Ray Menard is one of the top security architects in IBM Security, and he took a break from his global travel schedule to offer some tips on how to keep your security team from drowning in data and ensure your networks are protected from malicious activity. With over a decade of experience in the security industry, Menard has helped countless clients navigate the complex world of network security.

A summary of Menard’s words of wisdom about the risks of shortsighted purchase decisions are below, and you can hear his full remarks in his on-demand webinar.

Question: Security spending seems to be at an all-time high, yet many companies don’t discover a breach until it’s too late. Why is that?

Answer: When we look at recent attacks, the reason for the attack is rarely attributed to poor security; businesses are investing and trying to do security correctly. Many security teams and tools are in place to look at structured log data, but we now have waves of unstructured data from places like social media coming into the organization.

The sheer volume of data really requires people to rethink their tool sets and operational models. You need to be sure that if you allocate budget to a security solution today, you know exactly what problem that will solve in the short and long term.

How should companies evaluate what type of solution they need?

Over the years, I’ve seen people try to shortcut the process of defining requirements and, in the end, they spend more money than they need to. Let me explain some common traps that teams fall into:

  • Making a decision only on cost: If you’re facing a compliance audit, and you allow the focus to be just passing the audit, you’ll likely be pressured to buy the cheapest solution available. However, you’ll likely survive the audit but then realize what you have isn’t quite right. Don’t allow the business to pressure you to focus only on cost.
  • Taking a narrow focus: You may be tempted to solve for a point problem, but take the time to really define your full set of requirements. Then make sure all stakeholders understand the requirements. After everyone understands the full scope of issues, you may find you can solve multiple problems with one solution. And when you solve multiple problems for a broad set of functions such as networking, databases and security, your total cost of ownership is lowered.
  • Force-fitting what you have: It’s tempting to try to use something that you already have to solve a new security problem. Examine your situation carefully before you attempt to do this. It’s likely that it will take a significant amount of work, time and skills to adapt what you have, and often after a short period of time, something goes wrong. Make an honest assessment of how difficult it is to incorporate new requirements into what you have and then make the effort to explore all your options.

What are some of the risks of just using what you have to solve new types of security problems?

It’s human nature to default to what we know. However, that’s risky in this industry. While it’s easy to default to a solution that you may have learned in college or used at prior job, you need to step back and take a wide view. Define your requirements and what you want to accomplish first. Don’t commit budget to a project until you understand all the options.

Another scenario I come across is when an organization hires someone that knows a single technology and then builds an entire operation around it. If the solution is complex, training costs can skyrocket and negatively impact your time to value. And in the worst possible scenario, that person leaves the company for a new job and you’re left with a large gap. Ensure any solution that you adopt doesn’t require an army of specialists to run it. The more people you have maintaining a solution, the fewer people you have focused on actually doing security.

What’s important to look for in a solution?

The focus is really on speed and flexibility. The threat is constantly changing, so the security intelligence solution needs to be able to quickly adapt to the new landscape. Today, it’s taking teams too long to discover a breach, sometimes over 200 days. In some cases, your customers will discover the breach before you do, which results in loss of confidence and even loss of business.

Automating the analytics and reducing the time spent maintaining the security intelligence solution are force multipliers and add resource power to your organization so you can detect threats faster. This is what true security intelligence solutions should do.

To hear more from Ray about the various types of network security solutions and when to use managed security services, view the on-demand webinar “How Long Can You Afford to Wait to Discover a Network Breach?

More from Intelligence & Analytics

BlackCat (ALPHV) Ransomware Levels Up for Stealth, Speed and Exfiltration

9 min read - This blog was made possible through contributions from Kat Metrick, Kevin Henson, Agnes Ramos-Beauchamp, Thanassis Diogos, Diego Matos Martins and Joseph Spero. BlackCat ransomware, which was among the top ransomware families observed by IBM Security X-Force in 2022, according to the 2023 X-Force Threat Intelligence Index, continues to wreak havoc across organizations globally this year. BlackCat (a.k.a. ALPHV) ransomware affiliates' more recent attacks include targeting organizations in the healthcare, government, education, manufacturing and hospitality sectors. Reportedly, several of these incidents resulted…

9 min read

Despite Tech Layoffs, Cybersecurity Positions are Hiring

4 min read - It’s easy to read today’s headlines and think that now isn’t the best time to look for a job in the tech industry. However, that’s not necessarily true. When you read deeper into the stories and numbers, cybersecurity positions are still very much in demand. Cybersecurity professionals are landing jobs every day, and IT professionals from other roles may be able to transfer their skills into cybersecurity relatively easily. As cybersecurity continues to remain a top business priority, organizations will…

4 min read

79% of Cyber Pros Make Decisions Without Threat Intelligence

4 min read - In a recent report, 79% of security pros say they make decisions without adversary insights “at least the majority of the time.” Why aren’t companies effectively leveraging threat intelligence? And does the C-Suite know this is going on? It’s not unusual for attackers to stay concealed within an organization’s computer systems for extended periods of time. And if their methods and behavioral patterns are unfamiliar, they can cause significant harm before the security team even realizes a breach has occurred.…

4 min read

Why People Skills Matter as Much as Industry Experience

4 min read - As the project manager at a large tech company, I always went to Jim when I needed help. While others on my team had more technical expertise, Jim was easy to work with. He explained technical concepts in a way anyone could understand and patiently answered my seemingly endless questions. We spent many hours collaborating and brainstorming ideas about product features as well as new processes for the team. But Jim was especially valuable when I needed help with other…

4 min read