Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint Security

6/22/2017
12:00 PM
Rishi Bhargava
Rishi Bhargava
News Analysis-Security Now
50%
50%

False Positives Have Real Consequences

False positives are more than just annoying – they can seriously disrupt your cybersecurity efforts.

The number of security alerts that SOC (security operations center) professionals must deal with seems to be escalating at an alarming rate. According to a recent survey conducted by the industry analyst firm IDC, 37% of the respondents stated that they deal with at least 10,000 alerts every month — and 52% of those alerts are false positives. False positives are defined as alerts for which no malicious activity has been generated.

The average organization may deal with many more alerts, according to a study from the Ponemon Institute than actually reported during a typical week. Even so, the Ponemon study reported the average was almost 17,000 malware alerts, and a mere 19% of those were deemed worthy of action. Those responding to the Ponemon study also indicated that they estimate that their prevention tools miss approximately 40% of the malware infections they suffer in a typical week. Considering that the annual spend on dealing with false positives is estimated by the Ponemon Institute to be $1.3 million for a large company -- the equivalent of almost 21,000 hours of wasted time -- it becomes obvious that SOC professionals need to employ every tool they can find to control the issue.

False positives may not sound like a major problem, but they are extremely detrimental to security procedures. First of all, the sheer volume of false positives can obscure legitimate alerts. A single rule that leads to false positives can create thousands of alerts that staff members cannot afford to ignore. However, working their way through the false positives requires taking time away from the identification of real threats. Second, the sheer number of alerts can cause data fatigue where legitimate alerts might end up being ignored. At some point, it is very likely that the rules causing the false positives will be disabled or suppressed, leaving the company blind to the attack that the rule was put in place to prevent. A hacker could easily discover the vulnerability and navigate throughout the network at will, going undetected until the damage had already been done.

How are organizations approaching false alerts?
Despite the risks involved and the wasted time, many organizations do not have an effective strategy for dealing with false positives. When asked who was responsible for containment of malware, 33% reported having an ad hoc approach, and 40% reported that no individual in their company was responsible for containment. Approximately 10% stated that they have a structured approach that relies almost exclusively on manual activities. Roughly one third of the respondents stated that they have a structured approach that employs both automated tools and manual activities.

A recent study by IDC found that only 40% of the participants reported that they actually review every alert manually. And in a survey conducted by Skyhigh Networks, 30% of the respondents admitted that they sometimes ignore security alerts due to the high number of false positives, a practice that clearly leaves their organizations vulnerable.

The solution for handling false positives
The first step in creating an effective system for handling false positives is to realize that your staff are already overwhelmed. Even if staff members can evaluate an average of 12 alerts per hour -— which does not provide sufficient time for a thorough analysis —- each team member would be able to review fewer than 100 alerts per day. After weeks or months of facing a mountain of alerts that they cannot possibly clear, staff members may become desensitized to alarms, leading them to overlook alerts on legitimate threats. Given the scarcity of qualified personnel, many companies are also forced to rely on staff members with little experience in the "real world" or little training in SOC procedures, increasing the possibility of an overlooked threat.

The second step is leveraging robust detection engines, continual tuning and filtering, and analysis leveraging rich contextual threat data to eke out what is truly of value. Unfortunately, this process ends up generating high volumes of data.

The most effective strategy to realize the benefits for this data is through automation and collaboration hunting. Automation can be instrumental for identifying good data from worthless data. Automating security operations can help you build custom playbooks and workflows to handle each type of alert and detect duplicates with ease. In addition to detecting duplicates, the common procedures will help create best practices response actions within each playbook.

False positives are going to continue to plague SOC professionals for many years to come. This area is truly one in which the cliché, "Work smarter, not harder," seems appropriate -- and automation is the key to working smarter.

Rishi Bhargava is Co-founder and VP, Marketing for Demisto. Prior to founding Demisto, he was Vice President and General Manager of the Software Defined Datacenter Group at Intel Security. Rishi has over a dozen patents in the area of Computer Security.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Another COVID-19 Side Effect: Rising Nation-State Cyber Activity
Stephen Ward, VP, ThreatConnect,  7/1/2020
Lessons from COVID-19 Cyberattacks: Where Do We Go Next?
Derek Manky, Chief of Security Insights and Global Threat Alliances, FortiGuard Labs,  7/2/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15600
PUBLISHED: 2020-07-07
An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password.
CVE-2020-15599
PUBLISHED: 2020-07-07
Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.
CVE-2020-8916
PUBLISHED: 2020-07-07
A memory leak in Openthread's wpantund versions up to commit 0e5d1601febb869f583e944785e5685c6c747be7, when used in an environment where wpanctl is directly interfacing with the control driver (eg: debug environments) can allow an attacker to crash the service (DoS). We recommend updating, or to res...
CVE-2020-12821
PUBLISHED: 2020-07-07
Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack.
CVE-2020-15008
PUBLISHED: 2020-07-07
A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. As the code creates dynamic SQL for the insert statement and utilizes the user su...