Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

9/18/2018
10:30 AM
Dave Frampton
Dave Frampton
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

Overhauling the 3 Pillars of Security Operations

Modern apps and the cloud mean that organizations must now rethink older security practices.

Change is hard — especially when what needs to be changed has made progress against long-pursued goals. Transitions involving digital transformation, cloud migration, and application architecture are disrupting security operations in fundamental ways. Just as orchestration and automation, machine learning, and collaborative defense enable progress for traditional defenses, new challenges of modernizing IT — including increased threat surface area, transient infrastructure, and growing use of apps and the cloud — demand new approaches for the core defense functions of threat detection and investigation.

A large majority of security pros surveyed in our "2018 Global Security Trends in the Cloud" report observe that as their organization transitions to the cloud, there is a corresponding increase in the need for security and operations to collaborate, sometimes awkwardly, during threat detection and investigation. Further, over 80% of respondents note the need to examine threats at both the application and infrastructure layers. While a surprising 93% say current security tools are ineffective for the cloud, many assert that several traditional categories such as security information and event management (SIEM) — which create cumbersome silos of data, analytics, and workflow — should be completely rethought for the cloud.

The interests of the status quo advocate incrementalism to address these issues, such as bringing cloud data into the traditional SIEM, automating manual workflows, and layering additional tools for specialized analytics. But many security leaders see the need for a more disruptive break with the past to address three weaknesses of current security practices:

1. Siloed security can't understand and respond to the new generation of attacks.
One dilemma in security for cloud and modern application development/deployment is that the knowledge needed to pursue an investigation to its conclusion often is divided between two groups. Security analysts understand the process of investigation and the broad context, but only the operations team is apt to understand the essential specific context — application behavior and customer content, for example — needed to interpret and hypothesize at many steps in a security investigation.

"Dual-ticket" workflows in which cloud and ops teams have unique insight on application and network performance, DevSecOps workflows in which deep knowledge of the application is needed to map vulnerabilities to threat-detection methods, and investigation workflows that demand specific understanding of microservice logging practice are all good examples of where security must be democratized across groups as IT modernizes.

While separate silos for operations and security investigations made sense for classic on-premises systems, modern cloud deployments and application architecture demand a seamless back-and-forth workflow where, at each step, the skills and perspective from both operations and security can properly interpret the results of queries, evidence uncovered, or unfamiliar data. Despite the uncomfortable change on many levels, enabling collaborative real-time workflows is the only real answer.

2. Current-generation security tools lack essential application and cloud context.
Current tools rely too much on comfort zones with traditional infrastructure. Containers, microservices, distributed applications, DevSecOps — all of these trends create massive threat surface areas that demand security defenses have new insights into data. Specifically, much deeper insight into application layer and cloud context is needed for many workflows. Examples include cross-site scripting attacks, mapping microservices to dynamic infrastructure, and external customer behavioral analytics in production security.

Distributed applications in the cloud, container orchestration, and complex hybrid and multicloud use cases will continue to exacerbate the blind spots of traditional infrastructure-focused security. Developing new cloud and application insights with pattern recognition, machine learning, and context capture, and then packaging these insights for practical use, is one of the next frontiers in the evolution of security.

3. Humans and machines must collaborate 100x faster.
Many security operation centers are already at the breaking point with growing backlogs of investigations and reactive triage. An often-quoted statistic is that less than 10% of investigations are completed in a typical security operation.

Cloud and modern application transitions multiply the threat surface many times over, generating staggering volumes of data that need to be rapidly assimilated for insights. Further, cross-enterprise collaboration is requiring new models of distributed knowledge transfer because investigation workflows need to be shared across both security and operations.

Industry hype suggests artificial intelligence, machine learning, and improved automation will rapidly replace humans in every workflow in the next few years, but the reality is that there will be a long transition in which optimizing human and machine collaboration is essential to scale the defense. Although much can be automated, human context is still essential in many security workflows.

Breakthrough innovation in search speeds, data navigation and workflow learning will be needed to connect the dots across large and dynamic data sets. Furthermore, to keep pace, many investigation workflows must compress to minutes from the current hours — and sometimes days — despite the worsening data avalanche problem that is a result of cloud and application transitions.

Many enterprises are rethinking architectures, workflows, and tooling to tackle these challenges. The accelerating rate of the underlying transitions to cloud, digital transformation, and new application architectures is putting pressure on the pace of change.

Related Content:

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Dave Frampton is Vice President of Security Solutions at Sumo Logic, the leading cloud-native machine data analytics platform. He leads the development of security analytics solutions that solve the emerging challenges of cloud and modern application architectures. Before ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
virtualphil
50%
50%
virtualphil,
User Rank: Apprentice
9/18/2018 | 12:55:04 PM
Something new
Was this written in the 2000? 

https://www.mn.uio.no/ifi/english/research/groups/is/events/architecture-seminar/bygstad.pdf

"In his much cited article "Dismantling the silos: extracting new value from IT investments in public

administration" (2001) Frank Bannister analysed the growth of silo systems in the public sector."

Data silos have been A KNOWN ISSUE since 2001!

Have anything new to offer than react 100x faster? Does that imply man-machine interface becase I do not believe you can get a 100x speed improvement fromm the human side of the equation.  Maybe we need to hire an additional 99 to 1 people to make this work?

Would have been nice to actualy define what the 3 pillars are and what you propose they become. I do not see anything like that here.
caniwisteve
50%
50%
caniwisteve,
User Rank: Apprentice
9/23/2018 | 11:05:16 PM
Ahhh - it makes sense. Overhaul the 3 pillars of context, coverage and collaboration
Modernizing organisation need people, process technology that:

1) understand the 'context' of data sources

2) has the 'coverage; of key data sources (instead of leaving gaps in areas with growing attack vectors)

3) enables 'collaboration' across the whole stack (DevSecBizOps) using AI to reduce human analysis factor
For Cybersecurity to Be Proactive, Terrains Must Be Mapped
Craig Harber, Chief Technology Officer at Fidelis Cybersecurity,  10/8/2019
A Realistic Threat Model for the Masses
Lysa Myers, Security Researcher, ESET,  10/9/2019
USB Drive Security Still Lags
Dark Reading Staff 10/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17545
PUBLISHED: 2019-10-14
GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded.
CVE-2019-17546
PUBLISHED: 2019-10-14
tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
CVE-2019-17547
PUBLISHED: 2019-10-14
In ImageMagick before 7.0.8-62, TraceBezier in MagickCore/draw.c has a use-after-free.
CVE-2019-17501
PUBLISHED: 2019-10-14
Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > Discovery screen).
CVE-2019-17539
PUBLISHED: 2019-10-14
In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.