Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint Security

6/22/2017
12:00 PM
Rishi Bhargava
Rishi Bhargava
News Analysis-Security Now
50%
50%

False Positives Have Real Consequences

False positives are more than just annoying – they can seriously disrupt your cybersecurity efforts.

The number of security alerts that SOC (security operations center) professionals must deal with seems to be escalating at an alarming rate. According to a recent survey conducted by the industry analyst firm IDC, 37% of the respondents stated that they deal with at least 10,000 alerts every month — and 52% of those alerts are false positives. False positives are defined as alerts for which no malicious activity has been generated.

The average organization may deal with many more alerts, according to a study from the Ponemon Institute than actually reported during a typical week. Even so, the Ponemon study reported the average was almost 17,000 malware alerts, and a mere 19% of those were deemed worthy of action. Those responding to the Ponemon study also indicated that they estimate that their prevention tools miss approximately 40% of the malware infections they suffer in a typical week. Considering that the annual spend on dealing with false positives is estimated by the Ponemon Institute to be $1.3 million for a large company -- the equivalent of almost 21,000 hours of wasted time -- it becomes obvious that SOC professionals need to employ every tool they can find to control the issue.

False positives may not sound like a major problem, but they are extremely detrimental to security procedures. First of all, the sheer volume of false positives can obscure legitimate alerts. A single rule that leads to false positives can create thousands of alerts that staff members cannot afford to ignore. However, working their way through the false positives requires taking time away from the identification of real threats. Second, the sheer number of alerts can cause data fatigue where legitimate alerts might end up being ignored. At some point, it is very likely that the rules causing the false positives will be disabled or suppressed, leaving the company blind to the attack that the rule was put in place to prevent. A hacker could easily discover the vulnerability and navigate throughout the network at will, going undetected until the damage had already been done.

How are organizations approaching false alerts?
Despite the risks involved and the wasted time, many organizations do not have an effective strategy for dealing with false positives. When asked who was responsible for containment of malware, 33% reported having an ad hoc approach, and 40% reported that no individual in their company was responsible for containment. Approximately 10% stated that they have a structured approach that relies almost exclusively on manual activities. Roughly one third of the respondents stated that they have a structured approach that employs both automated tools and manual activities.

A recent study by IDC found that only 40% of the participants reported that they actually review every alert manually. And in a survey conducted by Skyhigh Networks, 30% of the respondents admitted that they sometimes ignore security alerts due to the high number of false positives, a practice that clearly leaves their organizations vulnerable.

The solution for handling false positives
The first step in creating an effective system for handling false positives is to realize that your staff are already overwhelmed. Even if staff members can evaluate an average of 12 alerts per hour -— which does not provide sufficient time for a thorough analysis —- each team member would be able to review fewer than 100 alerts per day. After weeks or months of facing a mountain of alerts that they cannot possibly clear, staff members may become desensitized to alarms, leading them to overlook alerts on legitimate threats. Given the scarcity of qualified personnel, many companies are also forced to rely on staff members with little experience in the "real world" or little training in SOC procedures, increasing the possibility of an overlooked threat.

The second step is leveraging robust detection engines, continual tuning and filtering, and analysis leveraging rich contextual threat data to eke out what is truly of value. Unfortunately, this process ends up generating high volumes of data.

The most effective strategy to realize the benefits for this data is through automation and collaboration hunting. Automation can be instrumental for identifying good data from worthless data. Automating security operations can help you build custom playbooks and workflows to handle each type of alert and detect duplicates with ease. In addition to detecting duplicates, the common procedures will help create best practices response actions within each playbook.

False positives are going to continue to plague SOC professionals for many years to come. This area is truly one in which the cliché, "Work smarter, not harder," seems appropriate -- and automation is the key to working smarter.

Rishi Bhargava is Co-founder and VP, Marketing for Demisto. Prior to founding Demisto, he was Vice President and General Manager of the Software Defined Datacenter Group at Intel Security. Rishi has over a dozen patents in the area of Computer Security.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: George has not accepted that the technology age has come to an end.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-26814
PUBLISHED: 2021-03-06
Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileges via /manager/files URI. An authenticated user to the service may exploit incomplete input validation on the /manager/files API to inject arbitrary code within the API service sc...
CVE-2021-27581
PUBLISHED: 2021-03-05
The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter.
CVE-2021-28042
PUBLISHED: 2021-03-05
Deutsche Post Mailoptimizer 4.3 before 2020-11-09 allows Directory Traversal via a crafted ZIP archive to the Upload feature or the MO Connect component. This can lead to remote code execution.
CVE-2021-28041
PUBLISHED: 2021-03-05
ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.
CVE-2021-3377
PUBLISHED: 2021-03-05
The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.