In the field of psychology, Maslow’s hierarchy of needs (sometimes also referred to as Maslow’s pyramid of needs) has become the established model for illustrating human needs. This describes how people generally first have the need to eat, and can only strive for ‘higher’ needs, such as self-actualisation, once their fundamental needs have been met. If fundamental needs are not met, the higher-level needs cannot be satisfactorily achieved either. This concept can also be applied to cyber security: the incident response pyramid offers a structured approach to improving security measures in a targeted manner.
The nine levels of the pyramid
The incident response hierarchy describes nine successive stages, ranging from a basic assessment to active threat defence.
Inventory (assessment)
The foundation of any security strategy is a complete inventory of one’s own systems and assets. Without this knowledge, effective protection remains impossible, because ‘you can only protect what you know’.
Telemetry
Transparency is crucial. Organisations must ensure that they can monitor and analyse all relevant system activities.
Detection
The ability to identify unauthorised or suspicious activity is essential. Without effective detection, attacks often go unnoticed.
Triage (Prioritisation & Classification)
Not every detected activity is a threat. Organisations must be able to assess and prioritise incidents in order to deploy resources effectively.
Threats (Threat Analysis)
This is about knowing the adversary: which attackers are active, what methods do they use, and what risks does the organisation face? As Sun Tzu wrote, ‘He who knows himself but not the enemy will suffer a defeat for every victory.’
Behaviours (Behavioural Detection)
Advanced defence mechanisms are based on the analysis of behavioural patterns to identify malicious activity at an early stage.
Hunt (Proactive Threat Hunting)
Reactive detection is not enough. Organisations should actively search for attackers who have already infiltrated their systems in order to eliminate them.
Track (Threat Tracking)
During an ongoing attack, it is crucial to monitor and track the adversaries’ activities in real time.
Act (Take action & implement countermeasures)
The highest level involves active defence, including the implementation of proven countermeasures and collaboration with trusted partners to disrupt attacks.
Origin of the concept
The underlying concept was developed by Microsoft employee Matt Swann as the ‘Incident Response Hierarchy of Needs’ and has been translated into many languages, including German by Mint Secure. Further information and downloadable PowerPoint slides in various languages can be found here on GitHub.
Why the pyramid is relevant for organisations
The Incident Response Hierarchy of Needs helps organisations systematically improve their cybersecurity strategy. In particular, it enables them to target specific improvements in the areas of Incident Response and security monitoring. Rather than taking isolated measures, it offers a clear roadmap for strengthening the security architecture, from an assessment of the current situation to actively defending against threats.
Mint Secure GmbH
How Mint Secure supports you in this
What level has your organisation already reached? We help you systematically climb to the next level of the pyramid.
Security Audit
An assessment of your systems, assets and existing telemetry as the foundation for a robust security strategy.
Incident Response
Establishing and optimising detection, triage and response processes so that incidents are quickly identified and contained.
Threat Hunting
Proactively searching for attackers already embedded in your environment, rather than simply waiting for alerts.
Could you be even better prepared for incidents?
We’ll show you where you currently stand on the pyramid. Get in touch now.
Conclusion
The pyramid of needs for incident response applies a tried-and-tested psychological model to cyber security. From assessment through telemetry and detection to proactive threat hunting and active defence, each level builds on the previous one and cannot be sustainably achieved without a solid foundation.
Organisations that systematically develop their security architecture across these nine levels improve their ability to detect incidents at an early stage and stop them with high effectiveness.
Want to find out where your organisation stands? Get in touch with us.
