DMS Alerts Should Be Key To Organisations’ Security Orchestration

Research shows that the Security Orchestration, Automation and Response (SOAR) Market is expected to grow by 15.8% (CAGR) from 2022 to 2027. That’s not surprising, given the perfect storm of conditions that have been brewing since the onset of the pandemic. 

Ransomware and other cyber attacks are on the increase, particularly now that remote and hybrid working present new attack surfaces, while at the same time, over-stretched IT teams means there’s a paucity of cyber security skills available to deploy against the rising threat. 
 
To help keep their heads above water, many organisations are investing in security orchestration to streamline their wider security operations centre (SOC) strategy, connecting siloed security tools, such as Security Information and Event Management (SIEM), to help automate threat alerts, monitoring, and remediation.

However, an essential element is often ignored as part of this streamlined security strategy: the organisation’s document and email management system (DMS). 

This is a significant oversight, because the DMS houses “the crown jewels” of the organisation: valuable client information, confidential documents, and other sensitive files. This is especially the case at professional services firms such as law, accounting, and financial services, all of whom are lucrative targets for cyber security criminals, due to the nature of privileged data they hold. 

So, why does this gap in the overall security strategy tend to form - and how can it be best addressed? 
 
Outside The Normal Flow

The key focus of IT is to look after the infrastructure and the widely used systems connected within this infrastructure: networking components, communication systems, endpoint devices, and so on. As a general rule, if a system sits within “infrastructure”, IT is in charge of monitoring, analysing and identifying any emerging threat patterns around it.

So far, so good. But when you're looking at a more dedicated or specialised type of system – like a DMS – it often may not fall under the umbrella of IT. It could be seen as belonging to an individual business department, or whichever teams are most heavily using it.

Here’s where we run into a problem. The SOC team relies on their SIEM dashboards to monitor attack patterns across the infrastructure but isn’t getting alerts or real-time information from potential insider or external threats involving the DMS. Instead, these alerts may go to a senior member of the department using the DMS or the CIO. Or they may not be getting picked up at all.

Allowing the DMS to sit outside the standardised flow of incident monitoring and threat management like this is problematic. But there is a better way. Incorporating DMS-centric threat patterns and alerts gives the SOC team access to an additional set of data points that can help determine whether a threat is actually present or not and if it warrants further action. This can include usage patterns that might indicate if something out of the ordinary is happening, such as data exfiltration from disgruntled employees, misuse of privileged accounts or stolen credentials.

Integration Is Key

To break down any silos in their security operations strategy, organisations need to consider an integrated approach that brings threat monitoring capabilities from all systems and applications, especially those holding sensitive data, together in the same place.

From a practical perspective, organisations should ask their current or prospect DMS providers if their application offers threat monitoring based on usage analytics and integration of any DMS alerts into the SOC team’s SIEM tool of choice via industry standard services, such as REST APIs. 

This is the goal for organisations to shoot for – one that effectively eliminates any gaps and risk of data loss that stem from not incorporating the DMS into an integrated SOC ecosystem.

The DMS Needs To Be Part Of The Conversation

#SOC teams are already overworked and operating in high-pressure environments. Security orchestration and automation provides an effective way to reduce that stress, but in taking a streamlined approach, organisations shouldn’t forget about their DMS. Especially if their DMS already provides the means to communicate with their integrated IT security stack.

The DMS needs to be part of the conversation. If it’s not, organisations will continue to have a gap that they’ll need to mind.

Manuel Sanchez is Global Product Marketing Manager at iManage

You Might Also Read:

Detect Spoofing Before Your Organisation Suffers Fraud:

 

« Chinese Internet Companies Required To Disclose Algorithm Data
US Government Will Invest $15 Billion In National Cyber Security »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Cyber Conflict Studies Association (CCSA)

Cyber Conflict Studies Association (CCSA)

Cyber Conflict Studies Association (CCSA) is a non-profit organization dedicated to leading a diversified research agenda in the field of cyber conflict.

Qubitekk

Qubitekk

Qubitekk has developed quantum cryptography solutions for the machine-to-machine (M2M) communications market.

Digital Ship

Digital Ship

Digital Ship provides news, information, conferences and events focused on digital ship systems, information technology and security relating to maritime operations.

Ignyte Assurance Platform

Ignyte Assurance Platform

Ignyte Assurance Platform™ is a leader in collaborative security and integrated GRC solutions for global corporations in Healthcare, Defense, and Technology.

Cybersecurity Tech Accord

Cybersecurity Tech Accord

The Cybersecurity Tech Accord promotes a safer online world by fostering collaboration among global technology companies.

Nexon Asia Pacific

Nexon Asia Pacific

Nexon solutions include cloud infrastructure and services, unified communications, managed security services, business continuity, secured high-performance network and business applications.

KirkpatrickPrice

KirkpatrickPrice

KirkpatrickPrice is dedicated to providing you with innovative security guidance and efficient audit services.

Salem Cyber

Salem Cyber

Salem Cyber builds Artificial Intelligence (AI) solutions that work collaboratively with people to address scalability challenges in cybersecurity operations.

Cloudsec Asia

Cloudsec Asia

Cloudsec Asia is Thailand's top-ranked cybersecurity consultant company. We offers security services to ensure that all your IT assets are reliable, accessible, and secure.

Hook Security

Hook Security

Setting a new standard in security awareness. Hook Security is a people-first company that uses psychological security training to help companies create security-aware culture.

Beround

Beround

Beround is an IT consultancy firm specialized in software testing.

Keyrus

Keyrus

Keyrus is a global consultancy that develops data and digital solutions for performance management.

Nihka Technology Group

Nihka Technology Group

Nihka offers full end-to-end ICT solutions from business optimisation, data centre modernisation, cloud connection and management, and ICT security.

XONA

XONA

XONA is The Zero Trust user access platform for the OT enterprise. Secure operational access to critical systems - from anywhere.

Security Solutions Services (S-3)

Security Solutions Services (S-3)

S-3 specialize in crafting tailored network design, security hardware, software, and storage solutions for businesses of all sizes.

Couno

Couno

Couno is a trusted provider of IT support services throughout the UK and Europe.