Can Shortening The Cyber Stack Increase Stability?

The number of cybersecurity tools that make up the security stack have continued to increase - it’s now not uncommon to find 75-100 tools deployed in the average enterprise - and managing this stack is proving difficult.

The security team needs to learn the nuances of each solution, log in and out of them, and keep them updated. Consequently, CISOs acknowledge they would derive more benefit from improving control over the stack rather than buying in more tools. 

These tools generate numerous alerts, which means the stack also contributes to alert fatigue. This increases stress and burnout among the team, with VMware’s Global Incident Response Threat Report finding 51% of cybersecurity professionals had experienced extreme stress or burnout over the course of the past year leading 67% of those to take time off as a result. But alert fatigue is also dangerous because it can desensitise the team, which means threats can be miscategorised or ignored.

CISOs, too, are suffering the consequences of the bloated cyber stack. The Implications of Stress on CISOs report found 94% reported feeling stressed and 65% said it was compromising their ability to protect the organisation. The top solution to solving this stress as identified by 57% of CISOs? Consolidate the stack by placing multiple security technologies over a single platform.

Curbing Costs

Reducing complexity not only lessens pressure on the security team but can also help save costs associated with licensing, training and maintenance. This makes it even more compelling in today’s economic climate, where costs are escalating. Some businesses are choosing to outsource as a result to a Managed Security Services Provider (MSSP) to keep their costs under control and predictable.

It's these drivers – the need to reduce risk, stress and cost – that are now seeing CISOs focus on reducing the number of cybersecurity tools they have and the number of vendors they deal with. In 2020, only 29% of CISOs were pursuing such a strategy but that has now risen to 75% in a bid to improve overall risk posture, gain efficiencies of scale and eliminate the need to integrate separate tools, according to Gartner. 

Most are going about this by looking at how they can reduce the number of point solutions, vendors and integrations the security team must maintain. But this is no race to the bottom, as choosing to combine technologies over a single platform can enable the business to take advantage of more cutting-edge technologies. These can be easily integrated within the platform, making it possible to augment the functionality the business already has with complementary solutions. 

Complementary Tech

Take, for example, a modern Security Incident and Event Management (SIEM) solution. These are now usually mapped to the MITRE ATT&CK framework giving them threat hunting capabilities but these can be further enhanced. It’s possible to utilise machine learning and AI behaviour-based analysis via User Entity Behaviour Analytics (UEBA) and automated detection and response via Security Orchestration Automation and Response (SOAR), for example. 

UEBA provides contextual information. It applies parameters that monitor user behaviour while allowing for exceptions to the rule. But should a transgression occur, it then flags that behaviour for investigation. A good example would be where a user is granted access to certain file systems during a specific period. Any access outside of those hours would then be treated as suspicious and trigger an alert.

SOAR helps detect and mitigate threats more precisely, decreasing the mean time to detect and respond (MTTD and MTTR) to suspicious behaviour. It stores and prioritises alerts and security data from multiple sources and systems and automates incident response through the application of playbooks that then enable the team to investigate, contain and remove threats.

When Less Means More

The assimilation of these technologies into a singular platform to complement the SIEM is helping to move us away from point solutions and drive down complexity. But the benefits go further than that. Each technology complements but also supplements the other to provide much deeper insights. For instance, rather than alerts being treated as weak signals of possible compromise, native integration of different components into a converged platform makes it possible to fuse weak signals, benefit from environmental and situational contextual information and then to focus on what matters most. 

The converged dashboard also provides a single pane of glass through which to continuously monitor the entire IT landscape, making it possible for the CISO to more easily view, manage and report on the information estate.

But ultimately, it helps stabilise the organisation, by alleviating workloads and reducing stress fatigue, qualifying and focusing attention on the threats that matter and lowering maintenance costs. So that, far from shrinking the cyber estate, we should view convergence as a way of condensing and concentrating security efforts. 

Tim Wallen isRegional Director for the UK, US and Emerging at Logpoint                       Image: Kaboompics

You Might Also Read: 

Can Automation Help Bridge The Cyber Skills Gap?:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« The Unique TTPs Attackers Use To Target APIs
Qakbot Malware Taken Down »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall And Why Does It Matter

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall And Why Does It Matter

See how to use next-generation firewalls (NGFWs) and how they boost your security posture.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Riverbed Technology

Riverbed Technology

The Riverbed Network and Application Performance Platform enables organizations to visualize, optimize, accelerate and remediate the performance of any network for any application.

Conscio Technologies

Conscio Technologies

Conscio Technologies is a specialist in IT security awareness. Our solutions allow you to easily manage innovative online IT awareness campaigns.

CERT-SE

CERT-SE

CERT-SE is the national and governmental Computer Security Incident Response Team of Sweden.

Assuria

Assuria

Assuria Cyber Security solutions provide protective monitoring of systems and user activity across the whole IT infrastructure.

Capita

Capita

Capita is a consulting, digital services and software business, providing end-to-end enterprise IT services and solutions focused around digital transformation and innovation.

BaseN

BaseN

BaseN is a full stack IoT Operator. We control the full value chain in order to provide ultimate scalability, fault tolerance and security to our customers.

REVI-IT

REVI-IT

REVI-IT is a Danish state-owned audit firm focusing on enterprise IT business processes and compliance,

Kudelski Security

Kudelski Security

Kudelski Security is an international cybersecurity company providing innovative, independent and tailored security solutions for large enterprise and public sector clients.

FixMeStick

FixMeStick

FixMeStick is a virus removal device, a USB key that removes malware conventional antivirus software often can’t detect.

AVORD

AVORD

AVORD is a cloud-based security testing platform that allows clients to manage security testing requirements in a far more productive and efficient way.

Cyan Securiy Group

Cyan Securiy Group

Cyan provide best-in-class cyber security solutions for mobile Internet and mobile devices that are extremely effective and highly intuitive in their use.

SurePassID

SurePassID

SurePassID is a provider of highly secure, highly extensible multi-factor authentication (MFA) solutions.

INE

INE

INE is a premier provider of Technical Training for the IT industry.

Innovex Global

Innovex Global

Innovex is a full-service executive search and advisory business that engages with early-stage startups, scale-ups, and established businesses in the Fintech, Cybersecurity and Technology industries.

CYSIAM

CYSIAM

CYSIAM provides world-leading expertise in offensive security and critical incident response. We train our clients to be able to protect themselves and respond to attacks and breaches when they occur.

Material Security

Material Security

Material is solving one of the most fundamental problems in security: protecting the data sitting in mailboxes.