Security blindness: Too many alerts and too few resources

Every new innovation that drives toward productivity and efficiency opens the doors to new threats to information assurance and safety. Those who attacked in hopes of gaining public notoriety and/or accolades from fellow hackers have figuratively stepped aside, making way for serious cybercriminals and nation states with far more sinister intent. Not a week passes without news of a new, devastating breach, targeting private identities and intellectual property, bringing financial damage and harming brand reputation. And security, a discipline once relegated to the back corners of IT, has moved to the forefront in discussions.

While the security industry responds to vulnerabilities in new technologies, actually mounting a formidable defense against today’s adversaries remains elusive. Close inspection demonstrates that current defense paradigms are archaic, introducing inefficiencies while missing a holistic view. A lack of skilled resources, budget constraints and tactical approaches have led to a haphazardly assembled strategy and a hodgepodge of solutions leading to an exposed enterprise.

Given their limited resources, security vendors solve the most high-profile problems with a rush to market. Thus, they continue to disseminate heterogeneous solutions, littering enterprises with point products. More important, many of the vendors do not have the real-world experience to face the complex adversaries in today’s world, delivering solutions based on static defense strategies. Seeking to stretch their investments, IT security vendors comply with a timeworn approach that lacks the capability for combat and resiliency in an intricate and shifting threat environment. While their products may support a specific function, they do not collectively work together, falling short of implementing a comprehensive, coordinated security posture.

To add to the burden, enterprises are awash with alerts. Each disparate security tool sends out a notification in its own format to its own console, leaving analysts scurrying among multiple terminals to come up with few meaningful clues about overall threat activity. In fact, security teams get so overwhelmed, according to industry research, that they investigate a mere 4 percent of alerts. At the end of the day, when an alert is determined to merit action, teams can respond only with piecemeal, manual processes.

With the number of alerts their systems spew out, these teams face difficulties prioritizing the most critical ones, much less responding to them. Just 19 percent of alerts are reliable, and 40 percent of infections go undetected, according to additional research. A dearth of required skills and experienced staff creates more headaches. Therefore, as security technologies grow in sophistication, organizations find that they don’t have the resources to effectively interpret and drive value out of newer solutions.

For years, security solutions “faced outward” to safeguard the perimeter with layers of prevention. IT leaders now realize that, while prevention is critical, it is not enough. Once a persistent threat enters the organization and defeats all defenses, networks lay open in a vulnerable state. Hence, experts say it is a question of if -- not when -- any given enterprise will suffer a compromise.

What’s worse, security information and event management tools do little to change this reality. SIEM offers visibility of logs and some other related data, but is essentially static. Furthermore, it cannot process the volume and variety of data that is flooding in from heterogeneous sources. It does not provide a complete enough picture to lead teams to the appropriate consoles to address the issue. To initiate a response, SIEM requires lengthy manual procedures to correlate information, identify patterns and understand context.

With organizations grudgingly accepting an “assumption of compromise” as the new normal, today’s teams should advance beyond SIEM and build a unified, dynamic platform. At its core, the unified, dynamic platform is analytics driven, establishing end-to-end visibility across the enterprise with the expressed intent of profiling attacks, unearthing patterns in threat activity and tracking movements of intruders. The newer generation, dynamic analytics platform is purposeful, features a single intuitive interface to all data and delivers powerful correlation, modeling and visualization capabilities to discern complex attack profiles. It can predict threats and gain insights from them to make informed decisions about mitigation and remediation.

A “single plane of glass” console proves key here. That’s where security analysts quickly see what is transpiring across networks, through a single, intuitive interface. Because the interface is intuitive, teams do not need degrees in data science and years of experience to use it. 

Collectively, organizations have created an enterprise security ecosystem over many years. They cannot readily “rip and replace” the ecosystem. But that doesn’t mean it should stay the way it is. The environment must evolve to directly confront today’s threats. Through a dynamic analytics platform, security teams will better prepare themselves  for anything. This is the future of cybersecurity.