talks about how their incident response platform (IRP) can save you time, lower your costs, and reduce security risks. And they’re probably right; IRPs are valuable tools for almost any organization. However, there are several distinct approaches to designing an IRP, wh...

Work Smarter, Not Harder: 5 Steps to Streamlined Incident Response

Incident Response ,
SOAR

by Walker Banerd - June 2, 2017

It’s a common problem in any workplace: you get so caught up dealing with a constant stream of tasks that you never have the chance to evaluate how you’re going about them. This can go on for months or even years before someone takes a step back and realizes that implementing selected process improv...

Why an IT Ticketing System Won’t Work for Incident Response

Incident Response

by Walker Banerd - May 24, 2017

Cybersecurity incident response is a relatively young corporate function. So it’s no surprise that companies are trying to leverage tools they already have to manage incidents and assign tasks. For many organizations, this means trying to configure an incident management workflow into their IT ticke...

5 Critical Steps for Your Cybersecurity Incident Response Plan

Incident Response

by Walker Banerd - May 12, 2017

While cybersecurity teams are generally overwhelmed these days, the moments after a major incident can be especially hectic. That’s why it’s critical to have an incident response plan in place, including workflows that are tailored to common threats like malware, DDoS, and many others. A good plan w...

Incident Response Platforms: 10 Features to Look For

Incident Response ,
SOAR

by Walker Banerd - May 8, 2017

Incident response platforms (IRPs) are powerful software solutions with wide-ranging feature sets. Many features are common across platforms, but each vendor has a unique approach to incident response, and the features they include or omit from their solution will reflect that perspective. At D3, we...

Cyber SAR Requirements – What They Are And How We Can Help

Compliance ,
Incident Response

by Walker Banerd - April 13, 2017

In October, 2016, the Financial Crimes Enforcement Network (FinCEN) published an advisory regarding financial institutions’ obligations related to cyber crime. The key takeaway from the advisory is that suspicious activity reports (SARs) should be filed for cyber events, even when they do not result...

Hacking Hollywood: Cyber Security Threats in the Entertainment Industry

Data Breach ,
Incident Response
Industry

by Walker Banerd - April 5, 2017

The reach and profile of entertainment companies make them an attractive target for a diverse group of adversaries, each with their own motivations and methods. Insiders, content pirates, hacktivists, and state-sponsored attackers—all of these threats pose a tangible risk to the financial, legal and...

Meeting NERC CIP Requirements with a Centralized IRP

Compliance ,
Forensics
Incident Response
Industry
Physical Security

by Walker Banerd - March 29, 2017

The Critical Infrastructure Protection (CIP) program administered by the North American Electric Reliability Corporation (NERC) holds Utilities to a broad set of security standards in order to minimize risk to the power grid across North America. NERC CIP standards are comprehensive—encompassing cyb...

The True Cost of a Breach: Infographic

Data Breach ,
Incident Response

by Alex MacLachlan - March 24, 2017

We all know that security breaches can cost companies millions in regulatory fines and lost business. Plus, investigation and remediation costs can run into the millions of dollars, especially for attacks perpetrated by well organized adversaries. In other words, the cumulative cost of a breach beco...

Incident Response Trends in 2017

Incident Response ,
Industry
SOAR

by Walker Banerd - March 20, 2017

Analysts and security professionals agree that 2016 brought cyber security unprecedented levels of attention, with vivid examples of cyber attacks in the news, and a seemingly constant string of hacks, ransomware, and other malicious incidents. The ubiquity of cyber incidents has led to a major shif...

Stories From The Front Lines: The Silo Effect vs. The Single Source of Truth

Compliance ,
Data Breach
Forensics
Incident Response
Industry

by Alex MacLachlan - March 16, 2017

Preface: This is the last installment of our three-part blog series called “Stories from the Front Lines”. This installment is slightly different, in that it features three different archetypical characters from different departments. Each of the problems they face is different, but keep reading t...

How to Comply With 23 NYCRR 500

Compliance ,
Data Breach
Incident Response
Industry

by Walker Banerd - March 13, 2017

In February of 2017, the New York State Department of Financial Services (NY DFS) released the updated version of their Cybersecurity Requirements for Financial Services Companies (23 NYCRR 500). The new legislation, which takes effect on March 1, reflects a growing concern in the NY DFS regarding t...

How Root Cause Analysis Can Help Your Hospital Avoid HIPAA Fines

Compliance ,
Data Breach
Forensics
Incident Response
Industry

by Alex MacLachlan - March 10, 2017

The Health Insurance Portability and Accountability Act or HIPAA provides data privacy and security provisions for safeguarding medical information. HIPAA regulations are enforced by the Department of Health and Human Service’s Office for Civil Rights (OCR). This office carries out its mandate by in...

5 Incident Response Takeaways from the Yahoo Breach Fallout

Compliance ,
Data Breach
Incident Response
Industry

by Walker Banerd - March 10, 2017

The ongoing fallout from the 2014 data breach at Yahoo has personally cost CEO Marissa Mayer upwards of $14 million. On March 1, Mayer announced on her blog that she had agreed to forego her annual bonus and equity grant, due to the breach happening on her watch as CEO. The bonus is worth $2 [&helli...

Stories From The Front Lines: Digital Forensics Case Management Systems

Forensics ,
Incident Response

by Alex MacLachlan - March 7, 2017

Preface: This is the second installment of a 3-part blog series called “Stories from the Front Lines”. Each installment will feature a different security industry persona-archetype, inspired by real D3’s projects and interactions with customers. Each will illustrate a common problem, and discuss a...

Incident Response In the Energy Industry

Compliance ,
Incident Response

by Alex MacLachlan - March 6, 2017

In November 2015, Tripwire and Dimensional Research commissioned a study assessing the cybersecurity challenges faced by organizations in the energy sector. Respondents included over 150 IT professionals from the energy, oil & gas and utilities industries. In addition to this study, Tripwire sur...

Cyber Security for the Manufacturing Industry

Incident Response ,
Industry

by Walker Banerd - February 26, 2017

According to the 2016 Cyber Security Intelligence Index performed by IBM’s X Force Research, manufacturing has moved up in the ranks to become the third most hacked industry second only to health care and information and communications. Businesses of these types include those that produce text...

Stories From The Front Lines: Part One

Compliance ,
Forensics
Incident Response
Industry

by Alex MacLachlan - February 24, 2017

Preface: This is the first installment of a 3-part blog series called “Stories from the Front Lines”. Each installment will feature a different user story, inspired by real D3’s projects and interactions with customers. Each will illustrate a common problem, and explore an effective solution with ...

Are Your Emails Safe From Prying Eyes?

Data Breach ,
Incident Response

by Alex MacLachlan - February 16, 2017

The much-publicised Democratic National Committee (DNC) email hack that resulted in nearly 20,000 confidential email messages leaked to WikiLeaks takes place amid a highly politized post-election environment. The US government has been quick to point fingers and label the attack a state-sponsored cy...

Webinar: Go Beyond Incident Response

Compliance ,
Incident Response

by Alex MacLachlan - January 16, 2017

February 8, 2017 @ 3:00PM- 4:00PM EST Enterprises face significant financial, reputational, intellectual property, and legal risks from data breaches, with all types of enterprises falling victim – from government agencies like Office of Personnel Management (OPM) and the Internal Revenue Service (...

Using IR Automation to Overcome the IT Skills Gap

Incident Response ,
SOAR

by Alex MacLachlan - October 27, 2016

“Cyber threats have evolved from targeting and harming computers, networks, and smartphones — to people, cars, railways, planes, power grids and anything with a heartbeat or an electronic pulse.” Steve Morgan, Hackerpocalypse: A Cybercrime Revelation Nearly half of all cyberattacks strike small and ...

7 Reasons why Enterprises Need a NIST-Compliant Cybersecurity IRP

Compliance ,
Incident Response
Industry

by Alex MacLachlan - October 27, 2016

As cyber attacks inflict increasing damage on organizations of all kinds across every sector of the economy, it has become critical for cybersecurity programs to evolve. Gone are the days of rudimentary intrusion detection systems and retroactive damage control following a security breach. To be tru...

Why Your IT Ticketing System Doesn’t Cut it for Incident Response

Incident Response

by Alex MacLachlan - October 18, 2016

In order to weather an attack in today’s ever-evolving cyber security climate, an organization must develop comprehensive cyber resilience. Cyber resilience involves the leveraging of detection, incident response (IR), and prevention methodologies that contribute to the overall flexibility and ultim...

The Value of Unifying SIEM Data with your Incident Response Platform

Incident Response ,
SOAR

by Alex MacLachlan - October 18, 2016

Today’s security information and event management systems (SIEM) operate with a more extensive knowledge base than their predecessors, and they are more useful in detecting and logging data than ever before—but they are never more powerful than when they are paired with a unified incident response (...

Design an IRP That Exceeds NIST Standards

Compliance ,
Incident Response

by Alex MacLachlan - October 14, 2016

Whether you have already developed an incident response plan (IRP) or you’re just getting started, you can benefit from the best-practices and approaches outlined in the National Institute of Standards and Technology (NIST) Computer Security Incident Handling Guide. NIST has developed a comprehensiv...

Five Traits of Highly Effective CERT Teams

Incident Response

by Alex MacLachlan - October 14, 2016

Managing cyber security risks and threats effectively is about more than just having the right systems, plans, and protocols in place. It’s also about the people behind the operation who must manage these systems and make split-second decisions that could determine how quickly an incident can be con...

Improve your Incident Response Plan Through Automation

Incident Response ,
SOAR

by Alex MacLachlan - October 14, 2016

Cybersecurity is a tough, dynamic line of work. On any given day, you could be dealing with a phishing attack, insider breach, and previously unseen technology being used to launch an attack against your company. As cyberattacks become increasingly sophisticated, you must be prepared to invest time ...

Why you Need an Up-to-Date IRP

Incident Response

by Alex MacLachlan - October 14, 2016

A cybersecurity incident response plan (IRP) is your organization’s best protection against the pervasive threat of a breach or attack. An IRP provides a roadmap for how your organization can secure and monitor its assets, engage in proactive planning and threat mitigation, and response during and a...

Tips to Help You Effectively Manage Your IR Team

Incident Response

by Alex MacLachlan - October 13, 2016

A cybersecurity incident response team is the first and most important line of defense in preventing breaches and mitigating damage. Cybersecurity team members are highly trained professionals who thrive in a dynamic, ever-changing environment. One day, they’re making split-second decisions to prote...

Standardizing Your Incident Response

Incident Response ,
SOAR

by Alex MacLachlan - October 11, 2016

A cyber threat infiltrates your organization and a breach occurs. You and your team go into reactive fire-fighting mode. You isolate the threat and put it down. Crisis averted right? Well what if the attack was an APT (Advanced Persistent Threat)? Just because you pulled the thread and took care of ...

Protecting Your Critical Infrastructure

Compliance ,
Incident Response
Industry
Physical Security

by Alex MacLachlan - October 11, 2016

The Patriot Act was passed in 2001 in response to terrorist attacks on American soil. However, we don’t usually think about how it helped define cybersecurity and how it continues to inform the framework for defining critical infrastructures and how we protect them in the US. With a growing number o...

Critical Controls in Action

Compliance ,
Incident Response

by Alex MacLachlan - October 11, 2016

The story of the tortoise and the hare is relevant in building any cybersecurity program. When faced with the challenges that doing business online in our highly connected world presents, it may quickly seem like an arms race when it comes to cybersecurity. A race where every day there is a new way ...

Dealing with an Insider Threat

Compliance ,
Data Breach
Forensics
Incident Response

by Alex MacLachlan - October 11, 2016

Bob just killed the company, or did he? For many of us we spend more time with our co-workers then we do with our immediate families. Because of all this we don’t want to think that inside the pursuit of common goals, comradery, extended family and our team that there could be a bad egg […]...

Incident Response Software: 5 Things to Know

Incident Response

by Alex MacLachlan - January 16, 2016

It doesn’t take a security professional to know that even the most infinitesimal incident can trigger much greater consequences. Because whether security, safety or compliance; even the smallest incidents can bring large and complex companies to their reckoning – by themselves or by contributing to ...

Hospital Cyber Security: Risk Reduction in 5 Easy Steps

Compliance ,
Data Breach
Incident Response
Industry

by Alex MacLachlan - December 18, 2015

Securing private health information and responding to security breaches have presented incredible challenges to hospitals whose healthcare records yield 10 to 20 times more value on the black market than credit card information. Moreover, the proliferation of BYOD, social media and phishing scams, m...

Incident Management Software Drive Cost Reductions at Utilities

Compliance ,
Incident Response
Industry

by Alex MacLachlan - June 8, 2015

With the unique ability to categorize different energy diversion types and perform theft analytics, D3 Security’s Incident Reporting and Case Management products give utilities and their security teams an incisive view at the root cause of energy diversion losses. Theft Analytics Drive Energy ...

One platform to stop alert overwhelm. Transform how your security team works, by focusing its resources on real threats.

Get Started

Platform

Get started with D3 Security

Want to see us in action? You can get started with SOAR today.

Why Smart SOAR?

Get started with D3 Security

Want to see us in action? You can get started with SOAR today.

Solutions

Get started with D3 Security

Want to see us in action? You can get started with SOAR today.

Partners

Get started with D3 Security

Want to see us in action? You can get started with SOAR today.

Resources

Gartner SOAR Market Guide

Learn what Gartner says about SOAR strategies and vendors.

Company

Get started with D3 Security

Want to see us in action? You can get started with SOAR today.

Defending Against Valid Account Threats: A Holistic Workflow with CrowdStrike, Okta, Elastic, and Recorded Future

Cyber Incident Response and Beyond: 6 Ways D3 Helps You Manage the Full Scope of an Incident

D3 Offers COVID-19 Pandemic Response Tool

Sherlock in the SOC—SecurityWeek

SANS Automation & Integration Survey: Closer Collaboration Enables More Automation

How D3 Uses the MITRE Framework to Enhance Phishing Investigations

D3 Supports Every Tier of SOC Analysts

Moving from Event-Based to Intent-Based SOAR Using the MITRE ATT&CK Framework

OSFI Incident Reporting Requirements: What You Need to Know

SOAR Trends and Questions from RSAC 2019

Connect with D3’s SOAR Experts at RSA Conference 2019

Don’t Search for a Needle in a Haystack — SecurityWeek

5 Trend Reports Every SOC Should Track

What Makes D3 Playbooks Different

D3 Security Integrates with McAfee Enterprise Security Manager (ESM)

Back to Basics: Incident Response Planning 101

Seven Security Activities You Should Automate — SecurityWeek

D3 Named Top Security Automation Solution

Preparing for SOAR: Join the Webinar from D3 and EMA

How Automation Helps Security Managers—SecurityWeek

Getting off the Ground with SOAR—SecurityWeek

The Evolution of SOAR Platforms — SecurityWeek

Threat Intelligence Use Cases

SOAR Like An Eagle: The Key to Fast and Full-Lifecycle Incident Response

How Much Does a Data Breach Really Cost You?

How SOAR Makes a Security Analyst More Impactful

Infosec Europe 2018 Recap

Why Modern Manufacturers Need Cyber Incident Response

5 Strategies for Extending SOAR Beyond the SOC —SecurityWeek

D3 at Infosecurity Europe 2018

Why Companies Need to Centralize Security Operations: Part 2

2018 GDPR Compliance Report

Why Companies Need to Centralize Security Operations: Part 1

RSA 2018 Recap: Show Me the Orchestration (and the Metrics)

Why Mass Transit Could Be the Next Big Cyber Target — SecurityWeek

How IR Platforms Can Help You Meet GDPR Reporting Timelines

Winning Best Security Automation Platform Was Just the Beginning

D3 Cyber Incident Response Product Guide

What Are the Incident Response Phases?

High Tensions Often Cause Incident Response to be Derailed — SecurityWeek

D3 Security Launches Guided Case Management

Strong Incident Response Starts with Careful Preparation- SecurityWeek

Incident Response: What to Automate (and Why)

Managing Financial Crime with D3

Key Findings from Five Major Cybersecurity Reports

Trump’s Twitter Disabled: Protecting Against Insider Threats

See Your Response Plan in Action with D3’s Visual Playbook Editor

Next-Generation Threat Management: White Paper and Webinar

New Report Details the Fight Against Ransomware

Why D3 is the “Perfect” Incident Response Platform for Splunk Users

Avoiding Rigidity in Incident Response Automation

How to Get More Value from Your Junior Security Analysts

The Equifax Breach: How Companies Can Respond to Major Security Incidents

Saving Valuable Time with Security Automation

Involving “Legal” in Incident Response: The Three Pillars

D3 is the Most Popular Incident Management Software – ASIS Survey

The Importance of Full-Lifecycle IR to Support Automation

5 Common Incident Response Problems that SOAR can Help Solve

Cybersecurity Incident Response Buyer’s Guide

How to Avoid HIPAA’s Wall of Shame: Protecting Against Ransomware

Understanding Automated Incident Response

4 Ways Your IRP Can Help Reduce False Positives