Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

7/13/2021
08:30 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Tool Sprawl & False Positives Hold Security Teams Back

Security teams spend as much time addressing false positive alerts as they do addressing actual cyberattacks, survey data shows.

Organizations report it's becoming increasingly difficult to maintain the security of their Web applications and APIs with a patchwork of security tools and a rising wave of false positive alerts.

Related Content:

AI and Cybersecurity: Making Sense of the Confusion

Special Report: Building the SOC of the Future

New From The Edge: Navigating Active Directory Security: Dangers and Defenses

Nearly half (45%) of all daily security alerts are false positives, researchers report in "Reaching the Tipping Point of Web Application and API Security," a study conducted by ESG Research and commissioned by Fastly. The global survey polled engineering, security, IT, and DevOps leaders across 500 organizations located in North America, Europe, and Asia-Pacific and Japan.

Most (75% of) respondents say their organization spends an equal amount, or more, time on false positives as on legitimate attacks. It's a costly problem in more ways than one, explains Kelly Shortridge, senior principal at Fastly.

"Sometimes the actual attacks are just lost in the deluge," she says. "It's really difficult to stay on top of things when you're having to triage sometimes more than a dozen events in an hour; sometimes much more than that."

Compass CISO Jonathan Agha points to the issue of tools fighting for attention, a problem that worsens as they accumulate.

"With all the tooling and alerts that we have, we have a ton of information, but it might not be relevant information, or a context that we care about, and the alert also requires a human to act on it," he adds.

False positive alerts can affect adjacent tooling as well, Shortridge continues. If an organization has a central data store polluted with a high number of false positives, it impedes the security team's ability to use automation to help with workflows or playbooks based on that data. Any processes they create based on that data won't work very well, she points out.

The opportunity cost extends to the rest of the business, as security practitioners investigating false positives lose time they could be spending on more strategic enterprise improvements. When more time is spent triaging false positives and trying to adjust tools to make them work better, the business misses out on opportunities to think more strategically about where it can improve elsewhere.

To respond to the increase in false positives, businesses have two primary options: run tools out of band in log or monitor mode, or turn them off entirely. Researchers found while 53% of respondents chose to shift to log or monitor mode, 12% report turning their tools off and 26% report doing both. Most respondents (82%) indicated their organization turned off Web application and API protection tools less than one month after deploying, researchers report.

Too Many Cooks in the Kitchen
Researchers found organizations use an average of 11 Web application and API security tools, and they spend $2.6 million on them each year. Much of this "tool sprawl" can be attributed to supporting new architectures and cloud environments, which indicates security grows more complex as businesses adopt new technologies.

"The majority of the market is struggling with transforming their applications to be cloud-native," says Shortridge. "A lot of times they're straddling the old world with monoliths and legacy on-prem systems, as well as the new world with microservices and cloud hosting."

Tools that worked with those legacy systems generally can't handle, or don't support, cloud-based workloads with a microservices architecture, she continues. In Shortridge's experience, tool sprawl isn't as common a problem in organizations that fully operate in the cloud.

There's a common mentality that a new tool will help solve a problem. When a data breach happens, or something falls through the cracks, or analysts are burned out, it's easier to buy a new tool than it is to step back and consider in which ways the security program may be failing.

"You can't technology your way out of a process or a people problem," she says. It's a human tendency to think buying the new and shiny tool, it will fix the problem — not make it worse — and people often think more about how they can add, rather than what they can subtract, when solving a problem.

How many tools is too many? While organizations often talk about the upfront cost and benefit of a new tool, they may not consider the long-term cost of their investment. The right number of tools is different for every business; however, there are a few red flags that might indicate it's time to cut back, Shortridge says.

One of these is apparent when bringing in new employees: If it's tough to onboard new team members who are supposed to work with application security tools, and they struggle to use them all, it's not a good sign. Consider whether it's difficult to discern the tool's value on a daily or weekly basis. If you get a result from a tool and don't immediately understand its value, that is a problem. And finally, she advises considering the opportunity cost: Where are tools slowing processes down? Would you recommend them to another organization?

Shopping for Web Application Security
As they consider which Web application security tools to invest in, she advises security teams to consider what the business values most, and the key indicators of success they're measuring. For example, for engineering-led organizations that value velocity in delivering software, a security tool that doesn't align with those principles of performance should give you pause.

"What's the point in securing the business if you're just hamstringing its operations?" Shortridge says. "The point is to help them operate safely."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-33988
PUBLISHED: 2021-10-19
Cross Site Scripting (XSS). vulnerability exists in Microweber CMS 1.2.7 via the Login form, which could let a malicious user execute Javascript by Inserting code in the request form.
CVE-2020-12141
PUBLISHED: 2021-10-19
An out-of-bounds read in the SNMP stack in Contiki-NG 4.4 and earlier allows an attacker to cause a denial of service and potentially disclose information via crafted SNMP packets to snmp_ber_decode_string_len_buffer in os/net/app-layer/snmp/snmp-ber.c.
CVE-2021-29912
PUBLISHED: 2021-10-19
IBM Security Risk Manager on CP4S 1.7.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 207828.
CVE-2021-38911
PUBLISHED: 2021-10-19
IBM Security Risk Manager on CP4S 1.7.0.0 stores user credentials in plain clear text which can be read by a an authenticatedl privileged user. IBM X-Force ID: 209940.
CVE-2021-3746
PUBLISHED: 2021-10-19
A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2's volatile state is written. The highest threat from this vulnerability ...