Ray Menard is one of the top security architects in IBM Security, and he took a break from his global travel schedule to offer some tips on how to keep your security team from drowning in data and ensure your networks are protected from malicious activity. With over a decade of experience in the security industry, Menard has helped countless clients navigate the complex world of network security.

A summary of Menard’s words of wisdom about the risks of shortsighted purchase decisions are below, and you can hear his full remarks in his on-demand webinar.

Question: Security spending seems to be at an all-time high, yet many companies don’t discover a breach until it’s too late. Why is that?

Answer: When we look at recent attacks, the reason for the attack is rarely attributed to poor security; businesses are investing and trying to do security correctly. Many security teams and tools are in place to look at structured log data, but we now have waves of unstructured data from places like social media coming into the organization.

The sheer volume of data really requires people to rethink their tool sets and operational models. You need to be sure that if you allocate budget to a security solution today, you know exactly what problem that will solve in the short and long term.

How should companies evaluate what type of solution they need?

Over the years, I’ve seen people try to shortcut the process of defining requirements and, in the end, they spend more money than they need to. Let me explain some common traps that teams fall into:

• Making a decision only on cost: If you’re facing a compliance audit, and you allow the focus to be just passing the audit, you’ll likely be pressured to buy the cheapest solution available. However, you’ll likely survive the audit but then realize what you have isn’t quite right. Don’t allow the business to pressure you to focus only on cost.

• Taking a narrow focus: You may be tempted to solve for a point problem, but take the time to really define your full set of requirements. Then make sure all stakeholders understand the requirements. After everyone understands the full scope of issues, you may find you can solve multiple problems with one solution. And when you solve multiple problems for a broad set of functions such as networking, databases and security, your total cost of ownership is lowered.

• Force-fitting what you have: It’s tempting to try to use something that you already have to solve a new security problem. Examine your situation carefully before you attempt to do this. It’s likely that it will take a significant amount of work, time and skills to adapt what you have, and often after a short period of time, something goes wrong. Make an honest assessment of how difficult it is to incorporate new requirements into what you have and then make the effort to explore all your options.

What are some of the risks of just using what you have to solve new types of security problems?

It’s human nature to default to what we know. However, that’s risky in this industry. While it’s easy to default to a solution that you may have learned in college or used at prior job, you need to step back and take a wide view. Define your requirements and what you want to accomplish first. Don’t commit budget to a project until you understand all the options.

Another scenario I come across is when an organization hires someone that knows a single technology and then builds an entire operation around it. If the solution is complex, training costs can skyrocket and negatively impact your time to value. And in the worst possible scenario, that person leaves the company for a new job and you’re left with a large gap. Ensure any solution that you adopt doesn’t require an army of specialists to run it. The more people you have maintaining a solution, the fewer people you have focused on actually doing security.

What’s important to look for in a solution?

The focus is really on speed and flexibility. The threat is constantly changing, so the security intelligence solution needs to be able to quickly adapt to the new landscape. Today, it’s taking teams too long to discover a breach, sometimes over 200 days. In some cases, your customers will discover the breach before you do, which results in loss of confidence and even loss of business.

Automating the analytics and reducing the time spent maintaining the security intelligence solution are force multipliers and add resource power to your organization so you can detect threats faster. This is what true security intelligence solutions should do.

To hear more from Ray about the various types of network security solutions and when to use managed security services, view the on-demand webinar “How Long Can You Afford to Wait to Discover a Network Breach?“