Overhauling the 3 Pillars of Security Operations

Change is hard — especially when what needs to be changed has made progress against long-pursued goals. Transitions involving digital transformation, cloud migration, and application architecture are disrupting security operations in fundamental ways. Just as orchestration and automation, machine learning, and collaborative defense enable progress for traditional defenses, new challenges of modernizing IT — including increased threat surface area, transient infrastructure, and growing use of apps and the cloud — demand new approaches for the core defense functions of threat detection and investigation.

A large majority of security pros surveyed in our "2018 Global Security Trends in the Cloud" report observe that as their organization transitions to the cloud, there is a corresponding increase in the need for security and operations to collaborate, sometimes awkwardly, during threat detection and investigation. Further, over 80% of respondents note the need to examine threats at both the application and infrastructure layers. While a surprising 93% say current security tools are ineffective for the cloud, many assert that several traditional categories such as security information and event management (SIEM) — which create cumbersome silos of data, analytics, and workflow — should be completely rethought for the cloud.

The interests of the status quo advocate incrementalism to address these issues, such as bringing cloud data into the traditional SIEM, automating manual workflows, and layering additional tools for specialized analytics. But many security leaders see the need for a more disruptive break with the past to address three weaknesses of current security practices:

1. Siloed security can't understand and respond to the new generation of attacks.
One dilemma in security for cloud and modern application development/deployment is that the knowledge needed to pursue an investigation to its conclusion often is divided between two groups. Security analysts understand the process of investigation and the broad context, but only the operations team is apt to understand the essential specific context — application behavior and customer content, for example — needed to interpret and hypothesize at many steps in a security investigation.

"Dual-ticket" workflows in which cloud and ops teams have unique insight on application and network performance, DevSecOps workflows in which deep knowledge of the application is needed to map vulnerabilities to threat-detection methods, and investigation workflows that demand specific understanding of microservice logging practice are all good examples of where security must be democratized across groups as IT modernizes.

While separate silos for operations and security investigations made sense for classic on-premises systems, modern cloud deployments and application architecture demand a seamless back-and-forth workflow where, at each step, the skills and perspective from both operations and security can properly interpret the results of queries, evidence uncovered, or unfamiliar data. Despite the uncomfortable change on many levels, enabling collaborative real-time workflows is the only real answer.

2. Current-generation security tools lack essential application and cloud context.
Current tools rely too much on comfort zones with traditional infrastructure. Containers, microservices, distributed applications, DevSecOps — all of these trends create massive threat surface areas that demand security defenses have new insights into data. Specifically, much deeper insight into application layer and cloud context is needed for many workflows. Examples include cross-site scripting attacks, mapping microservices to dynamic infrastructure, and external customer behavioral analytics in production security.

Distributed applications in the cloud, container orchestration, and complex hybrid and multicloud use cases will continue to exacerbate the blind spots of traditional infrastructure-focused security. Developing new cloud and application insights with pattern recognition, machine learning, and context capture, and then packaging these insights for practical use, is one of the next frontiers in the evolution of security.

3. Humans and machines must collaborate 100x faster.
Many security operation centers are already at the breaking point with growing backlogs of investigations and reactive triage. An often-quoted statistic is that less than 10% of investigations are completed in a typical security operation.

Cloud and modern application transitions multiply the threat surface many times over, generating staggering volumes of data that need to be rapidly assimilated for insights. Further, cross-enterprise collaboration is requiring new models of distributed knowledge transfer because investigation workflows need to be shared across both security and operations.

Industry hype suggests artificial intelligence, machine learning, and improved automation will rapidly replace humans in every workflow in the next few years, but the reality is that there will be a long transition in which optimizing human and machine collaboration is essential to scale the defense. Although much can be automated, human context is still essential in many security workflows.

Breakthrough innovation in search speeds, data navigation and workflow learning will be needed to connect the dots across large and dynamic data sets. Furthermore, to keep pace, many investigation workflows must compress to minutes from the current hours — and sometimes days — despite the worsening data avalanche problem that is a result of cloud and application transitions.

Many enterprises are rethinking architectures, workflows, and tooling to tackle these challenges. The accelerating rate of the underlying transitions to cloud, digital transformation, and new application architectures is putting pressure on the pace of change.

Related Content:

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.