Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint Security

6/22/2017
12:00 PM
Rishi Bhargava
Rishi Bhargava
News Analysis-Security Now
50%
50%

False Positives Have Real Consequences

False positives are more than just annoying – they can seriously disrupt your cybersecurity efforts.

The number of security alerts that SOC (security operations center) professionals must deal with seems to be escalating at an alarming rate. According to a recent survey conducted by the industry analyst firm IDC, 37% of the respondents stated that they deal with at least 10,000 alerts every month — and 52% of those alerts are false positives. False positives are defined as alerts for which no malicious activity has been generated.

The average organization may deal with many more alerts, according to a study from the Ponemon Institute than actually reported during a typical week. Even so, the Ponemon study reported the average was almost 17,000 malware alerts, and a mere 19% of those were deemed worthy of action. Those responding to the Ponemon study also indicated that they estimate that their prevention tools miss approximately 40% of the malware infections they suffer in a typical week. Considering that the annual spend on dealing with false positives is estimated by the Ponemon Institute to be $1.3 million for a large company -- the equivalent of almost 21,000 hours of wasted time -- it becomes obvious that SOC professionals need to employ every tool they can find to control the issue.

False positives may not sound like a major problem, but they are extremely detrimental to security procedures. First of all, the sheer volume of false positives can obscure legitimate alerts. A single rule that leads to false positives can create thousands of alerts that staff members cannot afford to ignore. However, working their way through the false positives requires taking time away from the identification of real threats. Second, the sheer number of alerts can cause data fatigue where legitimate alerts might end up being ignored. At some point, it is very likely that the rules causing the false positives will be disabled or suppressed, leaving the company blind to the attack that the rule was put in place to prevent. A hacker could easily discover the vulnerability and navigate throughout the network at will, going undetected until the damage had already been done.

How are organizations approaching false alerts?
Despite the risks involved and the wasted time, many organizations do not have an effective strategy for dealing with false positives. When asked who was responsible for containment of malware, 33% reported having an ad hoc approach, and 40% reported that no individual in their company was responsible for containment. Approximately 10% stated that they have a structured approach that relies almost exclusively on manual activities. Roughly one third of the respondents stated that they have a structured approach that employs both automated tools and manual activities.

A recent study by IDC found that only 40% of the participants reported that they actually review every alert manually. And in a survey conducted by Skyhigh Networks, 30% of the respondents admitted that they sometimes ignore security alerts due to the high number of false positives, a practice that clearly leaves their organizations vulnerable.

The solution for handling false positives
The first step in creating an effective system for handling false positives is to realize that your staff are already overwhelmed. Even if staff members can evaluate an average of 12 alerts per hour -— which does not provide sufficient time for a thorough analysis —- each team member would be able to review fewer than 100 alerts per day. After weeks or months of facing a mountain of alerts that they cannot possibly clear, staff members may become desensitized to alarms, leading them to overlook alerts on legitimate threats. Given the scarcity of qualified personnel, many companies are also forced to rely on staff members with little experience in the "real world" or little training in SOC procedures, increasing the possibility of an overlooked threat.

The second step is leveraging robust detection engines, continual tuning and filtering, and analysis leveraging rich contextual threat data to eke out what is truly of value. Unfortunately, this process ends up generating high volumes of data.

The most effective strategy to realize the benefits for this data is through automation and collaboration hunting. Automation can be instrumental for identifying good data from worthless data. Automating security operations can help you build custom playbooks and workflows to handle each type of alert and detect duplicates with ease. In addition to detecting duplicates, the common procedures will help create best practices response actions within each playbook.

False positives are going to continue to plague SOC professionals for many years to come. This area is truly one in which the cliché, "Work smarter, not harder," seems appropriate -- and automation is the key to working smarter.

Rishi Bhargava is Co-founder and VP, Marketing for Demisto. Prior to founding Demisto, he was Vice President and General Manager of the Software Defined Datacenter Group at Intel Security. Rishi has over a dozen patents in the area of Computer Security.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25514
PUBLISHED: 2020-09-22
Sourcecodester Simple Library Management System 1.0 is affected by Incorrect Access Control via the Login Panel, http://<site>/lms/admin.php.
CVE-2020-25515
PUBLISHED: 2020-09-22
Sourcecodester Simple Library Management System 1.0 is affected by Insecure Permissions via Books > New Book , http://<site>/lms/index.php?page=books.
CVE-2020-14022
PUBLISHED: 2020-09-22
Ozeki NG SMS Gateway 4.17.1 through 4.17.6 does not check the file type when bulk importing new contacts ("Import Contacts" functionality) from a file. It is possible to upload an executable or .bat file that can be executed with the help of a functionality (E.g. the "Application Star...
CVE-2020-14023
PUBLISHED: 2020-09-22
Ozeki NG SMS Gateway through 4.17.6 allows SSRF via SMS WCF or RSS To SMS.
CVE-2020-14024
PUBLISHED: 2020-09-22
Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the (1) Receiver or Recipient field in the Mailbox feature, (2) OZFORM_GROUPNAME field in the Group configuration of addresses, (3) listname field in the Defining address lists configuratio...