DMS Alerts Should Be Key To Organisations’ Security Orchestration

Research shows that the Security Orchestration, Automation and Response (SOAR) Market is expected to grow by 15.8% (CAGR) from 2022 to 2027. That’s not surprising, given the perfect storm of conditions that have been brewing since the onset of the pandemic. 

Ransomware and other cyber attacks are on the increase, particularly now that remote and hybrid working present new attack surfaces, while at the same time, over-stretched IT teams means there’s a paucity of cyber security skills available to deploy against the rising threat. 
 
To help keep their heads above water, many organisations are investing in security orchestration to streamline their wider security operations centre (SOC) strategy, connecting siloed security tools, such as Security Information and Event Management (SIEM), to help automate threat alerts, monitoring, and remediation.

However, an essential element is often ignored as part of this streamlined security strategy: the organisation’s document and email management system (DMS). 

This is a significant oversight, because the DMS houses “the crown jewels” of the organisation: valuable client information, confidential documents, and other sensitive files. This is especially the case at professional services firms such as law, accounting, and financial services, all of whom are lucrative targets for cyber security criminals, due to the nature of privileged data they hold. 

So, why does this gap in the overall security strategy tend to form - and how can it be best addressed? 
 
Outside The Normal Flow

The key focus of IT is to look after the infrastructure and the widely used systems connected within this infrastructure: networking components, communication systems, endpoint devices, and so on. As a general rule, if a system sits within “infrastructure”, IT is in charge of monitoring, analysing and identifying any emerging threat patterns around it.

So far, so good. But when you're looking at a more dedicated or specialised type of system – like a DMS – it often may not fall under the umbrella of IT. It could be seen as belonging to an individual business department, or whichever teams are most heavily using it.

Here’s where we run into a problem. The SOC team relies on their SIEM dashboards to monitor attack patterns across the infrastructure but isn’t getting alerts or real-time information from potential insider or external threats involving the DMS. Instead, these alerts may go to a senior member of the department using the DMS or the CIO. Or they may not be getting picked up at all.

Allowing the DMS to sit outside the standardised flow of incident monitoring and threat management like this is problematic. But there is a better way. Incorporating DMS-centric threat patterns and alerts gives the SOC team access to an additional set of data points that can help determine whether a threat is actually present or not and if it warrants further action. This can include usage patterns that might indicate if something out of the ordinary is happening, such as data exfiltration from disgruntled employees, misuse of privileged accounts or stolen credentials.

Integration Is Key

To break down any silos in their security operations strategy, organisations need to consider an integrated approach that brings threat monitoring capabilities from all systems and applications, especially those holding sensitive data, together in the same place.

From a practical perspective, organisations should ask their current or prospect DMS providers if their application offers threat monitoring based on usage analytics and integration of any DMS alerts into the SOC team’s SIEM tool of choice via industry standard services, such as REST APIs. 

This is the goal for organisations to shoot for – one that effectively eliminates any gaps and risk of data loss that stem from not incorporating the DMS into an integrated SOC ecosystem.

The DMS Needs To Be Part Of The Conversation

#SOC teams are already overworked and operating in high-pressure environments. Security orchestration and automation provides an effective way to reduce that stress, but in taking a streamlined approach, organisations shouldn’t forget about their DMS. Especially if their DMS already provides the means to communicate with their integrated IT security stack.

The DMS needs to be part of the conversation. If it’s not, organisations will continue to have a gap that they’ll need to mind.

Manuel Sanchez is Global Product Marketing Manager at iManage

You Might Also Read:

Detect Spoofing Before Your Organisation Suffers Fraud:

 

« Chinese Internet Companies Required To Disclose Algorithm Data
US Government Will Invest $15 Billion In National Cyber Security »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

RIVA Solutions

RIVA Solutions

RIVA provides innovative best practices in IT and management consulting, program support services and emerging technologies.

Contrast Security

Contrast Security

Contrast Security is the leader in modernized application security, embedding code analysis and attack prevention directly into software.

360Logica

360Logica

360Logica is a software testing company offering numerous kinds of testing services to improve the quality and performance of your software and IT systems.

Enigmedia

Enigmedia

Enigmedia provide solutions for the encryption of audio and video calls across all devices including Smartphones, Tablets and PCs.

Falanx Group

Falanx Group

Falanx Group protect and defend businesses against global cyber security threats.

DefCamp

DefCamp

DefCamp is the most important annual conference on Hacking & Information Security in Central Eastern Europe.

ComCERT

ComCERT

ComCERT SA is an independent, private consulting company focusing in the assistance of its customers facing the dangers of cyber threats and security incidents.

Altitude Networks

Altitude Networks

Altitude Networks is at the forefront of enterprise cloud security and data loss protection, protecting your company’s data against unauthorized access, accidental or malicious sharing, and theft.

HI Counter Fraud Group (HICFG)

HI Counter Fraud Group (HICFG)

HICFG is an association of various health insurers, travel insurers and managing agents, dedicated in detecting and preventing fraud in all forms against the insurance industry globally.

GB Group (GBG)

GB Group (GBG)

GBG is a global technology specialist in fraud, location and identity data intelligence.

AUTOCRYPT

AUTOCRYPT

AUTOCRYPT is a mobility security provider dedicated to the safety of future transportation

VLATACOM Institute

VLATACOM Institute

Vlatacom Institute is privately owned accredited research and development institute, system integrator and turn-key solution provider. Areas of expertise include encryption and authentication.

Sparrow

Sparrow

Sparrow specializes in application security testing solutions to cope with new technology trends such as cloud, mobile, and DevSecOps.

Liberman Networks

Liberman Networks

Liberman Networks is an IT solutions provider company that provides security, management, monitoring, BDR and cloud solutions.

LANCOM Systems

LANCOM Systems

LANCOM Systems is the leading European manufacturer of secure, reliable and future-proof networking (WAN, LAN, WLAN) and firewall solutions for the public and private sectors.

National Cybersecurity Consortium (NCC)

National Cybersecurity Consortium (NCC)

The NCC’s mandate is to keep Canada’s cyber and critical infrastructures and citizens safe while ensuring Canada’s global competitiveness and leadership in cybersecurity.