We are living in a new security reality. Cybercriminals are increasing both their collaborative efforts and the sophistication of their attacks. Meanwhile, those who defend against them remain siloed and under-resourced.

Currently, 80 percent of cyberattacks are driven by highly funded, collaborative cybercriminal groups who are sharing knowledge about targets and vulnerabilities. What’s more, sophisticated threats from these collaborative groups are rising in numbers and scale, expanding to more than 4 billion records leaked in 2016. That’s more than the combined total from the two previous years.

But how well are white-hat organizations collaborating to keep pace so that they can protect, detect and respond to these growing attacks?

Poor Integration at the Technology Level

Some enterprises have as many as 85 security tools from 45 different vendors. Many of these disparate point products aren’t integrating, communicating or providing security teams with the visibility they need for seamless, holistic protection.

At the same time, the volume of data is growing exponentially, adding complexity and risk to an already fragmented infrastructure. Siloed security controls are generating more alerts than organizations can feasibly respond to with their limited time and resources. According to Cisco’s “2017 Annual Cybersecurity Report,” 44 percent of security alerts go uninvestigated, increasing the likelihood that a costly breach will go undetected for months.

Siloed Departments at the People Level

Although the IT talent shortage is contributing to successful cyberattacks, a lack of collaboration throughout the organization is another culprit. The events of WannaCry and Petya showed a dangerous disconnect between security teams, which detect threats, and IT operations teams, which implement controls to prevent threats — not to mention the growing problem of shadow IT. After all, security teams can’t protect what they don’t know about.

These organizational silos don’t stop there. Consider the lack of collaboration between the C-suite, board of directors, human resources, marketing and finance. All of these groups should be actively participating in their organization’s security efforts, but many enterprises lack a cohesive, cross-functional security strategy.

Lack of Visibility at the Processes Level

While organizations may have documented security controls and processes in place, the breakdown lies in not sharing or integrating those processes between teams. Processes often stand alone with no visibility or continuity outside of individual departments. In the examples of WannaCry and Petya, there wasn’t a fully integrated process between monitoring malware alerts and delivering patch updates.

Change control processes that are not effectively managed and communicated across the organization can increase the risk of a security breach. One team might only be able to see part of a system, fail to realize the dependency or risk to another system, and inadvertently weaken security by making an unapproved change. Even if there are tight, collaborative processes detecting threats on the front end, 3 in 4 organizations still lack a consistent incident response plan.

Connecting People, Processes and Technology With a Collaborative Defense Strategy

How can organizations better collaborate between people, processes and technology for more effective threat defense?

Many companies practice defense-in-depth strategies, which focus on deploying a multilayered defense system centered on IT infrastructure, physical assets and personnel training to protect vital data assets. While this approach is still considered one of the best defense models out there, cybercriminals are now able to circumvent many traditional defenses by launching stealthier, sophisticated attacks that are difficult to detect and stop. It’s time we modernized defense in depth to combat cybercrime with the power of collaboration.

Collaborative defense in depth solves disparate security challenges within an organization’s people, processes and technologies. It encourages a more converged approach by integrating and streamlining threat defense.

This strategy starts with technology at its core. By embracing the practice of building strong, open integrations — both within a security vendor’s portfolio and between solutions from multiple vendors — organizations can accelerate threat defense and extend security capabilities beyond what each technology could provide on its own.

Dive Deeper at Think 2018

Learn more about how IBM Security is supporting collaborative defense in depth at Think 2018. There you can hear the latest about the IBM X-Force Exchange and how IBM security experts are working with other threat intelligence platforms to improve threat defense.

Learn about open APIs in products such as IBM QRadar SIEM and IBM Resilient Security Orchestration, Automation, and Response (SOAR) Platform, which are spurring the development of new plug-and-play integrations with IBM business partners. You can also look at the latest apps on the IBM Security App Exchange to streamline and strengthen your security posture while maximizing technology investments. More than 20 partners will be at the Think Security and Resiliency Campus to showcase these collaborative solutions and integrations.

Of course, collaborative defense doesn’t stop at technology — it’s the people and processes that drive those technologies. We know cybercriminals are collaborating, so we should be too.

Watch the full session from Think 2018: Collaborative Defense — Accelerating Threat Protection with Partnerships and Advanced Integrations

More from Intelligence & Analytics

The 13 Costliest Cyberattacks of 2022: Looking Back

2022 has shaped up to be a pricey year for victims of cyberattacks. Cyberattacks continue to target critical infrastructures such as health systems, small government agencies and educational institutions. Ransomware remains a popular attack method for large and small targets alike. While organizations may choose not to disclose the costs associated with a cyberattack, the loss of consumer trust will always be a risk after any significant attack. Let’s look at the 13 costliest cyberattacks of the past year and…

What Can We Learn From Recent Cyber History?

The Center for Strategic and International Studies compiled a list of significant cyber incidents dating back to 2003. Compiling attacks on government agencies, defense and high-tech companies or economic crimes with losses of more than a million dollars, this list reveals broader trends in cybersecurity for the past two decades. And, of course, there are the headline breaches and supply chain attacks to consider. Over recent years, what lessons can we learn from our recent history — and what projections…

When Logs Are Out, Enhanced Analytics Stay In

I was talking to an analyst firm the other day. They told me that a lot of organizations purchase a security information and event management (SIEM) solution and then “place it on the shelf.” “Why would they do that?” I asked. I spent the majority of my career in hardware — enterprise hardware, cloud hardware, and just recently made the jump to security software, hence my question. “Because SIEMs are hard to use. A SIEM purchase is just a checked…

4 Most Common Cyberattack Patterns from 2022

As 2022 comes to an end, cybersecurity teams globally are taking the opportunity to reflect on the past 12 months and draw whatever conclusions and insights they can about the threat landscape. It has been a challenging year for security teams. A major conflict in Europe, a persistently remote workforce and a series of large-scale cyberattacks have all but guaranteed that 2022 was far from uneventful. In this article, we’ll round up some of the most common cyberattack patterns we…