Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

3/11/2019
04:00 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

3 Places Security Teams Are Wasting Time

Dark Reading caught up with RSA Security president Rohit Ghai at the RSA Conference to discuss critical areas where CISOs and their teams are spinning their wheels.

If a single adjective could describe the universal attendee experience at last week's RSA Conference, it would probably be "overwhelmed." There were nearly 750 exhibiting vendors overflowing many football fields' worth of conference real estate, hundreds of conference talks, and tens of thousands of people thronging the event. As a result, it took most attendees a ton of work to sift through everything in order to mine the information and connections that actually offered them value.   

It's pretty apt, too, as it offers an uncanny parallel to the existential experience of security leaders and practitioners out in the real world today. Their inboxes are flooded by vendor sales pitches, their security operation centers are deluged with alerts and false positives, and their emotional stress levels are at all-time highs. It certainly helps to explain the emphasis on career burnout and even organized yoga events offered at RSAC this year. 

But it's going to take more than self-care to get security teams to the next level. It's also going to take prioritization so that cybersecurity professionals can eliminate the wasteful activities in their professional lives and focus on the things that help them most efficiently tackle cybersecurity risks for their organizations.

At the show, we caught up with Rohit Ghai, president of RSA Security, to discuss the trends driving security leadership today. He believes that the most evolved executives are learning to prioritize by helping their organizations marry overall enterprise risk management with cybersecurity.

"People are realizing that standalone cybersecurity is overwhelmed, and in order to tip the balance, you have to apply business context to security so you can prioritize and focus on what matters most," he said.

Additionally, he pointed to several key areas where cybersecurity leaders need to stop spinning their wheels.

Juggling Security Vendors 
Vendor fatigue is increasingly wearing on CISOs today, as the allure of acquiring best-in-class features has turned into an integration and vendor management nightmare for many. Right now organizations must sift between 4,700 different security vendors and systems integrators vying for attention, according to figures from the Cyber Research Databank. More than eight in 10 midsize business security leaders say it takes them and their staffs anywhere between 20 and 60 hours per week procuring, implementing, and managing security products.  

"I think they're wasting a lot of time in integrating point solutions and dealing with this fragmentation in the industry," Ghai said, “which is why an end-to-end strategy that brings in kind of the wholistic view is the right way to approach it."

Low-Priority Problems
The second area Ghai pinpointed as a security time sink is on low-priority problems and vulnerabilities. Most security professionals, he said, don't have an "innate sense of what's important" to their organizations.

"In a world where almost half of the cyber incidents go unhandled, what you want to make sure is the right half is getting addressed," he said. "They don't have that compass to tell them what is the right half, and they need business context for that. So that's a clear area of waste." 

This jibes with Deloitte's most recent "Future of Cyber" report, released last week, which named prioritization of cyber-risks across the enterprise as the second-biggest challenge facing CISOs today. 

Manual Labor on Automatable Problems
Finally, Ghai said, the third biggest area where cybersecurity teams are wasting their times is in plugging away with manual processes where automation would make more sense.

"We have a cyber talent issue, and we're still doing a lot of work that can be automated," Ghai said. "I envision a SOC where humans are collaborating with machines together to advance the agenda. We need to free up the human analysts from the mundane tasks of cutting and pasting URLs." 

CISOs are definitely coming around on this front. Approximately 58% of security decision-makers agree that machine learning and AI should help make the job of security professionals easier in the future. 

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
How Attackers Infiltrate the Supply Chain & What to Do About It
Shay Nahari, Head of Red-Team Services at CyberArk,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13961
PUBLISHED: 2019-07-18
A CSRF vulnerability was found in flatCore before 1.5, leading to the upload of arbitrary .php files via acp/core/files.upload-script.php.
CVE-2019-13962
PUBLISHED: 2019-07-18
lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.
CVE-2019-10101
PUBLISHED: 2019-07-18
OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery (CSRF). The impact is: The victim clicks on adding an administrator account. The component is: admincp.php. The attack vector is: network connectivity. The fixed version is: v4.3.
CVE-2019-10102
PUBLISHED: 2019-07-18
MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. The impact is: MySQL database content disclosure (e.g. username, password). The component is: The API call in the function allowAction() in NewslettersControlle...
CVE-2019-10102
PUBLISHED: 2019-07-18
Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detection bypass. The impact is: An attacker can evade a signature detection with a specialy formed sequence of network packets. The component is: detect.c (https://github.com/OISF/suric...