What’s missing in today’s chaotic, alert-driven incident response queue is the idea of a narrative that provides a detailed understanding of how an attack actually unfolds.

Joshua Goldfarb, Global Solutions Architect — Security

March 23, 2015

4 Min Read

Decision-making is a regular part of our lives. Most of us probably don’t give much thought to how many decisions we make on a daily basis. Although we may not be aware of it, particularly for smaller decisions, each decision involves considering multiple data points. Granted, there will always be some decisions that we make emotionally or irrationally. But for logical decisions, let’s take a step back and consider what happens during the decision-making process.

For logical decisions, the decision-maker will typically understand the decision that needs to be made, develop criteria, gather supporting data, and then evaluate the supporting data per the criteria. This probably sounds like a familiar process, but what does this have to do with information security? That is a great question, and it is one that I would like to discuss further.

In the security operations and incident response realm, organizations typically manage their workflow out of a unified work queue. Into this work queue may stream different types of information, the most common type being alerts. The volume of alerts heading into this work queue is typically extremely high, the noise level is quite high, and the signal is quite low. The end result of this alert-driven work queue can be quite chaotic. Why is this an issue, and why am I calling attention to this here? It goes back to the goal of that unified work queue.

The goal of a security operations and incident response work queue should be to support decision-making. Let’s put aside, for the moment, the question of “Where do I begin?” when looking at a somewhat overwhelming queue of alerts. Let’s think about this question: If I pick an alert out of the work queue, how do I know if it is a false positive or something that will land me in the headlines in six months’ time? The answer to that question is not trivial, and it’s one reason why detection rates are so low within many organizations.

What’s missing from the current-day work queue is the idea of a narrative. Each alert in the work queue is a snapshot, a moment in time, and a part of the overall story of what occurred. It’s a piece of the puzzle. Just as I cannot look at one piece of a 1,000 piece jigsaw puzzle and understand what the fully assembled puzzle looks like, I also cannot look at one alert and understand exactly what happened within my organization.

In order to understand the complete picture, alerts in the work queue must be vetted, qualified, investigated, and enriched with additional contextual information. This contextual information includes supporting data from relevant corroborating data sources, intelligence, and an understanding of how the attack unfolded. In other words, the alert needs an accurate story built around it to properly support decision-making. It needs a narrative.

Typically, vetting, qualifying, investigating, and enriching is a very manual process that some organizations do better than others. As you can imagine, this presents quite a challenge to the typical resource-constrained organization. It is a challenge that keeps detection rates low and persistence times high. Long term, the paradigm must shift away from today’s alert-driven model and toward a narrative-driven model, which will improve detection rates and reduce persistence times. But presenting the analyst with a queue of pre-assembled narratives, rather than a queue of context-less alerts changes the nature of security operations and incident response.

The narrative-driven model creates a world in which analysts work through a queue of assembled puzzles and painted pictures that empower them to make better decisions. Similarly, a lack of context is one of the main reasons decision-making is so hard and why so many breaches fly under the radar. The narrative-driven world will be one that supports better decision-making, resulting in stronger signal, less noise, and fewer missed cues.

It may not surprise you that this is a topic I am quite passionate about. Having spent a long time on the operational side, I long felt the pain of inadequate decision support in the security operations and incident response realm. When I speak to professionals currently in operational roles, it’s clear to me that they feel this pain as well. From the discussions I’ve had, I believe that the security operations community is ready for a move from an alert-driven model to a narrative-driven model. In the end, it all boils down to the ability to make better decisions about what’s going on within our organizations. Better decisions, in turn, improve our overall security postures.

About the Author(s)

Joshua Goldfarb

Global Solutions Architect — Security, F5

Josh Goldfarb is currently Global Solutions Architect — Security at F5. Previously, Josh served as VP and CTO of Emerging Technologies at FireEye and as Chief Security Officer for nPulse Technologies until its acquisition by FireEye. Prior to joining nPulse, Josh worked as an independent consultant, applying his analytical methodology to help enterprises build and enhance their network traffic analysis, security operations, and incident response capabilities to improve their information security postures. Earlier in his career, Josh served as the Chief of Analysis for the United States Computer Emergency Readiness Team, where he built from the ground up and subsequently ran the network, endpoint, and malware analysis/forensics capabilities for US-CERT. In addition to Josh's blogging and public speaking appearances, he is also a regular contributor to Dark Reading and SecurityWeek.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights