Can Shortening The Cyber Stack Increase Stability?

The number of cybersecurity tools that make up the security stack have continued to increase - it’s now not uncommon to find 75-100 tools deployed in the average enterprise - and managing this stack is proving difficult.

The security team needs to learn the nuances of each solution, log in and out of them, and keep them updated. Consequently, CISOs acknowledge they would derive more benefit from improving control over the stack rather than buying in more tools. 

These tools generate numerous alerts, which means the stack also contributes to alert fatigue. This increases stress and burnout among the team, with VMware’s Global Incident Response Threat Report finding 51% of cybersecurity professionals had experienced extreme stress or burnout over the course of the past year leading 67% of those to take time off as a result. But alert fatigue is also dangerous because it can desensitise the team, which means threats can be miscategorised or ignored.

CISOs, too, are suffering the consequences of the bloated cyber stack. The Implications of Stress on CISOs report found 94% reported feeling stressed and 65% said it was compromising their ability to protect the organisation. The top solution to solving this stress as identified by 57% of CISOs? Consolidate the stack by placing multiple security technologies over a single platform.

Curbing Costs

Reducing complexity not only lessens pressure on the security team but can also help save costs associated with licensing, training and maintenance. This makes it even more compelling in today’s economic climate, where costs are escalating. Some businesses are choosing to outsource as a result to a Managed Security Services Provider (MSSP) to keep their costs under control and predictable.

It's these drivers – the need to reduce risk, stress and cost – that are now seeing CISOs focus on reducing the number of cybersecurity tools they have and the number of vendors they deal with. In 2020, only 29% of CISOs were pursuing such a strategy but that has now risen to 75% in a bid to improve overall risk posture, gain efficiencies of scale and eliminate the need to integrate separate tools, according to Gartner. 

Most are going about this by looking at how they can reduce the number of point solutions, vendors and integrations the security team must maintain. But this is no race to the bottom, as choosing to combine technologies over a single platform can enable the business to take advantage of more cutting-edge technologies. These can be easily integrated within the platform, making it possible to augment the functionality the business already has with complementary solutions. 

Complementary Tech

Take, for example, a modern Security Incident and Event Management (SIEM) solution. These are now usually mapped to the MITRE ATT&CK framework giving them threat hunting capabilities but these can be further enhanced. It’s possible to utilise machine learning and AI behaviour-based analysis via User Entity Behaviour Analytics (UEBA) and automated detection and response via Security Orchestration Automation and Response (SOAR), for example. 

UEBA provides contextual information. It applies parameters that monitor user behaviour while allowing for exceptions to the rule. But should a transgression occur, it then flags that behaviour for investigation. A good example would be where a user is granted access to certain file systems during a specific period. Any access outside of those hours would then be treated as suspicious and trigger an alert.

SOAR helps detect and mitigate threats more precisely, decreasing the mean time to detect and respond (MTTD and MTTR) to suspicious behaviour. It stores and prioritises alerts and security data from multiple sources and systems and automates incident response through the application of playbooks that then enable the team to investigate, contain and remove threats.

When Less Means More

The assimilation of these technologies into a singular platform to complement the SIEM is helping to move us away from point solutions and drive down complexity. But the benefits go further than that. Each technology complements but also supplements the other to provide much deeper insights. For instance, rather than alerts being treated as weak signals of possible compromise, native integration of different components into a converged platform makes it possible to fuse weak signals, benefit from environmental and situational contextual information and then to focus on what matters most. 

The converged dashboard also provides a single pane of glass through which to continuously monitor the entire IT landscape, making it possible for the CISO to more easily view, manage and report on the information estate.

But ultimately, it helps stabilise the organisation, by alleviating workloads and reducing stress fatigue, qualifying and focusing attention on the threats that matter and lowering maintenance costs. So that, far from shrinking the cyber estate, we should view convergence as a way of condensing and concentrating security efforts. 

Tim Wallen isRegional Director for the UK, US and Emerging at Logpoint                       Image: Kaboompics

You Might Also Read: 

Can Automation Help Bridge The Cyber Skills Gap?:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« The Unique TTPs Attackers Use To Target APIs
Qakbot Malware Taken Down »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

CloudDNA

CloudDNA

CloudDNA deliver solutions that enable users and devices to connect over high performance, secure, efficient, scalable cloud networks.

CertiKit

CertiKit

CertiKit produce toolkit products that accelerate the adoption of ISO/IEC standards, including ISO 27001, helping organizations all over the world to realize the benefits as soon as possible.

Altius IT

Altius IT

Altius IT reviews your website for security vulnerabilities and provides a report identifying vulnerabilities and recommendations to make secure.

Packet Ninjas

Packet Ninjas

Packet Ninjas is a niche cyber security agency with specialized expertise in the use of digital intelligence to strengthen cyber security.

Red Balloon Security (RBS)

Red Balloon Security (RBS)

Red Balloon Security is a leading embedded device security company, delivering deep host-based defense for all devices.

BlueFiles

BlueFiles

BlueFiles enables users to send encrypted files securely while maintaining full control over recipients, access periods, downloads, and printing.

4Stop

4Stop

4Stop is a global KYC, compliance and anti-fraud risk management company.

DigitalXRaid

DigitalXRaid

DigitalXRAID is driven and motivated to ensure the bad guys don’t win. We’re dedicated to providing our clients with state-of-the-art cyber security solutions.

Spamhaus

Spamhaus

Spamhaus is the world leader in supplying realtime highly accurate threat intelligence to the Internet's major networks.

LGMS - LE Global Services

LGMS - LE Global Services

LGMS is a leading cyber security penetration testing and assessment firm in the Asia Pacific region.

Purple Knight

Purple Knight

Purple Knight is a free Active Directory security assessment tool built and managed by an elite group of Microsoft identity experts.

HTL Support

HTL Support

HTL Support, your trusted partner for comprehensive IT support in London. We specialize in delivering top-tier IT solutions tailored to both large enterprises and small businesses.

Somos

Somos

From voice to messaging to fraud prevention and beyond, Somos are committed to developing innovative solutions that ensure that our ability to maintain trustworthy connections never stops.

XeneX

XeneX

XeneX Cloud Security Services address enterprise-class security challenges by enabling DevOps and Security teams to access a shared source of truth.

Innerworks

Innerworks

Innerworks intelligent bot detection. Innerworks is building the future of behavioural data on web3.

Runtime Ventures

Runtime Ventures

Runtime Ventures focuses on seed and pre-seed stage cybersecurity investments. We love to work with ambitious founders building the future of the secure enterprise.