It’s overload, overload and overload–and we’re not even talking about laundry here.

So you’re the guy or gal charged with keeping the network environment safe, eh?  And you’re looking for help weeding through the torrents of threat information coming your way. Give me five minutes of your time and I’ll suggest a possible remedy.

If it were in my powers, I’d grant you another four hours in the working day where you could simple escape from your responsibilities without building-up a sleep debt.  Think about it; four free hours to help wipe away the cloud hanging over your head while drawing upon endless supplies of energy as if you were breathing pure oxygen in a Las Vegas casino.  Alas. my mere mortal status relegates me to more traditional solutions.

Frustration 1: Data overload

So few of you in these roles would disagree that IT security is a never ending task as there’s always something more to do.  Many start with the edict that we meet certain compliance mandates proving that our networks are secure, and only those expressly allowed to view private information are in fact permitted to do so.  Kudos to those who’ve achieved this objective and still have some available budget remaining.  Establishing some basic identity management and access control capabilities is a first step.

Once we know who is accessing our networks and where all the sensitive data resides, we’d like to understand more about when these  events are happening and what’s being communicated between the parties because it’s hard to identify discrepancies without a baseline.  This is where tools like QRadar SIEM help depict normal operations as people tend to use network resources in a fairly repeatable pattern.  Sudden changes in the behaviors of individual users or the amount of data they’re transmitting are ripe conditions for further forensic analysis activities, but identifying these conditions likely results in data overload.

Frustration 2: Solution overload

But the job of the security analyst is far from done.  Suppose for a minute that we’re able to overcome the first problem with data overload and we’ve reduced the critical SIEM notifications to something we can manage.  Now it’s time to illuminate the headlights and try to discover tomorrow’s problems.  Breaches start with the exploitation of typically known vulnerabilities, and there are currently thousands (70,000 according to X-Force Threat Intelligence Research) of documented Security vulnerabilities with an average of thirteen new problems reported on a daily basis into the National Vulnerability Database.

Chances are, you’re not running daily scans to detect either newly added network resources or the discovery of vulnerabilities associated with any newly reported conditions.  So when you run the next scheduled scan, you’re presented with the next level of data overload–more issues than time to address.

Using point solutions for SIEM, risk management and vulnerability management can mean jumping in and out of several different tools as you try to figure out where to start.

Frustration 3: False positive overload

The good news here is that many of the issues discovered may not be problems in the first place if you have a security intelligence solution that  leverages the available data to help narrow your focus, and the lynch-pin in this equation is visibility.  Point solutions that store their results in siloed repositories simply compound the overload effect and defeat your ability to eliminate false positives.

And while no vendor solutions are optimized to your particular environments, those that clearly depict the conditions underlying the identification of hundreds or thousands of offenses and vulnerabilities are the simplest to tune helping to reduce the overload of false positive conditions.

As you choose the tools that will help you succeed, we hope you’ll recognize the benefits of integration to address the three culprits of overload presented to security teams: data overload, solution overload and false positive overload.

Join us July 23rd to find out what’s NEXT with security intelligence.


I’d love to know your thoughts…

  • Do you agree with these frustrations?
  • What are your biggest sources of frustration when it comes to protecting your organization’s assets and network environment?
  • Do you feel overloaded with security information and what techniques do you use to find evidence of attacks, breaches and existing exposures?
  • What would you do with any extra time afforded using integrated tools with automated techniques for reducing the data into more actionable insights?


More from Intelligence & Analytics

BlackCat (ALPHV) Ransomware Levels Up for Stealth, Speed and Exfiltration

9 min read - This blog was made possible through contributions from Kat Metrick, Kevin Henson, Agnes Ramos-Beauchamp, Thanassis Diogos, Diego Matos Martins and Joseph Spero. BlackCat ransomware, which was among the top ransomware families observed by IBM Security X-Force in 2022, according to the 2023 X-Force Threat Intelligence Index, continues to wreak havoc across organizations globally this year. BlackCat (a.k.a. ALPHV) ransomware affiliates' more recent attacks include targeting organizations in the healthcare, government, education, manufacturing and hospitality sectors. Reportedly, several of these incidents resulted…

9 min read

Despite Tech Layoffs, Cybersecurity Positions are Hiring

4 min read - It’s easy to read today’s headlines and think that now isn’t the best time to look for a job in the tech industry. However, that’s not necessarily true. When you read deeper into the stories and numbers, cybersecurity positions are still very much in demand. Cybersecurity professionals are landing jobs every day, and IT professionals from other roles may be able to transfer their skills into cybersecurity relatively easily. As cybersecurity continues to remain a top business priority, organizations will…

4 min read

79% of Cyber Pros Make Decisions Without Threat Intelligence

4 min read - In a recent report, 79% of security pros say they make decisions without adversary insights “at least the majority of the time.” Why aren’t companies effectively leveraging threat intelligence? And does the C-Suite know this is going on? It’s not unusual for attackers to stay concealed within an organization’s computer systems for extended periods of time. And if their methods and behavioral patterns are unfamiliar, they can cause significant harm before the security team even realizes a breach has occurred.…

4 min read

Why People Skills Matter as Much as Industry Experience

4 min read - As the project manager at a large tech company, I always went to Jim when I needed help. While others on my team had more technical expertise, Jim was easy to work with. He explained technical concepts in a way anyone could understand and patiently answered my seemingly endless questions. We spent many hours collaborating and brainstorming ideas about product features as well as new processes for the team. But Jim was especially valuable when I needed help with other…

4 min read