Security Tool Sprawl Reaches Tipping Point

The typical security team today continues to struggle with the same frustrating and potentially dangerous problem: a sea of security tools that churn out waves of alerts and siloed data that often requires manual correlation — or get altogether dismissed by overburdened security analysts.

"If it takes a SOC analyst more than three clicks to make a decision, he/she is going to move on. They have thousands of other alerts" waiting for them, says Jill Cagliostro, product strategist for security firm Anomali.

That frightening — but understandable — conundrum for security analysts who under so much pressure that they literally pitch some alerts that take too much time to investigate underscores the perils and real possibility of missing that one needle in a haystack in security operations centers (SOCs) today. At the root of the alert overload, of course, is a mix of multiple security tools from various vendors — most of which don't work together and security analysts don't even have time to fully master.

Organizations on average run some 25 to 49 security tools from up to 10 different vendors, according to the Enterprise Strategy Group (ESG), and 40% of organizations are so taxed, according to 451 Research, that they can't act upon at least a quarter of their security alerts. And in many cases, that's leading to organizations literally shutting off some alerting functions, SOC vendor CriticalStart found.

"There have been a lot of research studies that find the whole issue of interoperability and scalability is largely ignored, so as a result the technologies don't actually work together and you have more [tools] than you need," Larry Ponemon, president of the Ponemon Group, said in an interview with Dark Reading in July. "So many things are generating reports [and alerts] ... you are in a state of information overload pretty quickly."

But the tipping point may finally be near. A gradual wave of security-tool consolidation and aggregation — thanks in part to some strategic acquisitions — as well as a new vendor effort led by IBM and McAfee for an open source set of specifications for tool interoperability, could finally streamline and integrate tools and, ultimately, workloads for SOC analysts.

The newly formed Open Security Consortium (OCA), part of the OASIS open source standards organization, will come up a common way for security tools to present data and communicate with and message one another. "Essentially, the goals of the alliance are interoperability, and collaboration around various different standards, tools, procedures, and open source libraries to enable that interoperability," says Jason Keirstead, chief architect for IBM Security Threat Management.

The alliance isn't all about creating new standards, Keirstead says, although new ones could emerge eventually. "It's around collaborating on how we interoperate with each other."

OCA — which also includes members Advanced Cyber Security Corp., Corsa, CrowdStrike, CyberArk, Cybereason, DFLabs, EclecticIQ, Electric Power Research Institute, Fortinet, Indegy, New Context, ReversingLabs, SafeBreach, Syncurity, ThreatQuotient, and Tufin — initially announced its first two protocols, existing work from its co-founders IBM and McAfee. The first is IBM's open source data library STIX-Shifter, based on the STIX2 data model standard, which grabs threat information from various data repositories and converts it to a common format for all security tools that adopt STIX-Shifter. OCA also released McAfee's OpenDXL Standard Ontology, which supports the OpenDXL (based on the Data Exchange Layer standard) messaging standard for communicating and sharing security information among different security products.

The OCA's open source releases are available to all security vendors, even nonmembers of the consortium, as well as enterprises that want to incorporate the technologies. The goal, according to the OCA, is to easily integrate security detection, threat hunting, analytics, and other tools so they can operate together "out of the box."

"It's less about combining [security tool] screens and more about assuring the multiple tools a customer has all interoperate with each other and [enterprises] don't have to spend so much time maintaining those integrations," IBM's Keirstead says. "A customer can swap out any one vendor and add a competitor's and they will work seamlessly."

Several security experts welcomed the OCA's effort. "I think it's a step in the right direction," says Jon Oltsik, senior principal analyst with Enterprise Strategy Group. Security organizations for years have been collecting and storing security data in various places and trying to analyze the same data across different tools, he says. And an open source integration layer effort lowers vendors' R&D burden, he adds.

Even so, Oltsik says he wonders why more large organizations themselves aren't driving such an effort rather than the vendors. "One thing that concerns me is you would think the demand side would be driving this versus the supply side," such as large financial firms, he says. "I'd like to see some big buy-side organizations" calling for vendors to support these open source standards if they want to sell to them, he says.

Current Consolidation Situation

MSSPs also face some of the same challenges as enterprise SOCs when it comes to integrating and streamlining tools. Kevin Hanes, COO at Secureworks, says the OCA effort for data "normalization" is a positive step by the industry. It's not an easy task today, he admits: "We have solved that through a variety of ways, with us doing the hard work to bring the normalization to our platform," Hanes says. "The more that can be solved at a higher plane ... that helps everyone."

It's common for startups to get funding to focus on a specific "pain point" in security and then roll out these very focused tools, he notes. But these and other tools then don't actually work together, he says. 

The OCA effort comes at a time when several security tool vendors already have been adding products and features that aggregate others' products, as well as the consolidation of security orchestration and automation (SOAR) into bigger platforms. Splunk now owns SOAR vendor Phantom, and Palo Alto Networks owns SOAR vendor Demisto, for example, and Elastic recently acquired endpoint security firm Endgame. Experts say more technology acquisitions and integrations are on the horizon.

"There's some pretty significant consolidation happening in the market right now," says James Carder, CISO at LogRhythm. "The reason being, I think, is that SIEM as promised decades ago was the be-all, end-all, single pane of glass for the modern SOC. Now there's SOAR, endpoint security, network components, and all those pieces that are in the SOC."

Carder says vendors are trying to consolidate SOC tools, including endpoint, SIEM, and SOAR, into single platforms, and build appropriate integration among the tools. "That's a trend we're seeing now in the SOC itself."

LogRhythm is doing that with its updated SIEM platform, NexGen SIEM Platform, which combines SOAR, log management, security analytics, and network monitoring, for example, he says. "We may look at other acquisitions that could bolster [it] and give a SOC-in-a-box" offering, he says.

The OCA security-tool interoperability effort is a "sound" approach, Carder says. "Having a standard taxonomy and language and method for all different security technologies out there is a dream state of the industry where you don't have to build these special integrations with" multiple products, he says.

Even so, the industry is a long way from achieving that reality, he notes. There also are the non-security applications that have security ties to consider, he says, such as physical security systems like cameras or badging systems in an organization, and even human resources applications. For example, if a user logs in from an atypical location and suspicious network activity ensues, an HR app can't necessarily be queried to automatically check if he or she is on vacation, or if the user's credentials have been compromised. "You're still building one-off integration" with products outside security, Carder explains.

Some recently announced security tool integrations also demonstrate the pressure for vendors to unite disparate security tools. Security management platform vendor ReliaQuest, for example, acquired Threatcare earlier this month and plans to add its attack simulation technology to its GreyMatter security platform.

{Continued on Next Page}

{Continued from Page 1}

GreyMatter basically aggregates security data from SIEMs, endpoint detection and response tools, firewalls, threat intelligence feeds, and other security tools, in addition to providing some of its own analytics and automation functions. "The main problem we want to solve is tools fatigue and vendor sprawl," says Joe Partlow, CTO of ReliaQuest. "CISOs are trying to adapt and get greater coverage of their attack surface, but the opposite is happening: not greater visibility ... but instead more complexity and data residing in silos" and more alerts than they can handle, he says.

GreyMatter basically does the dirty work of pulling together the different tools and their data. It gathers the data from the tools and then "normalizes" that data into a standard format for the platform. That replaces the spreadsheet-merging approach many organizations use to sort and correlate data from various tools.

Aaron Sherrill, a senior analyst at 451 Research, says many security tools are mostly just narrowly focused security features that ultimately get swallowed up by other vendors or get wrapped inside existing platforms — or fall by the wayside. "I view GreyMatter as aggregating a few different security approaches, [including] a managed service provider, SOAR, attack simulation," and some other security tools, Sherrill says. "It's [also] an opportunity for them to go a little deeper and look at the effectiveness of the tools in place," too, by providing the status and health of the various security tools in the organization's environment.

Anomali's Cagliostro, meanwhile, points out that one of the big drivers of security tool consolidation is security team turnover, which often results in losing expertise in specific security tools. When an analyst with expertise in reverse engineering gets hired away, for instance, notes Cagliostro, "institutional knowledge goes out the door with him."

Her firm's newly released Lens tool aims to provide all levels of the organization, including SOC analysts as well as company executives, alerts of an attack underway and what to do about it. Lens basically creates automated threat bulletins out of content it gathers online from threat intelligence findings, cybersecurity news articles, security logs, and other sources of threat information. Those bulletins then get absorbed into Anomali's threat intel system. Lens, the threat intel platform, and Anomali Match, an analysis tool, together make up Anomali's Altitude security management platform.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Can the Girl Scouts Save the Moon from Cyberattack?"