Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

10/9/2019
04:40 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

Security Tool Sprawl Reaches Tipping Point

How a new open source initiative for interoperable security tools and a wave of consolidation could finally provide some relief for overwhelmed security analysts and SOCs.

{Continued from Page 1}

GreyMatter basically aggregates security data from SIEMs, endpoint detection and response tools, firewalls, threat intelligence feeds, and other security tools, in addition to providing some of its own analytics and automation functions. "The main problem we want to solve is tools fatigue and vendor sprawl," says Joe Partlow, CTO of ReliaQuest. "CISOs are trying to adapt and get greater coverage of their attack surface, but the opposite is happening: not greater visibility ... but instead more complexity and data residing in silos" and more alerts than they can handle, he says.

GreyMatter basically does the dirty work of pulling together the different tools and their data. It gathers the data from the tools and then "normalizes" that data into a standard format for the platform. That replaces the spreadsheet-merging approach many organizations use to sort and correlate data from various tools.

Aaron Sherrill, a senior analyst at 451 Research, says many security tools are mostly just narrowly focused security features that ultimately get swallowed up by other vendors or get wrapped inside existing platforms — or fall by the wayside. "I view GreyMatter as aggregating a few different security approaches, [including] a managed service provider, SOAR, attack simulation," and some other security tools, Sherrill says. "It's [also] an opportunity for them to go a little deeper and look at the effectiveness of the tools in place," too, by providing the status and health of the various security tools in the organization's environment.

Anomali's Cagliostro, meanwhile, points out that one of the big drivers of security tool consolidation is security team turnover, which often results in losing expertise in specific security tools. When an analyst with expertise in reverse engineering gets hired away, for instance, notes Cagliostro, "institutional knowledge goes out the door with him."

Her firm's newly released Lens tool aims to provide all levels of the organization, including SOC analysts as well as company executives, alerts of an attack underway and what to do about it. Lens basically creates automated threat bulletins out of content it gathers online from threat intelligence findings, cybersecurity news articles, security logs, and other sources of threat information. Those bulletins then get absorbed into Anomali's threat intel system. Lens, the threat intel platform, and Anomali Match, an analysis tool, together make up Anomali's Altitude security management platform.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Can the Girl Scouts Save the Moon from Cyberattack?"

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
greg.jensen
50%
50%
greg.jensen,
User Rank: Apprentice
11/22/2019 | 12:55:11 PM
46 point solutions per cyber analyst
This is a problem exasberated by the proliferation of point solutions that lack integration and creates gaps of capability between them.  According to my annual Cloud Threat Report, we found the average cyber analyst/leader is responsabile for 46 individual cyber solutions to manage risk and threats. This is a number that has been growing and consolidation (as you point out) is not only ineviable, it is critical to helping to reign it all in.  Great job on this article!
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19740
PUBLISHED: 2019-12-12
Octeth Oempro 4.7 allows SQL injection. The parameter CampaignID in Campaign.Get is vulnerable.
CVE-2019-19746
PUBLISHED: 2019-12-12
make_arrow in arrow.c in Xfig fig2dev 3.2.7b allows a segmentation fault and out-of-bounds write because of an integer overflow via a large arrow type.
CVE-2019-19748
PUBLISHED: 2019-12-12
The Work Time Calendar app before 4.7.1 for Jira allows XSS.
CVE-2017-18640
PUBLISHED: 2019-12-12
The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
CVE-2019-19726
PUBLISHED: 2019-12-12
OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be defeated by setting a very small RLIMIT_DATA resource limit. When executing chpass or passwd (which are setuid root), _dl_setup_env in ld.so tries to strip LD_LIBRARY_PATH from th...