The Securities and Exchange Commission (SEC) of the United States has adopted new regulations that require public companies to disclose material cybersecurity incidents within four days. To the positive, this initiative seeks to increase transparency and safeguard investors against potential cybersecurity risks. However, it also puts new weight and responsibility on enterprises that may not yet be ready for the challenge. Meeting this stringent 4-day standard means that enterprises now must be able to investigate cyberattacks swiftly and precisely to determine the significance of incidents. This was more feasible when incidents primarily impacted on-premises environments. Now that the threat landscape extends across multi-cloud and SaaS environments, there is an added measure of complexity in meeting the expectation.
What the SEC Ruling Means for Enterprises IR (Incident Response)
Companies must promptly evaluate the severity of a data breach to determine if it is "material" and requires immediate disclosure. This requires addressing three fundamental concerns regarding the occurrence:
1. What access did the attacker gain? It is crucial to quickly determine the extent of an attacker's access to an organization's systems. Enterprises must determine whether the intruder obtained unauthorized access, deeply penetrated critical infrastructure, or merely scratched the surface.
2. What data was compromised? Understanding the scope of data compromised during a cyber attack is crucial for assessing the enterprise’s potential risks and impact on its stakeholders. Identifying sensitive data that may have been compromised can aid in the formulation of an appropriate response.
3. Where did the attack originate? Determining the attack vector, i.e., the method used by the perpetrator to infiltrate the organization's network, is essential for assessing the sophistication level and potential risk. This data can inform future security measures and aid in the prevention of similar assaults.
Developing New Capabilities for Rapid Breach Investigations
To meet the SEC's stricter reporting deadlines, enterprises will not only require new organizational focus but also need to be enabled with the latest incident response capabilities. For example, enterprises must seek solutions that cover them across all their cloud and SaaS environments, offer greater degrees of visibility and breach readiness, and can analyze the forensic data collected to provide swift answers. Because traditional incident response methods routinely require weeks and months to collect data following a breach, it becomes clear how vital innovative approaches are.
Migita’s CIRA (Cloud Investigation and Response Automation) Solution Supports the New SEC Requirement
Mitiga’s IR2 platform provides an all-inclusive solution for cloud and SaaS environments that supports enterprises, before during, and after an attack through a mix of readiness, threat hunting, and automated response capabilities. We help organizations prepare for potential cyber assaults by proactively constructing a Forensic Data Lake and streaming the necessary forensic data to it from across their cloud and SaaS environments. When breaches occur, investigations can commence immediately. By using the leading-edge IR automation that we term “Forensics as Code,” our responders support team to provide swift answers. This approach significantly cuts response times that used to be measured in days and weeks to hours. Understanding the scope and impact of the breach enables businesses to make informed decisions about the significance of an attack and efficiently report to regulatory authorities, thereby assuring compliance and protecting shareholder interests.
