Threat Intelligence

9/18/2018
10:30 AM
Dave Frampton
Dave Frampton
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

Overhauling the 3 Pillars of Security Operations

Modern apps and the cloud mean that organizations must now rethink older security practices.

Change is hard — especially when what needs to be changed has made progress against long-pursued goals. Transitions involving digital transformation, cloud migration, and application architecture are disrupting security operations in fundamental ways. Just as orchestration and automation, machine learning, and collaborative defense enable progress for traditional defenses, new challenges of modernizing IT — including increased threat surface area, transient infrastructure, and growing use of apps and the cloud — demand new approaches for the core defense functions of threat detection and investigation.

A large majority of security pros surveyed in our "2018 Global Security Trends in the Cloud" report observe that as their organization transitions to the cloud, there is a corresponding increase in the need for security and operations to collaborate, sometimes awkwardly, during threat detection and investigation. Further, over 80% of respondents note the need to examine threats at both the application and infrastructure layers. While a surprising 93% say current security tools are ineffective for the cloud, many assert that several traditional categories such as security information and event management (SIEM) — which create cumbersome silos of data, analytics, and workflow — should be completely rethought for the cloud.

The interests of the status quo advocate incrementalism to address these issues, such as bringing cloud data into the traditional SIEM, automating manual workflows, and layering additional tools for specialized analytics. But many security leaders see the need for a more disruptive break with the past to address three weaknesses of current security practices:

1. Siloed security can't understand and respond to the new generation of attacks.
One dilemma in security for cloud and modern application development/deployment is that the knowledge needed to pursue an investigation to its conclusion often is divided between two groups. Security analysts understand the process of investigation and the broad context, but only the operations team is apt to understand the essential specific context — application behavior and customer content, for example — needed to interpret and hypothesize at many steps in a security investigation.

"Dual-ticket" workflows in which cloud and ops teams have unique insight on application and network performance, DevSecOps workflows in which deep knowledge of the application is needed to map vulnerabilities to threat-detection methods, and investigation workflows that demand specific understanding of microservice logging practice are all good examples of where security must be democratized across groups as IT modernizes.

While separate silos for operations and security investigations made sense for classic on-premises systems, modern cloud deployments and application architecture demand a seamless back-and-forth workflow where, at each step, the skills and perspective from both operations and security can properly interpret the results of queries, evidence uncovered, or unfamiliar data. Despite the uncomfortable change on many levels, enabling collaborative real-time workflows is the only real answer.

2. Current-generation security tools lack essential application and cloud context.
Current tools rely too much on comfort zones with traditional infrastructure. Containers, microservices, distributed applications, DevSecOps — all of these trends create massive threat surface areas that demand security defenses have new insights into data. Specifically, much deeper insight into application layer and cloud context is needed for many workflows. Examples include cross-site scripting attacks, mapping microservices to dynamic infrastructure, and external customer behavioral analytics in production security.

Distributed applications in the cloud, container orchestration, and complex hybrid and multicloud use cases will continue to exacerbate the blind spots of traditional infrastructure-focused security. Developing new cloud and application insights with pattern recognition, machine learning, and context capture, and then packaging these insights for practical use, is one of the next frontiers in the evolution of security.

3. Humans and machines must collaborate 100x faster.
Many security operation centers are already at the breaking point with growing backlogs of investigations and reactive triage. An often-quoted statistic is that less than 10% of investigations are completed in a typical security operation.

Cloud and modern application transitions multiply the threat surface many times over, generating staggering volumes of data that need to be rapidly assimilated for insights. Further, cross-enterprise collaboration is requiring new models of distributed knowledge transfer because investigation workflows need to be shared across both security and operations.

Industry hype suggests artificial intelligence, machine learning, and improved automation will rapidly replace humans in every workflow in the next few years, but the reality is that there will be a long transition in which optimizing human and machine collaboration is essential to scale the defense. Although much can be automated, human context is still essential in many security workflows.

Breakthrough innovation in search speeds, data navigation and workflow learning will be needed to connect the dots across large and dynamic data sets. Furthermore, to keep pace, many investigation workflows must compress to minutes from the current hours — and sometimes days — despite the worsening data avalanche problem that is a result of cloud and application transitions.

Many enterprises are rethinking architectures, workflows, and tooling to tackle these challenges. The accelerating rate of the underlying transitions to cloud, digital transformation, and new application architectures is putting pressure on the pace of change.

Related Content:

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Dave Frampton is Vice President of Security Solutions at Sumo Logic, the leading cloud-native machine data analytics platform. He leads the development of security analytics solutions that solve the emerging challenges of cloud and modern application architectures. Before ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
caniwisteve
50%
50%
caniwisteve,
User Rank: Apprentice
9/23/2018 | 11:05:16 PM
Ahhh - it makes sense. Overhaul the 3 pillars of context, coverage and collaboration
Modernizing organisation need people, process technology that:

1) understand the 'context' of data sources

2) has the 'coverage; of key data sources (instead of leaving gaps in areas with growing attack vectors)

3) enables 'collaboration' across the whole stack (DevSecBizOps) using AI to reduce human analysis factor
virtualphil
50%
50%
virtualphil,
User Rank: Apprentice
9/18/2018 | 12:55:04 PM
Something new
Was this written in the 2000? 

https://www.mn.uio.no/ifi/english/research/groups/is/events/architecture-seminar/bygstad.pdf

"In his much cited article "Dismantling the silos: extracting new value from IT investments in public

administration" (2001) Frank Bannister analysed the growth of silo systems in the public sector."

Data silos have been A KNOWN ISSUE since 2001!

Have anything new to offer than react 100x faster? Does that imply man-machine interface becase I do not believe you can get a 100x speed improvement fromm the human side of the equation.  Maybe we need to hire an additional 99 to 1 people to make this work?

Would have been nice to actualy define what the 3 pillars are and what you propose they become. I do not see anything like that here.
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
6 Reasons Why Employees Violate Security Policies
Ericka Chickowski, Contributing Writer, Dark Reading,  10/16/2018
Getting Up to Speed with "Always-On SSL"
Tim Callan, Senior Fellow, Comodo CA,  10/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Too funny!
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.