The challenges of cybersecurity have been covered ad nauseum: the ever-increasing volume and sophistication of attacks, the shortage of skilled cybersecurity analysts, and the general inability to keep up with all that is going on in the cybersecurity market have all been well documented.
So, what can be done? Given all these conditions, how can a business better protect their operations and resources? The short answer is they can start using a combination of technologies, services and education to stem the impact of cyber-attacks on their organization.
Technologies Can Help Fill the Gap Created by the Skills Shortage
Organizations can look for technologies that are primed to automate and orchestrate responses to cyberattacks.
This is not a new concept – back in 2011, the US Department of Homeland Services described, in their paper “Enabling Distributed Security in Cyberspace,” an ecosystem where “cyber devices are able to work together in near-real time to anticipate and prevent cyberattacks, limit the spread of attacks across participating devices, minimize the consequences of attacks, and recover to a trusted state.”
This is very different from what most organizations have today. Typically, companies have a host of cybersecurity technologies, from firewalls and to that are working alongside, but not in concert with one another. Each solution is specialized to look for something – e.g. evidence of a distributed denial of service attack, indicators that a user’s credentials have been compromised, pointers to data being leaked via cloud apps, signs that a mobile device has been taken over, etc.
Each of these solutions requires someone to deploy, manage and maintain it, as well as make sense of the information it generates. The data these solutions produce and the people managing them often remain in a silo, making it hard for anyone or anything to see the complete picture to quickly and confidently take action, as appropriate. But change is coming.
Half of the respondents (55%) to a survey by Intel Security “believe cybersecurity technologies will evolve to help close the skills gap within five years.” Likely this will come in the form of advances in intelligence, automation and orchestration. We have already seen vendors dabble with artificial intelligence (AI) and machine learning to accelerate the identification of an attack and support the orchestration of more automated responses.
It has been particularly effective when entities or events can be easily incriminated or exonerated, such as in the incident response process. A large organization can average close to 17,000 alerts a week, which is why only one in five alerts ends up being something worth dealing with.
A solution, however, that can automate investigations and help prioritize subsequent activities is sustainable. Hence, we have seen an explosion in the IR automation market – the Enterprise Strategy Group found that 56% of enterprise organizations “are already taking action to automate and orchestrate incident response processes;” Technavio has the IR system market growing at a compound annual growth rate (CAGR) of 13%.
To truly ease the burden on cybersecurity analysts and improve the efficiency and productivity of their cybersecurity infrastructure, organizations need to look for and demand more of these kinds of innovations from their technology vendors.
Services Play a Viable Role in Augmenting Capabilities
The reality is there are always times when organizations, even those with SOCs that are skilled and staffed appropriately, may need a little help. This is where services come in; we are finding there is greater acceptance that augmenting resources with a service offering can be a good way to enhance the effectiveness of an organization’s cybersecurity strategy and implementation.
An outsider’s view can give organizations the knowledge they need, a fresh perspective or a new way of thinking that helps drive better decision-making and ultimately better security.
The problem is managed security services providers (MSSP) are having to staff up themselves to meet the demand, which is why we’ve seen some a lot movement in this space. For example, there has been FireEye’s acquisition of Mandiant, IBM’s acquisition of Lighthouse Security, and BAE System’s acquisition of SilverSky, etc.
Ultimately, being able to deliver the experience and know-how organizations need will help close the gap and strengthen overall security.
Educational Opportunities are Key to Bolstering General Awareness and Expertise
At the end of the day, nothing replaces the knowledge and expertise of an in-house analyst. Only they truly understand an organization’s nuances, putting them in the best position to effectively identify, contain and fully remediate many of the more sophisticated attacks targeting the organization.
Unfortunately, as we’ve already mentioned, these folks are in short supply, so organizations need to look across their IT organization to develop cybersecurity awareness and know how.
Training courses taught by experts with real-world experience and include lab time are invaluable for building the skills that will be applicable to strengthen the organization’s security stance. Virtual sandboxes (vSandbox) and Ultimate Test Drives (UTD) are also good tools to deploy. They allow attendees to test and work with solutions in a safe environment, so they can see firsthand how they can be deployed and used to improve the cybersecurity capabilities of the organization’s own environment.
Ultimately, to address the cybersecurity gap and all the threats that are targeting an organization, it will take a confluence of technologies, services and experiential learning. Together, organizations can deploy the skills and capabilities they need to keep up, and ideally get ahead, in this harried cybersecurity landscape.