Can Shortening The Cyber Stack Increase Stability?

The number of cybersecurity tools that make up the security stack have continued to increase - it’s now not uncommon to find 75-100 tools deployed in the average enterprise - and managing this stack is proving difficult.

The security team needs to learn the nuances of each solution, log in and out of them, and keep them updated. Consequently, CISOs acknowledge they would derive more benefit from improving control over the stack rather than buying in more tools. 

These tools generate numerous alerts, which means the stack also contributes to alert fatigue. This increases stress and burnout among the team, with VMware’s Global Incident Response Threat Report finding 51% of cybersecurity professionals had experienced extreme stress or burnout over the course of the past year leading 67% of those to take time off as a result. But alert fatigue is also dangerous because it can desensitise the team, which means threats can be miscategorised or ignored.

CISOs, too, are suffering the consequences of the bloated cyber stack. The Implications of Stress on CISOs report found 94% reported feeling stressed and 65% said it was compromising their ability to protect the organisation. The top solution to solving this stress as identified by 57% of CISOs? Consolidate the stack by placing multiple security technologies over a single platform.

Curbing Costs

Reducing complexity not only lessens pressure on the security team but can also help save costs associated with licensing, training and maintenance. This makes it even more compelling in today’s economic climate, where costs are escalating. Some businesses are choosing to outsource as a result to a Managed Security Services Provider (MSSP) to keep their costs under control and predictable.

It's these drivers – the need to reduce risk, stress and cost – that are now seeing CISOs focus on reducing the number of cybersecurity tools they have and the number of vendors they deal with. In 2020, only 29% of CISOs were pursuing such a strategy but that has now risen to 75% in a bid to improve overall risk posture, gain efficiencies of scale and eliminate the need to integrate separate tools, according to Gartner. 

Most are going about this by looking at how they can reduce the number of point solutions, vendors and integrations the security team must maintain. But this is no race to the bottom, as choosing to combine technologies over a single platform can enable the business to take advantage of more cutting-edge technologies. These can be easily integrated within the platform, making it possible to augment the functionality the business already has with complementary solutions. 

Complementary Tech

Take, for example, a modern Security Incident and Event Management (SIEM) solution. These are now usually mapped to the MITRE ATT&CK framework giving them threat hunting capabilities but these can be further enhanced. It’s possible to utilise machine learning and AI behaviour-based analysis via User Entity Behaviour Analytics (UEBA) and automated detection and response via Security Orchestration Automation and Response (SOAR), for example. 

UEBA provides contextual information. It applies parameters that monitor user behaviour while allowing for exceptions to the rule. But should a transgression occur, it then flags that behaviour for investigation. A good example would be where a user is granted access to certain file systems during a specific period. Any access outside of those hours would then be treated as suspicious and trigger an alert.

SOAR helps detect and mitigate threats more precisely, decreasing the mean time to detect and respond (MTTD and MTTR) to suspicious behaviour. It stores and prioritises alerts and security data from multiple sources and systems and automates incident response through the application of playbooks that then enable the team to investigate, contain and remove threats.

When Less Means More

The assimilation of these technologies into a singular platform to complement the SIEM is helping to move us away from point solutions and drive down complexity. But the benefits go further than that. Each technology complements but also supplements the other to provide much deeper insights. For instance, rather than alerts being treated as weak signals of possible compromise, native integration of different components into a converged platform makes it possible to fuse weak signals, benefit from environmental and situational contextual information and then to focus on what matters most. 

The converged dashboard also provides a single pane of glass through which to continuously monitor the entire IT landscape, making it possible for the CISO to more easily view, manage and report on the information estate.

But ultimately, it helps stabilise the organisation, by alleviating workloads and reducing stress fatigue, qualifying and focusing attention on the threats that matter and lowering maintenance costs. So that, far from shrinking the cyber estate, we should view convergence as a way of condensing and concentrating security efforts. 

Tim Wallen isRegional Director for the UK, US and Emerging at Logpoint                       Image: Kaboompics

You Might Also Read: 

Can Automation Help Bridge The Cyber Skills Gap?:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« The Unique TTPs Attackers Use To Target APIs
Qakbot Malware Taken Down »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

Intercede

Intercede

Intercede is a cybersecurity company specializing in digital identities, derived credentials and access control, enabling digital trust in a mobile world.

Bulletproof

Bulletproof

Bulletproof offer a range of security services, from penetration testing and vulnerability assessments to 24/7 security monitoring, and consultancy.

Oppida

Oppida

Oppida provides tailored IT security services to help you identify security gaps and assist in finding the most effective remediation.

Telspace Systems

Telspace Systems

Telspace Systems provides penetration testing, vulnerability assessment and training services.

MadSec Security

MadSec Security

MadSec Security is a leading consulting company whose expertise are information and cyber security.

SecureNinja

SecureNinja

SecureNinja provides professional training, certifications & professional services related to all facets of Information Technology and Cyber Security.

The Open Group

The Open Group

The Open Group: Leading the development of open, vendor-neutral IT standards and certifications.

Cask Government Services

Cask Government Services

Cask Government Services focuses on program management, cybersecurity, logistics, business analysis and engineering services for Federal, State and Local Government.

Trinity Cyber

Trinity Cyber

Trinity Cyber’s patent-pending technology stops attacks before they reach internal networks,reducing risk and increasing cost to adversaries.

ACET Solutions

ACET Solutions

ACET Solutions delivers a wide range of Automation, Cyber Security and Enterprise IT/OT Integration Solutions to industrial clients.

Albania Lab

Albania Lab

Albania Lab is a consulting company focused on the development and delivery of digital solutions and IT services including cybersecurity.

SignalFire

SignalFire

SignalFire invest across both enterprise and consumer sectors at the seed and early growth stages.

Morpheus Enterprises

Morpheus Enterprises

Morpheus Enterprises offer managed security solutions designed to keep your web applications secure and your business running smoothly.

Harbor Networks

Harbor Networks

Harbor Networks is a communications systems integrator and managed services provider. We provide business consultation services for voice and data communication technology.

Techsolidity

Techsolidity

Techsolidity is an emerging e-learning platform that offers a wide range of upskilling programs worldwide in areas including cybersecurity.

Red Maple Technologies

Red Maple Technologies

Started and run by engineers from the UK Intelligence and Defence communities, Red Maple is a technical consultancy and product company.