
All told, 72% of cybersecurity and IT professionals believe that cybersecurity analytics and operations is more difficult in 2017 than 2015. Why is this the case? The top reasons making things more difficult included:
- The threat landscape. Survey respondents admit that it has become extremely difficult to keep up with the volume, sophistication, and dynamic nature of cyber-threats. In many cases, cybersecurity teams don’t have the right skills to monitor and proactively respond to changing threats, which gives the bad guys a distinct advantage.
- Changing regulatory compliance demands. A constant stream of regulatory compliance mandates perpetually increases the workload on the security operations center (SOC) staff. With regulations like the New York State department of financial services and the general data protection regulation (GDPR) in Europe, regulatory rules and changes aren’t going to get any easier either.
- The growing volume of security alerts. Organizations are adding new tools for threat detection but this only increases daily security alert storms. Security analysts are then called upon to triage, investigate, and prioritize these alerts but in reality, all they can do is cherry pick and focus on obvious security incidents. This means that more difficult and stealthy attacks tend to go unnoticed.
- Gaps in security monitoring. To me, this one is pretty frightening. Cybersecurity professionals admit that there are systems, network segments, applications, devices, etc., that fall outside of the scope of their security monitoring tools and processes. To paraphrase the old business school adage, ‘you can’t secure what you can’t measure.’
After spending the last few months buried in this research, I’ve concluded that there is no one killer problem with organizations’ cybersecurity analytics and operations. Rather, cybersecurity analytics and operations suffer from ‘death by a thousand cuts.’ CISOs are often faced with organizational, process, and technology problems that keep getting worse.
When I chat with CISOs about this situation, they often lament that they know they have to do something to improve cybersecurity analytics and operations but aren’t sure where to start. What are the best practices here and what are leading-edge cybersecurity organizations doing to improve SOC efficacy, efficiency, and productivity? Doug and I will touch upon this in our webinar later this week. I’ll also continue to blog about what we learned in this research project, so stay tuned.
Jon Oltsik is an ESG senior principal analyst and the founder of the firm’s cybersecurity service. Read more ESG blogs here.