Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
Is Your Security Workflow Backwards?
The pace at which information security evolves means organizations must work smarter, not harder. Here's how to stay ahead of the threats.
4 Min Read
If you're like me, you typically make a list of items you need before you visit the supermarket. Sometimes you end up with a few more items than you planned. But in general, what you leave the supermarket with is about what you expected you would leave with. This is a fairly logical and straightforward way to approach a shopping trip, and so it is no surprise that many people shop this way.
Imagine, if you will, a different approach. What if you went to the supermarket, bought one of every item the store carried, paid for it all, searched through the items you purchased for the items you actually need, and subsequently returned the remaining items to the store? Sounds pretty inefficient and time consuming, doesn't it?
At this point, you're likely asking yourself what this supermarket-based thought exercise has to do with security. I would argue: all too much. You see, if we look at the security operations workflow of many security organizations, it more closely resembles the second supermarket example than the first.
Unfortunately, many security organizations still follow a fairly inefficient and time-consuming workflow. What do I mean by this? Let's enumerate (at a high level) how security organizations typically build their security operations workflow:
Sensing technologies, whether network-based, endpoint-based, or intelligence-based, are deployed around the enterprise.
Signature sets and detection algorithms are developed internally or leveraged from external sources.
An alert cannon ensues, with tens or hundreds of thousands of alerts blasted to the organization's unified work queue on a daily basis.
Analysts try to sift through the pile of alerts, looking for those of the highest fidelity, highest priority, and of the utmost urgency.
In a time-consuming process, the vast majority of alerts are "returned to the supermarket" (closed as false positives).
Rinse and repeat each day.
It may be a bit unnerving and uncomfortable to see this workflow presented so starkly and bluntly. Those who know me know I am a fan of directness, and sometimes it is the best way to get the message across. If you've worked in security operations and incident response for a little while, you know all too well the pain and somewhat illogical nature of the cycle of alert fatigue I've described above.
So what can organizations do to end the absurdity and work in a more logical and efficient manner? They can start by turning their entire security operations workflow on its head. I'll explain.
If we look at the second supermarket example and compare it with the security operations workflow enumerated above, there is a common thread that runs through them both. Instead of prioritizing at the beginning of the workflow, which would allow us to focus, define, and reduce the data set we subsequently need to work with, we prioritize at the end. Of course, the supermarket example illustrates the absurdity of this approach quite clearly. This is something that is much harder for most of us to see when we look at our respective security operations workflows.
So how can organizations prioritize at the beginning of the workflow, and what does that modified workflow look like? Here's an example:
Identify and prioritize risks and threats to the organization.
Identify assets and prioritize their criticality.
Identify where sensitive, critical, and proprietary data resides.
Develop targeted, precise, and incisive alert logic to identify activities of concern based on the results of the above three bullet points.
Give each resulting alert a priority and criticality score based on the threat it poses to the organization and the criticality of the assets and data it affects.
Send the prioritized alerts with associated background information regarding the assets and data they are associated with to the unified work queue.
Review the alerts in descending order, from highest priority to lowest.
As I hope you can see, the workflow enumerated here is far more efficient than the one I enumerated earlier. Of course, it takes a bit of an up-front investment in time to prioritize at the beginning of the workflow rather than the end. But this investment pays large dividends: analysts can focus on investigation, analysis, and response, rather than spending their time sifting through piles of false positives and noise.
In addition to allowing an organization to run security operations better and more efficiently, this approach also saves money. How so? Here are a few of the ways:
Expensive analyst resources are focused on the highest-value work, which increases team productivity with no additional labor cost.
Technology is acquired strategically, efficiently, and precisely — exactly where operational needs dictate and nowhere else.
Hardware resources can be optimized to fit the streamlined workflow of the organization, effectively doing more with less.
I don't know too many organizations that have an endless supply of time and money. The pace at which information security evolves means organizations must work smarter rather than harder. Attacking and optimizing the security operations workflow is one of the best ways an organization can improve its security posture.
Related Content:
About the Author
You May Also Like
More Insights
