Analytics // Security Monitoring
5/15/2014
04:55 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

A State of Security Event Overload

As many as 150,000 security events are logged each day in some enterprises, new data shows.

Target isn't the only enterprise getting inundated with security events:  The average enterprise receives more than 10,000 events a day that may or may not be malware-related, and for some of the biggest enterprises, that number jumps to more than 150,000 per day, according to new data from Damballa Labs.

It could happen to anyone, but Target has become a poster child for how easy it is to dismiss the wrong event as a false positive among the heavy volume generated by today's security tools. Target's security team evaluated the "activity" that was flagged and concluded it was not relevant for action. "With the benefit of hindsight, we are investigating whether, if different judgments had been made, the outcome may have been different," a Target spokeswoman said in the aftermath.

Damballa Labs' new data on network events, logged in the first quarter of this year, demonstrates how easy it would be for information overload to complicate the ability to respond to real threats among the benign events.

"There are lots of events each day, and [organizations] can't check on each one" individually, says Brian Foster, CTO at Damballa. "There are not enough smart people to go around. The industry needs to make humans smarter and more efficient, and then they can deal with more events... It eventually leads to automatable defenses."

Foster says the risk of missing a real event among a bunch of false positives is such that some organizations are taking a more holistic approach that looks at risk, prevention and detection, and response. "How many active infections are those alerts resulting in?" he asks, and how much data is going out the door as the attackers steal it?

"Security teams must be able to automate infection 'hunting' and prioritize their response. Otherwise they will find the wolf is already inside their network," Damballa's new Q1 2014 State of Infections Report says.

The full report is available here for download.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
NHARTSELL787
50%
50%
NHARTSELL787,
User Rank: Apprentice
6/12/2014 | 10:49:27 AM
Re: Overload indeed.
The issue of training, pay and retention are certainly important.  But that is ultimately just short term supply and demand.  It doesn't really address the larger issue:

How many security staff do you have?  For a typical company...

Rev x % spend on IT x % of that spent on security x % of that spent on security staff x % of those doing actual analysis

For example....

$1B rev company x 5% x 10% x 30% X 25% = $375K

Assuming a loaded labor cost of $200K, that's about two headcount.

Now get these two guys to stay on top of 150,000 alerts a day - and also fix the CEO's expired password?

Versus...

Based on some research by the U.S. intelligence, the total number of registered hackers in China is approaching 400,000.  Source: http://securecyber.blogspot.com/2010/02/should-we-be-afraid-of-chinese-hackers_19.html  (Ok, it's a number, but even if it's off by an order of magnitude or two...you get the point)

And these guys only need ONE window a jar in your network...

So we are hugely outnumbered.

The only answer is leverage.  And leverage will have to come from machines that can learn to  tie together indicators of compromise (not produce more malware signatures) that increasingly get better at separating signal from noise. Then our two lone staff can be pointed to the right data (not big data, please), analyze it fast for patterns that - if presented visually -  enable humans to see an activity pattern faster than a machine, then teach the machine this new analytic.  Rinse and repeat as in GTD.

Shameless plug - this is what we are working on at clicksecurity.com.
AccessServices
50%
50%
AccessServices,
User Rank: Apprentice
5/19/2014 | 7:37:49 AM
Staffing and Training
I see inside a lot of companies.  The number one security issue I see is with staffing.  Companies will spend thousands to millions of dollars on tools that no one knows how to use.  Managers say, 'I don't want to train people because they leave'.  These qualified people leave because they make more elsewhere.  I don't buy the story about there are not enough qualified people.  Unemployment has been high for years and especially for new graduates.  HR needs to work with IT managers to have a plan to immediately give the high acheiving employees raises.  It could be bring in employees as contractors first at a low wage.  If they prove themselves by passing tests and receiving high marks by managers, they are brought on full time with a significant increase in income.  On line training is cheap. 


Companies are receiving too many alerts because no one has the time to take a long look at all the alerts and start filtering the noise.  Where is your critical data?  Know where it is and prioritize your alerts.  Take a day or two and think about what is really at risk in your organization then go protect what is important. 
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
5/16/2014 | 11:53:22 AM
Overload indeed.
This is a major issue that faces all security professionals.  There is simply too much traffic to be able to evaluate it all.  Therefore, we must rely on signatures to detect security events.  Even that only narrows down the results from billions to hundreds of thousands.  As a result, many of those events are never investigated becauser there simply isn't enough man power to properly investigate.

Also, this doesn't even take into account the security events for which there are no signatures.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2010-5312
Published: 2014-11-24
Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.

CVE-2012-6662
Published: 2014-11-24
Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.

CVE-2014-1424
Published: 2014-11-24
apparmor_parser in the apparmor package before 2.8.95~2430-0ubuntu5.1 in Ubuntu 14.04 allows attackers to bypass AppArmor policies via unspecified vectors, related to a "miscompilation flaw."

CVE-2014-7817
Published: 2014-11-24
The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))".

CVE-2014-7821
Published: 2014-11-24
OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (crash) via a crafted dns_nameservers value in the DNS configuration.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?