Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics //

Security Monitoring

5/15/2014
04:55 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

A State of Security Event Overload

As many as 150,000 security events are logged each day in some enterprises, new data shows.

Target isn't the only enterprise getting inundated with security events:  The average enterprise receives more than 10,000 events a day that may or may not be malware-related, and for some of the biggest enterprises, that number jumps to more than 150,000 per day, according to new data from Damballa Labs.

It could happen to anyone, but Target has become a poster child for how easy it is to dismiss the wrong event as a false positive among the heavy volume generated by today's security tools. Target's security team evaluated the "activity" that was flagged and concluded it was not relevant for action. "With the benefit of hindsight, we are investigating whether, if different judgments had been made, the outcome may have been different," a Target spokeswoman said in the aftermath.

Damballa Labs' new data on network events, logged in the first quarter of this year, demonstrates how easy it would be for information overload to complicate the ability to respond to real threats among the benign events.

"There are lots of events each day, and [organizations] can't check on each one" individually, says Brian Foster, CTO at Damballa. "There are not enough smart people to go around. The industry needs to make humans smarter and more efficient, and then they can deal with more events... It eventually leads to automatable defenses."

Foster says the risk of missing a real event among a bunch of false positives is such that some organizations are taking a more holistic approach that looks at risk, prevention and detection, and response. "How many active infections are those alerts resulting in?" he asks, and how much data is going out the door as the attackers steal it?

"Security teams must be able to automate infection 'hunting' and prioritize their response. Otherwise they will find the wolf is already inside their network," Damballa's new Q1 2014 State of Infections Report says.

The full report is available here for download.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
NHARTSELL787
50%
50%
NHARTSELL787,
User Rank: Apprentice
6/12/2014 | 10:49:27 AM
Re: Overload indeed.
The issue of training, pay and retention are certainly important.  But that is ultimately just short term supply and demand.  It doesn't really address the larger issue:

How many security staff do you have?  For a typical company...

Rev x % spend on IT x % of that spent on security x % of that spent on security staff x % of those doing actual analysis

For example....

$1B rev company x 5% x 10% x 30% X 25% = $375K

Assuming a loaded labor cost of $200K, that's about two headcount.

Now get these two guys to stay on top of 150,000 alerts a day - and also fix the CEO's expired password?

Versus...

Based on some research by the U.S. intelligence, the total number of registered hackers in China is approaching 400,000.  Source: http://securecyber.blogspot.com/2010/02/should-we-be-afraid-of-chinese-hackers_19.html  (Ok, it's a number, but even if it's off by an order of magnitude or two...you get the point)

And these guys only need ONE window a jar in your network...

So we are hugely outnumbered.

The only answer is leverage.  And leverage will have to come from machines that can learn to  tie together indicators of compromise (not produce more malware signatures) that increasingly get better at separating signal from noise. Then our two lone staff can be pointed to the right data (not big data, please), analyze it fast for patterns that - if presented visually -  enable humans to see an activity pattern faster than a machine, then teach the machine this new analytic.  Rinse and repeat as in GTD.

Shameless plug - this is what we are working on at clicksecurity.com.
AccessServices
50%
50%
AccessServices,
User Rank: Apprentice
5/19/2014 | 7:37:49 AM
Staffing and Training
I see inside a lot of companies.  The number one security issue I see is with staffing.  Companies will spend thousands to millions of dollars on tools that no one knows how to use.  Managers say, 'I don't want to train people because they leave'.  These qualified people leave because they make more elsewhere.  I don't buy the story about there are not enough qualified people.  Unemployment has been high for years and especially for new graduates.  HR needs to work with IT managers to have a plan to immediately give the high acheiving employees raises.  It could be bring in employees as contractors first at a low wage.  If they prove themselves by passing tests and receiving high marks by managers, they are brought on full time with a significant increase in income.  On line training is cheap. 


Companies are receiving too many alerts because no one has the time to take a long look at all the alerts and start filtering the noise.  Where is your critical data?  Know where it is and prioritize your alerts.  Take a day or two and think about what is really at risk in your organization then go protect what is important. 
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
5/16/2014 | 11:53:22 AM
Overload indeed.
This is a major issue that faces all security professionals.  There is simply too much traffic to be able to evaluate it all.  Therefore, we must rely on signatures to detect security events.  Even that only narrows down the results from billions to hundreds of thousands.  As a result, many of those events are never investigated becauser there simply isn't enough man power to properly investigate.

Also, this doesn't even take into account the security events for which there are no signatures.
Microsoft Patches Wormable RCE Vulns in Remote Desktop Services
Kelly Sheridan, Staff Editor, Dark Reading,  8/13/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15150
PUBLISHED: 2019-08-19
In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function.
CVE-2017-18550
PUBLISHED: 2019-08-19
An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_get_hba_info does not initialize the hbainfo structure.
CVE-2017-18551
PUBLISHED: 2019-08-19
An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an out of bounds write in the function i2c_smbus_xfer_emulated.
CVE-2017-18552
PUBLISHED: 2019-08-19
An issue was discovered in net/rds/af_rds.c in the Linux kernel before 4.11. There is an out of bounds write and read in the function rds_recv_track_latency.
CVE-2018-20976
PUBLISHED: 2019-08-19
An issue was discovered in fs/xfs/xfs_super.c in the Linux kernel before 4.18. A use after free exists, related to xfs_fs_fill_super failure.