July 15, 2013 By Jay Bretzmann 3 min read

It’s overload, overload and overload–and we’re not even talking about laundry here.

So you’re the guy or gal charged with keeping the network environment safe, eh?  And you’re looking for help weeding through the torrents of threat information coming your way. Give me five minutes of your time and I’ll suggest a possible remedy.

If it were in my powers, I’d grant you another four hours in the working day where you could simple escape from your responsibilities without building-up a sleep debt.  Think about it; four free hours to help wipe away the cloud hanging over your head while drawing upon endless supplies of energy as if you were breathing pure oxygen in a Las Vegas casino.  Alas. my mere mortal status relegates me to more traditional solutions.

Frustration 1: Data overload

So few of you in these roles would disagree that IT security is a never ending task as there’s always something more to do.  Many start with the edict that we meet certain compliance mandates proving that our networks are secure, and only those expressly allowed to view private information are in fact permitted to do so.  Kudos to those who’ve achieved this objective and still have some available budget remaining.  Establishing some basic identity management and access control capabilities is a first step.

Once we know who is accessing our networks and where all the sensitive data resides, we’d like to understand more about when these  events are happening and what’s being communicated between the parties because it’s hard to identify discrepancies without a baseline.  This is where tools like QRadar SIEM help depict normal operations as people tend to use network resources in a fairly repeatable pattern.  Sudden changes in the behaviors of individual users or the amount of data they’re transmitting are ripe conditions for further forensic analysis activities, but identifying these conditions likely results in data overload.

Frustration 2: Solution overload

But the job of the security analyst is far from done.  Suppose for a minute that we’re able to overcome the first problem with data overload and we’ve reduced the critical SIEM notifications to something we can manage.  Now it’s time to illuminate the headlights and try to discover tomorrow’s problems.  Breaches start with the exploitation of typically known vulnerabilities, and there are currently thousands (70,000 according to X-Force Threat Intelligence Research) of documented Security vulnerabilities with an average of thirteen new problems reported on a daily basis into the National Vulnerability Database.

Chances are, you’re not running daily scans to detect either newly added network resources or the discovery of vulnerabilities associated with any newly reported conditions.  So when you run the next scheduled scan, you’re presented with the next level of data overload–more issues than time to address.

Using point solutions for SIEM, risk management and vulnerability management can mean jumping in and out of several different tools as you try to figure out where to start.

Frustration 3: False positive overload

The good news here is that many of the issues discovered may not be problems in the first place if you have a security intelligence solution that  leverages the available data to help narrow your focus, and the lynch-pin in this equation is visibility.  Point solutions that store their results in siloed repositories simply compound the overload effect and defeat your ability to eliminate false positives.

And while no vendor solutions are optimized to your particular environments, those that clearly depict the conditions underlying the identification of hundreds or thousands of offenses and vulnerabilities are the simplest to tune helping to reduce the overload of false positive conditions.

As you choose the tools that will help you succeed, we hope you’ll recognize the benefits of integration to address the three culprits of overload presented to security teams: data overload, solution overload and false positive overload.

Join us July 23rd to find out what’s NEXT with security intelligence.

 

I’d love to know your thoughts…

  • Do you agree with these frustrations?
  • What are your biggest sources of frustration when it comes to protecting your organization’s assets and network environment?
  • Do you feel overloaded with security information and what techniques do you use to find evidence of attacks, breaches and existing exposures?
  • What would you do with any extra time afforded using integrated tools with automated techniques for reducing the data into more actionable insights?

 

More from Intelligence & Analytics

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Web injections are back on the rise: 40+ banks affected by new malware campaign

8 min read - Web injections, a favored technique employed by various banking trojans, have been a persistent threat in the realm of cyberattacks. These malicious injections enable cyber criminals to manipulate data exchanges between users and web browsers, potentially compromising sensitive information. In March 2023, security researchers at IBM Security Trusteer uncovered a new malware campaign using JavaScript web injections. This new campaign is widespread and particularly evasive, with historical indicators of compromise (IOCs) suggesting a possible connection to DanaBot — although we…

Accelerating security outcomes with a cloud-native SIEM

5 min read - As organizations modernize their IT infrastructure and increase adoption of cloud services, security teams face new challenges in terms of staffing, budgets and technologies. To keep pace, security programs must evolve to secure modern IT environments against fast-evolving threats with constrained resources. This will require rethinking traditional security strategies and focusing investments on capabilities like cloud security, AI-powered defense and skills development. The path forward calls on security teams to be agile, innovative and strategic amidst the changes in technology…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today