With the recent Log4j vulnerability impacting organizations around the world, company leaders are looking for ways to address cybersecurity challenges that can no longer be ignored. Cybersecurity threats not only interrupt everyday business functions, but can cause financial losses as well.
Further complicating the decisions business leaders are considering, threats like Log4j are stark reminders that technology alone won’t solve these problems.
Security experts agree on this point. According to recent research by the Ponemon Institute, over half of respondents noted that their protective controls, such as intrusion detection systems and anti-virus solutions, have failed to stop exploits and malware from getting into the network.
As the new year kicks off, here are 4 ways businesses can address these increasing challenges with defense-in-depth strategies to measurably improve security operations outcomes.
Challenge 1: Not Able to Respond Rapidly
In 2021, on average, threats were in the network for over 212 days undetected. This ‘dwell time’ is problematic because the longer a threat is undetected, the more time bad actors have to do damage by using techniques such as lateral movement to find sensitive information and steal information. The detection challenge is usually related to a lack of technology/people-power to focus on the day-to-day threat detection tasks.
One of the most effective strategies to deal with this challenge is by working with a recognized Managed Detection and Response (MDR) service provider. A trusted MDR provider should provide 24/7/365 monitoring to minimize dwell time and accelerate incident response. Added benefits with the right MDR provider include increased visibility and support to mature the organization’s security posture. These strategies are measurable ways to ultimately minimize the cost of a breach, which can cost upwards of $4.87m depending on the amount of downtime (IBM).
Challenge 2: Overwhelming number of alerts
It’s not news that cybersecurity teams are struggling with alert fatigue. Valuable resource hours are spent investigating thousands of false positives, while increasing the risk of missing the real threats. Alert fatigue is the result of the inability to appropriately prioritize alerts from various data sources (or not prioritizing them at all), resulting in a weaker security posture.
One way to address this weakness is to establish the baseline of risks for that organization. This baseline provides a logical method to quantify risk and prioritize what needs to be addressed, and what can be deprioritized. Typical methods may involve a risk management framework, like the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), and/or a security maturity model. An MDR service provider that is interested in overall security success will have some type of measurement or methodology in place to help the organization measure their current security maturity, and develop a roadmap to improve security posture and maturity over time.
Read to learn more about the outcomes you can expect from a trusted Managed Detection and Response provider? Find out how MDR can work for you in the Deepwatch MDR Buyer’s Guide.
Challenge 3: Difficulty hiring and retaining skilled security talent
One of the universally-identified issues for every security team is the difficulty of hiring and retaining security talent. However, with the changing digital landscape and increase in remote work, more use of cloud technology, and advanced cybersecurity threats, security leaders and business owners alike are dealing with the hiring pressures now more than ever.
One solid approach to addressing this challenge is to work with an MDR provider to bring in an expert team of focused resources to remove some of the load from the in-house team’s plate. This relieves the in-house team to focus on the overall security program and manage security initiatives that strengthen security maturity year over year.
With a successful partnership in place, leaders should expect to see significant resource hours freed up for the in-house team. In a best-case scenario, the in-house team will gain actual on-the-job experience working with the extended MDR team on a day-to-day basis on activities including alert triage, ongoing SIEM tuning, and proactive threat hunting. Ultimately, the right MDR provider can help positively influence job satisfaction and employee retention of expensive, in-demand security talent.
Challenge 4: Inability to Demonstrate Security Spend ROI
As they do with other areas of investment, business leaders look for a strong ROI on any investment in security solutions. Despite spending on average $18.4M on security investments, a recent survey of cybersecurity professionals revealed only 39% of respondents felt they were getting the full value from those investments. Security professionals do not need more security alerts; in fact, they need the opposite. They need fewer alerts that are prioritized and provide context. With the increasing investments in security technologies, knowing what data sources matter most nowadays can be a moving target for security leaders and professionals.
With the constant evolution of the threat landscape, security leaders are focused on protecting their organizations from experiencing a costly security breach. To truly optimize security investments and tools, human expertise is required. Unfortunately, with the cybersecurity skills gap, that expertise is difficult to find.
By working with a Managed Security Services provider, companies can tap extended expertise to augment the in-house team, and gain the benefits of a well-tuned security tech stack that delivers advanced threat detection and rapid response capabilities with a quantifiable return-on-investment. When paired with 24/7/365 MDR services, an organization can extend their teams with 24/7 security analysts who understand the security environment and can run the security stack, without having to increase headcount with hard-to-find expensive FTEs.
Managing Cybersecurity Risks with Managed Detection and Response
With an extended team of experts managing detection and response for you, Deepwatch can help you mitigate your cybersecurity risks now and measure gains in your Security Operations metrics over time.
Ready to reset your Security Operations program and achieve success in 2022? Contact Deepwatch today; we’ll gather your solution requirements and help you create a plan that can deliver the results you need to protect and defend your business from today’s evolving threats and vulnerabilities.
Sources
- https://www.keepersecurity.com/ponemon2020.html
- https://www.ibm.com/security/data-breach
- https://www.businesswire.com/news/home/20190730005215/en/Ponemon-Study-53-Percent-of-IT-Security-Leaders-Don%E2%80%99t-Know-if-Cybersecurity-Tools-are-Working-Despite-an-Average-of-18.4-Million-Annual-Spend
Share