Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint Security

6/22/2017
12:00 PM
Rishi Bhargava
Rishi Bhargava
News Analysis-Security Now
50%
50%

False Positives Have Real Consequences

False positives are more than just annoying – they can seriously disrupt your cybersecurity efforts.

The number of security alerts that SOC (security operations center) professionals must deal with seems to be escalating at an alarming rate. According to a recent survey conducted by the industry analyst firm IDC, 37% of the respondents stated that they deal with at least 10,000 alerts every month — and 52% of those alerts are false positives. False positives are defined as alerts for which no malicious activity has been generated.

The average organization may deal with many more alerts, according to a study from the Ponemon Institute than actually reported during a typical week. Even so, the Ponemon study reported the average was almost 17,000 malware alerts, and a mere 19% of those were deemed worthy of action. Those responding to the Ponemon study also indicated that they estimate that their prevention tools miss approximately 40% of the malware infections they suffer in a typical week. Considering that the annual spend on dealing with false positives is estimated by the Ponemon Institute to be $1.3 million for a large company -- the equivalent of almost 21,000 hours of wasted time -- it becomes obvious that SOC professionals need to employ every tool they can find to control the issue.

False positives may not sound like a major problem, but they are extremely detrimental to security procedures. First of all, the sheer volume of false positives can obscure legitimate alerts. A single rule that leads to false positives can create thousands of alerts that staff members cannot afford to ignore. However, working their way through the false positives requires taking time away from the identification of real threats. Second, the sheer number of alerts can cause data fatigue where legitimate alerts might end up being ignored. At some point, it is very likely that the rules causing the false positives will be disabled or suppressed, leaving the company blind to the attack that the rule was put in place to prevent. A hacker could easily discover the vulnerability and navigate throughout the network at will, going undetected until the damage had already been done.

How are organizations approaching false alerts?
Despite the risks involved and the wasted time, many organizations do not have an effective strategy for dealing with false positives. When asked who was responsible for containment of malware, 33% reported having an ad hoc approach, and 40% reported that no individual in their company was responsible for containment. Approximately 10% stated that they have a structured approach that relies almost exclusively on manual activities. Roughly one third of the respondents stated that they have a structured approach that employs both automated tools and manual activities.

A recent study by IDC found that only 40% of the participants reported that they actually review every alert manually. And in a survey conducted by Skyhigh Networks, 30% of the respondents admitted that they sometimes ignore security alerts due to the high number of false positives, a practice that clearly leaves their organizations vulnerable.

The solution for handling false positives
The first step in creating an effective system for handling false positives is to realize that your staff are already overwhelmed. Even if staff members can evaluate an average of 12 alerts per hour -— which does not provide sufficient time for a thorough analysis —- each team member would be able to review fewer than 100 alerts per day. After weeks or months of facing a mountain of alerts that they cannot possibly clear, staff members may become desensitized to alarms, leading them to overlook alerts on legitimate threats. Given the scarcity of qualified personnel, many companies are also forced to rely on staff members with little experience in the "real world" or little training in SOC procedures, increasing the possibility of an overlooked threat.

The second step is leveraging robust detection engines, continual tuning and filtering, and analysis leveraging rich contextual threat data to eke out what is truly of value. Unfortunately, this process ends up generating high volumes of data.

The most effective strategy to realize the benefits for this data is through automation and collaboration hunting. Automation can be instrumental for identifying good data from worthless data. Automating security operations can help you build custom playbooks and workflows to handle each type of alert and detect duplicates with ease. In addition to detecting duplicates, the common procedures will help create best practices response actions within each playbook.

False positives are going to continue to plague SOC professionals for many years to come. This area is truly one in which the cliché, "Work smarter, not harder," seems appropriate -- and automation is the key to working smarter.

Rishi Bhargava is Co-founder and VP, Marketing for Demisto. Prior to founding Demisto, he was Vice President and General Manager of the Software Defined Datacenter Group at Intel Security. Rishi has over a dozen patents in the area of Computer Security.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises Are Assessing Cybersecurity Risk in Today's Environment
The adoption of cloud services spurred by the COVID-19 pandemic has resulted in pressure on cyber-risk professionals to focus on vulnerabilities and new exposures that stem from pandemic-driven changes. Many cybersecurity pros expect fundamental, long-term changes to their organization's computing and data security due to the shift to more remote work and accelerated cloud adoption. Download this report from Dark Reading to learn more about their challenges and concerns.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-4172
PUBLISHED: 2022-01-22
Cross-site Scripting (XSS) - Stored in GitHub repository star7th/showdoc prior to 2.10.2.
CVE-2022-23807
PUBLISHED: 2022-01-22
An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.
CVE-2022-23808
PUBLISHED: 2022-01-22
An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.
CVE-2022-21707
PUBLISHED: 2022-01-21
wasmCloud Host Runtime is a server process that securely hosts and provides dispatch for web assembly (WASM) actors and capability providers. In versions prior to 0.52.2 actors can bypass capability authorization. Actors are normally required to declare their capabilities for inbound invocations, bu...
CVE-2022-21708
PUBLISHED: 2022-01-21
graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL han...