Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

10/9/2019
04:40 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

Security Tool Sprawl Reaches Tipping Point

How a new open source initiative for interoperable security tools and a wave of consolidation could finally provide some relief for overwhelmed security analysts and SOCs.

{Continued from Page 1}

GreyMatter basically aggregates security data from SIEMs, endpoint detection and response tools, firewalls, threat intelligence feeds, and other security tools, in addition to providing some of its own analytics and automation functions. "The main problem we want to solve is tools fatigue and vendor sprawl," says Joe Partlow, CTO of ReliaQuest. "CISOs are trying to adapt and get greater coverage of their attack surface, but the opposite is happening: not greater visibility ... but instead more complexity and data residing in silos" and more alerts than they can handle, he says.

GreyMatter basically does the dirty work of pulling together the different tools and their data. It gathers the data from the tools and then "normalizes" that data into a standard format for the platform. That replaces the spreadsheet-merging approach many organizations use to sort and correlate data from various tools.

Aaron Sherrill, a senior analyst at 451 Research, says many security tools are mostly just narrowly focused security features that ultimately get swallowed up by other vendors or get wrapped inside existing platforms — or fall by the wayside. "I view GreyMatter as aggregating a few different security approaches, [including] a managed service provider, SOAR, attack simulation," and some other security tools, Sherrill says. "It's [also] an opportunity for them to go a little deeper and look at the effectiveness of the tools in place," too, by providing the status and health of the various security tools in the organization's environment.

Anomali's Cagliostro, meanwhile, points out that one of the big drivers of security tool consolidation is security team turnover, which often results in losing expertise in specific security tools. When an analyst with expertise in reverse engineering gets hired away, for instance, notes Cagliostro, "institutional knowledge goes out the door with him."

Her firm's newly released Lens tool aims to provide all levels of the organization, including SOC analysts as well as company executives, alerts of an attack underway and what to do about it. Lens basically creates automated threat bulletins out of content it gathers online from threat intelligence findings, cybersecurity news articles, security logs, and other sources of threat information. Those bulletins then get absorbed into Anomali's threat intel system. Lens, the threat intel platform, and Anomali Match, an analysis tool, together make up Anomali's Altitude security management platform.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Can the Girl Scouts Save the Moon from Cyberattack?"

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
greg.jensen
50%
50%
greg.jensen,
User Rank: Apprentice
11/22/2019 | 12:55:11 PM
46 point solutions per cyber analyst
This is a problem exasberated by the proliferation of point solutions that lack integration and creates gaps of capability between them.  According to my annual Cloud Threat Report, we found the average cyber analyst/leader is responsabile for 46 individual cyber solutions to manage risk and threats. This is a number that has been growing and consolidation (as you point out) is not only ineviable, it is critical to helping to reign it all in.  Great job on this article!
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "The security team seem to be taking SiegeWare seriously" 
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16770
PUBLISHED: 2019-12-05
A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.
CVE-2019-19609
PUBLISHED: 2019-12-05
The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.
CVE-2019-16768
PUBLISHED: 2019-12-05
Exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. A validation m...
CVE-2012-1105
PUBLISHED: 2019-12-05
An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. The Central Authentication Service client library archives the debug logging file in an insecure manner.
CVE-2019-16769
PUBLISHED: 2019-12-05
Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash...