In his blog post, he cited three trends: More data held in the cloud and more networks outsourced; more APTs by nation states and; a continuing lack of investment in protection and detection, leaving the bulk of the burden on response.
But IR has been more on everybody's lips in 2014 than even a couple of years ago. The mantra of security experts is that it is not a matter of if, but when, an organization will be breached, and that an effective IR plan (combined with detection) can make attacks more of a nuisance than a disaster.
Getting IR right is crucial, but Tom Bain, vice president of CounterTack, calls it, "the hardest job in security. You can have all the technology in place to detect, prevent and analyze, but if your workflow is broken, or the team is so inundated with incident investigation, you are still vulnerable," he said.
More regulation, please
An industry that generally decries government regulation -- retail -- is now singing the opposite tune when it comes to cyber security.
A Nov. 6 letter signed by 44 state and national organizations representing retailers, addressed to the leaders of both houses of Congress, called for, "a single federal law applying to all breached entities (to) ensure clear, concise and consistent notices to all affected consumers regardless of where they live or where the breach occurs."
Sprickerhoff said such a law would be, "a good first step. There are 38 states with different definitions of what is a breach, so things are getting a bit out of hand," he said. "If you had unifying description of what needs to be done, that's not a bad thing."
But, of course, notification is not the same as improving security. And there are limits to what regulation can accomplish in that area.
"I worry that 'compliance with frameworks' attracts a lot of attention," said Richard Bejtlich, chief security strategist at FireEye. "I would prefer that organizations focus on results or outputs, like what was the time from detection to containment?
"Until organizations track those metrics, based on results, they will not really know if their security posture is improving," he said.
What to do?
There are, of course, no magic bullets in security. Isaacs said, noting that it's almost impossible to say what is the biggest threat. "I heard a speech where it was described as, "death by a thousand cuts," she said.
But experts do have suggestions. Sprickerhoff said more training is crucial, not just the security awareness of employees, but the next generation of IT security experts.
"I don't think it's ever been harder to find good people in IT security," he said. "There's not much in course work at the college level."
Sign up for Computerworld eNewsletters.