Dwell Time In Cyber Security

Do you know how much time an attacker spends on information gathering about the target??……..a lot. That is why reconnaissance is the most important stage of pre-attack.

But have you ever thought that after compromising something how much time attacker spend into the target’s network before they leave or caught?? This leads us to Dwell Time.

Dwell time is the time from the point of infiltration to the point of detection.

This is a term that you’ll hear often in incident response, threat hunting, and maybe even threat intelligence.

Dwell Time represents the length of time a cyber attacker has free reign in an environment from the time they get in until they are eradicated.

Attackers spend this time to understand network, know vulnerabilities and launching exploits. Lengthy Dwell Times give attackers more opportunity to access private data and observe and record user and network behavior as well as to plant secondary malware or APTs. It is a top concern for all organizations since the issue impacts brand reputation and legal repercussions.

Research shows that attackers spend an average of 200 days inside a network before being eradicated . Imagine the damage an attacker could inflict over that period of time. If attackers can be contained in less time and subsequently have access to less enterprise surface area, they will burn through more resources to get what they want.

How it is measured??

This can only be assessed by tracing the threat back to its origin. Determine when and where the compromise came from, in addition to tracing those lateral movements. It is determined by adding Mean Time to Detect (MTTD) and Mean Time to Repair/Remediate (MTTR) and is usually measured in days. It is sometimes referred to as the breach detection gap.

How to reduce it??

The goal should be to reduce dwell time as much as possible, providing the attacker the least amount of opportunity to achieve lateral movement and remove critical data from your organization.

Steps for reducing it is given below:

1. Fundamentals security controls.

2. Thorough monitoring and Meeting the challenges

3. Alert rules

4. Incident response plans

5. Actionable Prediction of Human Behavior

6. User Awareness

Thank You……