Learn about the issue of overreliance on detection solutions in the security stack. EDR, XDR and SIEM are great for triage, remediation and preventative measures. Unfortunately, when they fail to recognize threats or falsely identify them, security teams suffer in terms of both time and money.
To address the issue of overreliance on detection solutions in the security stack, organizations must prioritize and score alerts according to their environment. Doing so reduces noise in the security space and allows security operators to make efficient use of their resources.
Overreliance on Detection Solutions
Overreliance on detection solutions to detect threats can present several issues. False positives, for instance, are a major headache for security teams as they waste valuable time and resources investigating false positives. Furthermore, false positives negatively affect the security team’s capacity for making informed decisions.
Another problem arises due to the growing volume of noise generated by all the detection tools deployed across an organization’s network. For instance, a single security analyst might need to work on alerts from multiple firewalls, IPS/IDS, routers, web and email security, endpoint security systems, SIEM tools, as well as incident response playbooks.
Due to their often complex design and maintenance requirements, these systems can become overburdened with alerts. A security analyst might need to sift through tens of thousands of notifications before identifying one that truly indicates a threat.
To address these concerns, many vendors have developed unified incident detection and response platforms that collect and correlate data from existing security tools and processes for centralized visibility. These solutions – known as Extended Detection and Response (XDR) platforms – offer organizations the most out of their investment in detection tools.
For optimal XDR platform performance, not only should it offer a comprehensive selection of high-quality use case based detection but also be capable of automatically creating them based on its programming and both external and internal knowledge of an environment. Doing this helps reduce false alarms and boost alert quality for security teams.
A novel approach to detection called detection engineering applies a systems thinking and engineering mindset to detection rules. This involves writing detections as code and automating them using the CI/CD process. Furthermore, it includes other necessary processes like pentesting, purple teaming, sandboxing and threat hunting which ensure accurate writing of detections is done.
Insufficient Threat Intelligence
Threat intelligence is an integral component of cybersecurity, helping security teams recognize and respond to threats in real-time. It enables them to build defenses against cyberattackers that last beyond one incident. But for this benefit to be fully realized, you need the right intelligence sources integrated into your security stack.
Threat intelligence consists of four main categories: strategic, operational, tactical and evidence-based. Each type can be utilized to enhance your company’s security posture and protect against specific types of attacks.
Strategic threat intelligence is provided to executives and high-level decision-makers so they can plan business strategies around potential risk and compromise. This type of intelligence provides a high-level, risk-based perspective that’s most useful for non-technical audiences.
This type of intelligence can offer detailed details on the techniques, tactics and procedures attackers use to target your organization. It also gives you a greater appreciation of your own vulnerabilities and helps prioritize tasks that will reduce the risks from cyberattacks.
Tactical intelligence is more technical in nature and meant to be utilized quickly. It may contain indicators of compromise (IOCs) as well as machine-readable data such as URLs, domain names, and IP addresses. This type of threat intelligence can typically be accessed through “intelligence feeds,” which update detection capabilities within firewalls, SIEMs, SOARs, and other security tools.
Security teams need access to operational intelligence through an intelligent platform that compiles threat data from various sources and analyzes it in real-time. This could be a vendor-based solution, community-based service or public source.
A smart intelligence platform utilizes the three core components of threat intelligence – aggregation, analysis and action – to filter out false alerts that divert attention away from real issues. This process involves collecting raw data about existing and emerging threat actors, threats and indicators of compromise from multiple sources and analysing, enriching and comparing it with curated intelligence to produce a threat intelligence feed and management report.
A reliable threat intelligence platform will automatically sift through all data to identify and eliminate false positives, saving analysts the effort of manually searching through hundreds of alerts. Furthermore, it makes finding relevant information much simpler for security team members; additionally, they can share this resulting data with other teams within your organization such as incident response or defense so they can take immediate action on it.
False Positives
False positives are a frequent problem in machine-learning systems. Examples include valid email messages being blocked by anti-spam solutions, unexploitable software defects being flagged by software analysis tools, and normal application traffic being identified as malicious by intrusion detection systems.
False positives are an enormous burden for analysts and security operations teams, taking up valuable time that could otherwise be put to better use on real threats. According to Kaspersky’s recent survey, 75% of enterprises report spending more time dealing with false positives than genuine security incidents.
Reducing false positives is therefore paramount for maintaining an effective cybersecurity posture and averting negative outcomes for businesses. To assist businesses in reducing false positives, the following methods may be beneficial:
First and foremost, teams should guarantee their security rules have a low false-positive rate. Doing so will prevent teams from receiving too many alerts in response to threats that don’t actually occur.
Another way to prevent false positives is by employing advanced analytics to filter out and eliminate potential threats. This can be accomplished either through real-time analysis of collected data, or by incorporating historical information into the system’s algorithms.
Additionally, teams must monitor and identify red flags as soon as they appear. For instance, if an antivirus or email security solution detects an untrusted file or web link, the team should immediately block or quarantine it to prevent further contamination of systems which could lead to more costly issues in the future.
Additionally, teams should utilize automated detection processes to guarantee they are only alerted of threats with a high likelihood of exploitability or damage. Doing this will save teams time from spending too much vetting and investigating every alert, while guaranteeing serious security issues receive adequate attention.
A low false-positive rate also helps teams stay alert to threat alerts and vulnerability reports, which is an issue common in IT and which can have a major effect on team morale.
Blind Spots
One of the greatest threats to security stack is blind spots. These are areas in a security ecosystem which cannot be detected by users or sensors, leaving them vulnerable to attackers.
One way to prevent blind spots in your business is by conducting a blind spot analysis. This process identifies outdated assumptions and conventions within the industry that could stifle creative ideas or hinder decision making.
Blind spot analysis is a two-step process. First, you collect competitive intelligence on the target company’s top executives’ assumptions about their industry structure from sources such as annual reports, letters to shareholders, interviews in the press, public appearances and industry meetings.
Step 2 is then to compare the top executives’ assumptions about an industry structure with your actual analysis from Step 1. Any discrepancies between them can be indicative of a potential blind spot.
Blind spots can be hazardous for drivers and passengers alike. They could lead to various accidents, including collisions with pedestrians, other vehicles, animals or more; they also carry the potential for severe injuries like lacerations or even death.
