Analytics // Security Monitoring
5/15/2014
04:55 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

A State of Security Event Overload

As many as 150,000 security events are logged each day in some enterprises, new data shows.

Target isn't the only enterprise getting inundated with security events:  The average enterprise receives more than 10,000 events a day that may or may not be malware-related, and for some of the biggest enterprises, that number jumps to more than 150,000 per day, according to new data from Damballa Labs.

It could happen to anyone, but Target has become a poster child for how easy it is to dismiss the wrong event as a false positive among the heavy volume generated by today's security tools. Target's security team evaluated the "activity" that was flagged and concluded it was not relevant for action. "With the benefit of hindsight, we are investigating whether, if different judgments had been made, the outcome may have been different," a Target spokeswoman said in the aftermath.

Damballa Labs' new data on network events, logged in the first quarter of this year, demonstrates how easy it would be for information overload to complicate the ability to respond to real threats among the benign events.

"There are lots of events each day, and [organizations] can't check on each one" individually, says Brian Foster, CTO at Damballa. "There are not enough smart people to go around. The industry needs to make humans smarter and more efficient, and then they can deal with more events... It eventually leads to automatable defenses."

Foster says the risk of missing a real event among a bunch of false positives is such that some organizations are taking a more holistic approach that looks at risk, prevention and detection, and response. "How many active infections are those alerts resulting in?" he asks, and how much data is going out the door as the attackers steal it?

"Security teams must be able to automate infection 'hunting' and prioritize their response. Otherwise they will find the wolf is already inside their network," Damballa's new Q1 2014 State of Infections Report says.

The full report is available here for download.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
NHARTSELL787
50%
50%
NHARTSELL787,
User Rank: Apprentice
6/12/2014 | 10:49:27 AM
Re: Overload indeed.
The issue of training, pay and retention are certainly important.  But that is ultimately just short term supply and demand.  It doesn't really address the larger issue:

How many security staff do you have?  For a typical company...

Rev x % spend on IT x % of that spent on security x % of that spent on security staff x % of those doing actual analysis

For example....

$1B rev company x 5% x 10% x 30% X 25% = $375K

Assuming a loaded labor cost of $200K, that's about two headcount.

Now get these two guys to stay on top of 150,000 alerts a day - and also fix the CEO's expired password?

Versus...

Based on some research by the U.S. intelligence, the total number of registered hackers in China is approaching 400,000.  Source: http://securecyber.blogspot.com/2010/02/should-we-be-afraid-of-chinese-hackers_19.html  (Ok, it's a number, but even if it's off by an order of magnitude or two...you get the point)

And these guys only need ONE window a jar in your network...

So we are hugely outnumbered.

The only answer is leverage.  And leverage will have to come from machines that can learn to  tie together indicators of compromise (not produce more malware signatures) that increasingly get better at separating signal from noise. Then our two lone staff can be pointed to the right data (not big data, please), analyze it fast for patterns that - if presented visually -  enable humans to see an activity pattern faster than a machine, then teach the machine this new analytic.  Rinse and repeat as in GTD.

Shameless plug - this is what we are working on at clicksecurity.com.
AccessServices
50%
50%
AccessServices,
User Rank: Apprentice
5/19/2014 | 7:37:49 AM
Staffing and Training
I see inside a lot of companies.  The number one security issue I see is with staffing.  Companies will spend thousands to millions of dollars on tools that no one knows how to use.  Managers say, 'I don't want to train people because they leave'.  These qualified people leave because they make more elsewhere.  I don't buy the story about there are not enough qualified people.  Unemployment has been high for years and especially for new graduates.  HR needs to work with IT managers to have a plan to immediately give the high acheiving employees raises.  It could be bring in employees as contractors first at a low wage.  If they prove themselves by passing tests and receiving high marks by managers, they are brought on full time with a significant increase in income.  On line training is cheap. 


Companies are receiving too many alerts because no one has the time to take a long look at all the alerts and start filtering the noise.  Where is your critical data?  Know where it is and prioritize your alerts.  Take a day or two and think about what is really at risk in your organization then go protect what is important. 
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
5/16/2014 | 11:53:22 AM
Overload indeed.
This is a major issue that faces all security professionals.  There is simply too much traffic to be able to evaluate it all.  Therefore, we must rely on signatures to detect security events.  Even that only narrows down the results from billions to hundreds of thousands.  As a result, many of those events are never investigated becauser there simply isn't enough man power to properly investigate.

Also, this doesn't even take into account the security events for which there are no signatures.
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2021
Published: 2014-10-24
Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.4.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted XMLRPC API request, as demonstrated using the client name.

CVE-2014-3604
Published: 2014-10-24
Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVE-2014-6230
Published: 2014-10-24
WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a crafted X-Forwarded-For header.

CVE-2014-6251
Published: 2014-10-24
Stack-based buffer overflow in CPUMiner before 2.4.1 allows remote attackers to have an unspecified impact by sending a mining.subscribe response with a large nonce2 length, then triggering the overflow with a mining.notify request.

CVE-2014-7180
Published: 2014-10-24
Electric Cloud ElectricCommander before 4.2.6 and 5.x before 5.0.3 uses world-writable permissions for (1) eccert.pl and (2) ecconfigure.pl, which allows local users to execute arbitrary Perl code by modifying these files.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.