What does MTTD stand for and measure?

What does MTTD stand for and measure?

• A. The average time to recover from a security incident.
• B. The mean time it takes to detect a security incident.
• C. The time required to contain an incident.
• D. The duration of a security audit

Answer: (B)

MTTD stands for Mean Time To Detect, and it measures the average time from when a security incident begins to when it is detected. This focuses on how quickly threats are discovered, which is crucial because shorter detection times reduce the window attackers have to do damage—the dwell time. The metric is calculated by taking the detection time for each incident, subtracting the incident start time, summing those values, and dividing by the number of incidents. The other options describe different things: recovery time to restore operations, time to contain the incident, or the duration of an audit. These are separate metrics and do not define what MTTD measures. Lower MTTD indicates faster detection and a stronger ability to respond before an attacker can cause more harm.

MTTD stands for Mean Time To Detect, and it measures the average time from when a security incident begins to when it is detected. This focuses on how quickly threats are discovered, which is crucial because shorter detection times reduce the window attackers have to do damage—the dwell time. The metric is calculated by taking the detection time for each incident, subtracting the incident start time, summing those values, and dividing by the number of incidents.

The other options describe different things: recovery time to restore operations, time to contain the incident, or the duration of an audit. These are separate metrics and do not define what MTTD measures. Lower MTTD indicates faster detection and a stronger ability to respond before an attacker can cause more harm.