It’s overload, overload and overload–and we’re not even talking about laundry here.

So you’re the guy or gal charged with keeping the network environment safe, eh?  And you’re looking for help weeding through the torrents of threat information coming your way. Give me five minutes of your time and I’ll suggest a possible remedy.

If it were in my powers, I’d grant you another four hours in the working day where you could simple escape from your responsibilities without building-up a sleep debt.  Think about it; four free hours to help wipe away the cloud hanging over your head while drawing upon endless supplies of energy as if you were breathing pure oxygen in a Las Vegas casino.  Alas. my mere mortal status relegates me to more traditional solutions.

Frustration 1: Data overload

So few of you in these roles would disagree that IT security is a never ending task as there’s always something more to do.  Many start with the edict that we meet certain compliance mandates proving that our networks are secure, and only those expressly allowed to view private information are in fact permitted to do so.  Kudos to those who’ve achieved this objective and still have some available budget remaining.  Establishing some basic identity management and access control capabilities is a first step.

Once we know who is accessing our networks and where all the sensitive data resides, we’d like to understand more about when these  events are happening and what’s being communicated between the parties because it’s hard to identify discrepancies without a baseline.  This is where tools like QRadar SIEM help depict normal operations as people tend to use network resources in a fairly repeatable pattern.  Sudden changes in the behaviors of individual users or the amount of data they’re transmitting are ripe conditions for further forensic analysis activities, but identifying these conditions likely results in data overload.

Frustration 2: Solution overload

But the job of the security analyst is far from done.  Suppose for a minute that we’re able to overcome the first problem with data overload and we’ve reduced the critical SIEM notifications to something we can manage.  Now it’s time to illuminate the headlights and try to discover tomorrow’s problems.  Breaches start with the exploitation of typically known vulnerabilities, and there are currently thousands (70,000 according to X-Force Threat Intelligence Research) of documented Security vulnerabilities with an average of thirteen new problems reported on a daily basis into the National Vulnerability Database.

Chances are, you’re not running daily scans to detect either newly added network resources or the discovery of vulnerabilities associated with any newly reported conditions.  So when you run the next scheduled scan, you’re presented with the next level of data overload–more issues than time to address.

Using point solutions for SIEM, risk management and vulnerability management can mean jumping in and out of several different tools as you try to figure out where to start.

Frustration 3: False positive overload

The good news here is that many of the issues discovered may not be problems in the first place if you have a security intelligence solution that  leverages the available data to help narrow your focus, and the lynch-pin in this equation is visibility.  Point solutions that store their results in siloed repositories simply compound the overload effect and defeat your ability to eliminate false positives.

And while no vendor solutions are optimized to your particular environments, those that clearly depict the conditions underlying the identification of hundreds or thousands of offenses and vulnerabilities are the simplest to tune helping to reduce the overload of false positive conditions.

As you choose the tools that will help you succeed, we hope you’ll recognize the benefits of integration to address the three culprits of overload presented to security teams: data overload, solution overload and false positive overload.

Join us July 23rd to find out what’s NEXT with security intelligence.

I’d love to know your thoughts…

• Do you agree with these frustrations?
• What are your biggest sources of frustration when it comes to protecting your organization’s assets and network environment?
• Do you feel overloaded with security information and what techniques do you use to find evidence of attacks, breaches and existing exposures?
• What would you do with any extra time afforded using integrated tools with automated techniques for reducing the data into more actionable insights?