To shift to data-driven security decision making: Start with the right data

We live in the age of data-driven everything. From sales to operations, and everything in-between, today’s organizations are constantly looking for ways to leverage the data they accrue – reacting more agilely, operating more efficiently, and safeguarding profitability.

Security should be no different. Yet businesses continue to succumb to digital threats because security teams can’t make the most of their data. A key reason behind this security shortfall is the vast volume of data being produced by security tools.

Wary of the regulatory, reputational and business continuity implications of cyberattacks, organizations are over-investing in cybersecurity. In fact, recent research by Trend Micro found that the average organization has no less than 29 security monitoring solutions in place. This translates into an unmanageable amount of data flowing into the Security Operations Center (SOC), and makes it increasingly difficult to prioritize alerts and manage cyber risk.

Today, cybersecurity stakeholders are at a crossroads. They understand that not all datasets are born equal. Yet they’re still seeking the best way to create a balance between the amount of data they have and the amount they need. Knowing which data is the right data has become a mission-critical challenge.

Tool sprawl: Where’s the data coming from

Tool sprawl – the term coined to describe the over-abundance of cybersecurity incident detection and response tools enterprises are adopting – has brought cybersecurity professionals to the point where they have trouble telling what data is coming from where, not to mention which data is valid or relevant.

As a result, many tools end up being ignored. How many? The survey quoted above found that over half of respondents don’t even use many of their cybersecurity tools. These security professionals can’t get the most basic value from incident detection and response tools owing to lack of integration, lack of skilled operators, difficulty understanding how to operationalize the solutions, and more.

Too many cooks spoil the data

With so much data in play, it’s also tough for cybersecurity stakeholders to identify system overlaps and (more crucially) the gaps between systems. It is literally hard to see the cybersecurity forest for the trees.

Data that appears relevant could actually be duplicate data from multiple sources – not necessarily relevant to you or your ecosystem. And even if some tools say certain datasets are relevant, this is often based on statistical or industry relevance, not necessarily an organization’s actual unique environment.

With threat exposure distributed across legacy, hybrid, and cloud-native environments, identifying and patching vulnerabilities requires sifting through the mountains of data generated by detection tools, then prioritizing the patching order in-line with business priorities.

And the thing is … this is all getting lost in the data at the moment.

Zooming in on the right data

Cybersecurity data is constantly shifting owing to agile development and emerging threats – to name just a few reasons. Managing security posture demands advanced ability in identifying critical data. Data analytics tools need to be customizable to allow intelligent filtering of relevant information, along with correlation of all findings across the defensive tool array.

Security professionals need to effectively redefine what the ‘right data’ is in order to transition from threat validation to threat management. They need to be able to rapidly and intuitively understand how effectively incident detection and response tools are working. This will allow them to pivot and reconfigure on-demand – detecting the attacks that might have otherwise been missed.

To proactively counter emerging threats and improve overall risk posture, organizations need innovative, efficient, and effective ways to turn today’s security data into tomorrow’s risk management value.

With the threat landscape evolving at such a rapid pace, Extended Security Posture Management (XSPM) platforms help organizations stay in control of their security posture while minimizing resources – allowing security professionals to better understand and control their cybersecurity posture in today’s dynamic environment.

Encompassing Attack Surface Management, Continuous Automated Red Teaming and Breach and Attack Simulation alongside an Advanced Purple Teaming framework, XSPM-based solutions provide granular information about each incident detection and response tool in use. This helps cybersecurity stakeholders identify the overlap between solutions and locks down security gaps the second they’re discovered. What’s more, XSPM solutions deliver detailed remediation recommendations for each gap and optimization options for identified overlaps.

In the age of data-driven everything and pervasive cyber threats, XSPM helps security professionals make sure they’re driving with the right data.

Source: https://www.helpnetsecurity.com/2022/02/22/organizations-leverage-data/