Compromise Context Supercharges Incident Response

An average security team receives 3,000 notifications on a daily basis and this number increased by almost 20% last year. Combing through alerts is costing businesses an average of $1.5 million in overhead expenses on a yearly basis, and most CISOs have admitted to struggling to manage the rising number of notifications. 

From its outset, Lumu has offered an easy-to-use solution that drastically eases alert fatigue by going beyond Indicators of Compromise and alerting your teams only when a particular device is being contacted by infrastructure that belongs to the adversary. Now, we are strengthening this capability by including robust context around confirmed compromise incidents that enable teams to implement the right response in a timely manner. 

The context will help to answer questions like:

• How is the compromise spreading?
• What is the attacker’s objective?
• Is this happening anywhere else?
• How long has this been going on for?

Today, most security monitoring technologies don’t provide this kind of context out of the box. You need—in the best scenario—to invest a lot of time and effort creating rules, applying conditions, and more. But not with Lumu. 

Why this is important for security teams

As a part of a security team you have two big priorities: mitigate the threat as quickly as possible and take strategic decisions to avoid this threat in the future.

Typically, to mitigate threats security teams can take a combination of actions, such as attempting to block adversarial infrastructure, learning more about the type of threat, evaluating the scope of the problem in the organization, and identifying which devices are affected. All these things take time, and Lumu now has a single place to understand the compromise, which is key to security teams when responding to incidents.

After mitigation, the next important thing is to make strategic decisions that should include documentation about the attack and techniques, reveal the history behind the compromise, adjust the incident response playbooks, and identify if long term prevention strategies are required. With the context provided by Lumu making factual decisions is finally achievable in cybersecurity.

How Lumu provides enhanced compromise context

To address this ongoing problem, Lumu is introducing Compromise Context to help you be more efficient and effective in your daily operations. 

Compromise Context allows organizations to enrich confirmed compromise information and understand how the attack is moving, what the compromise distribution is, what the compromise behavior is, and more.