October 21, 2016 By Bob Kalka 3 min read

This is the second installment in a three-part series covering cybersecurity for the CIO. Be sure to read Part 1 for the first three questions every CIO should ask the organization’s security leader.

The operational core of any cybersecurity program consists of proper visibility into and response to cybersecurity events and threats. The security operations center (SOC) is typically the entity that builds and delivers this capability based on advanced intelligence and analytics.

The Next Two Questions for the Cybersecurity Leader

However, today’s SOCs struggle to execute across the basic components of a security operations and response program. CIOs should ask the organization’s cybersecurity leader the following questions to understand these components, their most common weaknesses and how to improve them.

4. What Is the Current Maturity Level of Our Security Analytics Capabilities?

Security analytics are necessary for providing broad visibility into potential and realized threats. There are four general levels of maturity in cybersecurity analytics:

  1. Analyzing events that have happened previously: That is, compiling potential cybersecurity events for analysis through the collection, normalization, correlation, reporting and monitoring of device logs. The technology for automating this process is referred to as security information and event management (SIEM).
  2. Analyzing events that are happening now: Here, online traffic flows and patterns are studied for normalcy, and analytics are used to identify the outliers that could indicate compromising activities.
  3. Applying forensics to confirm cybersecurity incidents: When an expanded set of sensitive content movement and user activity is analyzed, cybersecurity incidents can be validated for response faster and more accurately.
  4. Leveraging cognitive analysis to improve speed and accuracy of root-cause analysis: Cognitive computing uses machine learning to radically improve the speed and accuracy of processing and understanding huge amounts of information. It is estimated that 7,400 pages of new threat intelligence are generated every single day, making it physically impossible to fully consider all of this data in security assessment decisions.

Interestingly, today’s best practice is focused on implementing and tuning just the first two levels above, while the third level is just beginning to emerge as a priority. The fourth level — cognitive — is a revolutionary approach expected to explode in 2017.

The challenge is that the majority of firms are stuck on just the first level, using SIEM tools to collect huge amounts of log data — typically millions of entries a day. These companies struggle to tune the analytics around this data, rendering the work ineffective.

Ironically, this is one of the litmus tests an organization can use to determine whether its cybersecurity program is based on risk management or compliance. If the SIEM investment is tuned and effective, it’s usually because the prioritized list of business risks has driven a more accurate and focused tuning of event analytics.

CIOs must encourage the cybersecurity organization to improve its maturity to reach today’s best practice and explore the latter, more innovative levels. Better analytics means fewer cybersecurity incidents that affect the organization’s IT investments.

5. Do We Have an Explicitly Detailed, Well-Governed Incident Response Plan to Address Our List of Prioritized Cybersecurity Incidents?

Cybersecurity incidents are high-stress, high-impact and high-visibility affairs. When an organization confirms that it has experienced such an incident, the cybersecurity leader must consider and document how the IT team plans to respond to that particular event.

However, we discovered that the majority of organizations lack a formal, updated incident response plan that defines their highest priority incidents and keeps a formal run book of who will do what by when should an incident occur.

Without this, organizations fail to respond to cybersecurity incidents quickly or completely, thus putting themselves at an even greater risk. Since incident response plans typically involve many assets across the IT team, the CIO and cybersecurity leader must actively participate in ensuring that the updated plan is in effect.

Read Part 3 for the final installment in this series.

More from CISO

Empowering cybersecurity leadership: Strategies for effective Board engagement

4 min read - With the increased regulation surrounding cyberattacks, more and more executives are seeing these attacks for what they are - serious threats to business operations, profitability and business survivability. But what about the Board of Directors? Are they getting all the information they need? Are they aware of your organization’s cybersecurity initiatives? Do they understand why those initiatives matter? Maybe not. According to Harvard Business Review, only 47% of board members regularly engage with their CISO. There appears to be a…

The evolution of 20 years of cybersecurity awareness

3 min read - Since 2004, the White House and Congress have designated October National Cybersecurity Awareness Month. This year marks the 20th anniversary of this effort to raise awareness about the importance of cybersecurity and online safety. How have cybersecurity and malware evolved over the last two decades? What types of threat management tools surfaced and when? The Cybersecurity Awareness Month themes over the years give us a clue. 2004 - 2009: Inaugural year and beyond This early period emphasized general cybersecurity hygiene,…

C-suite weighs in on generative AI and security

3 min read - Generative AI (GenAI) is poised to deliver significant benefits to enterprises and their ability to readily respond to and effectively defend against cyber threats. But AI that is not itself secured may introduce a whole new set of threats to businesses. Today IBM’s Institute for Business Value published “The CEO's guide to generative AI: Cybersecurity," part of a larger series providing guidance for senior leaders planning to adopt generative AI models and tools. The materials highlight key considerations for CEOs…

Bringing threat intelligence and adversary insights to the forefront: X-Force Research Hub

3 min read - Today defenders are dealing with both a threat landscape that’s constantly changing and attacks that have stood the test of time. Innovation and best practices co-exist in the criminal world, and one mustn’t distract us from the other. IBM X-Force is continuously observing new attack vectors and novel malware in the wild, as adversaries seek to evade detection innovations. But we also know that tried and true tactics — from phishing and exploiting known vulnerabilities to using compromised credentials and…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today