False Positives Have Real Consequences

The number of security alerts that SOC (security operations center) professionals must deal with seems to be escalating at an alarming rate. According to a recent survey conducted by the industry analyst firm IDC, 37% of the respondents stated that they deal with at least 10,000 alerts every month — and 52% of those alerts are false positives. False positives are defined as alerts for which no malicious activity has been generated.

The average organization may deal with many more alerts, according to a study from the Ponemon Institute than actually reported during a typical week. Even so, the Ponemon study reported the average was almost 17,000 malware alerts, and a mere 19% of those were deemed worthy of action. Those responding to the Ponemon study also indicated that they estimate that their prevention tools miss approximately 40% of the malware infections they suffer in a typical week. Considering that the annual spend on dealing with false positives is estimated by the Ponemon Institute to be $1.3 million for a large company -- the equivalent of almost 21,000 hours of wasted time -- it becomes obvious that SOC professionals need to employ every tool they can find to control the issue.

False positives may not sound like a major problem, but they are extremely detrimental to security procedures. First of all, the sheer volume of false positives can obscure legitimate alerts. A single rule that leads to false positives can create thousands of alerts that staff members cannot afford to ignore. However, working their way through the false positives requires taking time away from the identification of real threats. Second, the sheer number of alerts can cause data fatigue where legitimate alerts might end up being ignored. At some point, it is very likely that the rules causing the false positives will be disabled or suppressed, leaving the company blind to the attack that the rule was put in place to prevent. A hacker could easily discover the vulnerability and navigate throughout the network at will, going undetected until the damage had already been done.

How are organizations approaching false alerts?
Despite the risks involved and the wasted time, many organizations do not have an effective strategy for dealing with false positives. When asked who was responsible for containment of malware, 33% reported having an ad hoc approach, and 40% reported that no individual in their company was responsible for containment. Approximately 10% stated that they have a structured approach that relies almost exclusively on manual activities. Roughly one third of the respondents stated that they have a structured approach that employs both automated tools and manual activities.

A recent study by IDC found that only 40% of the participants reported that they actually review every alert manually. And in a survey conducted by Skyhigh Networks, 30% of the respondents admitted that they sometimes ignore security alerts due to the high number of false positives, a practice that clearly leaves their organizations vulnerable.

The solution for handling false positives
The first step in creating an effective system for handling false positives is to realize that your staff are already overwhelmed. Even if staff members can evaluate an average of 12 alerts per hour -— which does not provide sufficient time for a thorough analysis —- each team member would be able to review fewer than 100 alerts per day. After weeks or months of facing a mountain of alerts that they cannot possibly clear, staff members may become desensitized to alarms, leading them to overlook alerts on legitimate threats. Given the scarcity of qualified personnel, many companies are also forced to rely on staff members with little experience in the "real world" or little training in SOC procedures, increasing the possibility of an overlooked threat.

The second step is leveraging robust detection engines, continual tuning and filtering, and analysis leveraging rich contextual threat data to eke out what is truly of value. Unfortunately, this process ends up generating high volumes of data.

The most effective strategy to realize the benefits for this data is through automation and collaboration hunting. Automation can be instrumental for identifying good data from worthless data. Automating security operations can help you build custom playbooks and workflows to handle each type of alert and detect duplicates with ease. In addition to detecting duplicates, the common procedures will help create best practices response actions within each playbook.

False positives are going to continue to plague SOC professionals for many years to come. This area is truly one in which the cliché, "Work smarter, not harder," seems appropriate -- and automation is the key to working smarter.

– Rishi Bhargava is Co-founder and VP, Marketing for Demisto. Prior to founding Demisto, he was Vice President and General Manager of the Software Defined Datacenter Group at Intel Security. Rishi has over a dozen patents in the area of Computer Security.