The exponential rise in attacks has made executives more proactive. Firewalls, antivirus, IPS and IDS will not prevent every intrusion. It is not if, it is when.
1. Not on the lookout
You cannot protect what you cannot see.
2. Not having the mojo
You need technical responders plus Legal, IT, HR, PR.
3. Not having a budget
Translate technical needs into business relevance.
4. Running with your head cut off
You need a written IR playbook with defined roles.
5. Just following everyone's lead
Strike a balance between policy and the right decisions in a crisis.
6. Not the right threat model
Focus most effort on most valuable assets.
7. Not knowing your devices
Tune and configure devices. Neglecting to retune leads to alert overload.
Originally published 13 April 2017. Migrated to the new IRC site in 2026.