Can Shortening The Cyber Stack Increase Stability?

The number of cybersecurity tools that make up the security stack have continued to increase - it’s now not uncommon to find 75-100 tools deployed in the average enterprise - and managing this stack is proving difficult.

The security team needs to learn the nuances of each solution, log in and out of them, and keep them updated. Consequently, CISOs acknowledge they would derive more benefit from improving control over the stack rather than buying in more tools. 

These tools generate numerous alerts, which means the stack also contributes to alert fatigue. This increases stress and burnout among the team, with VMware’s Global Incident Response Threat Report finding 51% of cybersecurity professionals had experienced extreme stress or burnout over the course of the past year leading 67% of those to take time off as a result. But alert fatigue is also dangerous because it can desensitise the team, which means threats can be miscategorised or ignored.

CISOs, too, are suffering the consequences of the bloated cyber stack. The Implications of Stress on CISOs report found 94% reported feeling stressed and 65% said it was compromising their ability to protect the organisation. The top solution to solving this stress as identified by 57% of CISOs? Consolidate the stack by placing multiple security technologies over a single platform.

Curbing Costs

Reducing complexity not only lessens pressure on the security team but can also help save costs associated with licensing, training and maintenance. This makes it even more compelling in today’s economic climate, where costs are escalating. Some businesses are choosing to outsource as a result to a Managed Security Services Provider (MSSP) to keep their costs under control and predictable.

It's these drivers – the need to reduce risk, stress and cost – that are now seeing CISOs focus on reducing the number of cybersecurity tools they have and the number of vendors they deal with. In 2020, only 29% of CISOs were pursuing such a strategy but that has now risen to 75% in a bid to improve overall risk posture, gain efficiencies of scale and eliminate the need to integrate separate tools, according to Gartner. 

Most are going about this by looking at how they can reduce the number of point solutions, vendors and integrations the security team must maintain. But this is no race to the bottom, as choosing to combine technologies over a single platform can enable the business to take advantage of more cutting-edge technologies. These can be easily integrated within the platform, making it possible to augment the functionality the business already has with complementary solutions. 

Complementary Tech

Take, for example, a modern Security Incident and Event Management (SIEM) solution. These are now usually mapped to the MITRE ATT&CK framework giving them threat hunting capabilities but these can be further enhanced. It’s possible to utilise machine learning and AI behaviour-based analysis via User Entity Behaviour Analytics (UEBA) and automated detection and response via Security Orchestration Automation and Response (SOAR), for example. 

UEBA provides contextual information. It applies parameters that monitor user behaviour while allowing for exceptions to the rule. But should a transgression occur, it then flags that behaviour for investigation. A good example would be where a user is granted access to certain file systems during a specific period. Any access outside of those hours would then be treated as suspicious and trigger an alert.

SOAR helps detect and mitigate threats more precisely, decreasing the mean time to detect and respond (MTTD and MTTR) to suspicious behaviour. It stores and prioritises alerts and security data from multiple sources and systems and automates incident response through the application of playbooks that then enable the team to investigate, contain and remove threats.

When Less Means More

The assimilation of these technologies into a singular platform to complement the SIEM is helping to move us away from point solutions and drive down complexity. But the benefits go further than that. Each technology complements but also supplements the other to provide much deeper insights. For instance, rather than alerts being treated as weak signals of possible compromise, native integration of different components into a converged platform makes it possible to fuse weak signals, benefit from environmental and situational contextual information and then to focus on what matters most. 

The converged dashboard also provides a single pane of glass through which to continuously monitor the entire IT landscape, making it possible for the CISO to more easily view, manage and report on the information estate.

But ultimately, it helps stabilise the organisation, by alleviating workloads and reducing stress fatigue, qualifying and focusing attention on the threats that matter and lowering maintenance costs. So that, far from shrinking the cyber estate, we should view convergence as a way of condensing and concentrating security efforts. 

Tim Wallen isRegional Director for the UK, US and Emerging at Logpoint                       Image: Kaboompics

You Might Also Read: 

Can Automation Help Bridge The Cyber Skills Gap?:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« The Unique TTPs Attackers Use To Target APIs
Qakbot Malware Taken Down »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Lloyd's

Lloyd's

As an insurance market, Lloyd’s can provide access to more than 65 expert cyber risk insurers in one place.

ElcomSoft

ElcomSoft

ElcomSoft is a global leader in computer and mobile forensics, IT security and forensic data recovery.

Pindrop Security

Pindrop Security

Pindrop solutions are leading the way to the future of voice by establishing the standard for security, identity, and trust for every voice interaction.

Cyber Risk Opportunities

Cyber Risk Opportunities

Cyber Risk Opportunities was formed to enable middle-market executives to become more proficient cyber risk managers so their organizations can thrive.

SaltStack

SaltStack

SaltStack develops award-winning intelligent IT automation software. We help businesses more efficiently secure and manage all aspects of their digital infrastructure.

BI.ZONE

BI.ZONE

BI.ZONE creates high-tech products and solutions to protect IT infrastructures and applications, and provides services from cyber intelligence and proactive defence to cybercrime investigation.

Converge Technology Solutions

Converge Technology Solutions

Converge Technology Solutions Corp. is a North American IT solution provider delivering advanced analytics, cloud, cybersecurity, and managed services solutions.

Zemana

Zemana

Zemana provides innovative cyber-security solutions to deal with complex malicious software and other cyber threats.

MedSec

MedSec

MedSec is the only company of its type focused solely on cybersecurity for hospitals and medical device manufacturers, offering both a cybersecurity software solution and consulting services.

Hook Security

Hook Security

Setting a new standard in security awareness. Hook Security is a people-first company that uses psychological security training to help companies create security-aware culture.

DigitalPlatforms

DigitalPlatforms

DigitalPlatforms SpA is an Italian group with the mission of providing end-to-end solutions and Internet of Things and Cyber technologies to companies that manage critical infrastructures.

Qevlar AI

Qevlar AI

Qevlar AI empowers SOC teams, to eliminate redundant tasks and refocus on what truly matters - making the most of every employee within the SecOps team.

Irys Technologies

Irys Technologies

Irys Technologies specialize in pioneering digital transformation solutions designed to streamline communications and enhance maintenance and operational efficiency for a variety of sectors.

AKS iQ

AKS iQ

AKS iQ leads the RegTech sector with AI, automating regulatory compliance in the banking industry and ensuring paperless TBML and CFT adherence in finance.

Applied Insight

Applied Insight

Applied Insight work closely with government agencies and industry to overcome technical and cultural hurdles to innovation, empowering them with the latest cloud, data and cyber capabilities.

Texaport

Texaport

Texaport's vision is to be the trusted partner of choice for organisations seeking comprehensive IT management and cutting-edge security solutions.