Why Middle East enterprises need a new cybersec approach

Traditional security models focus too much on alerting and prevention tools that can only catch ‘known’ threats, leaving serious gaps in security infrastructure

Tags: AccessData Group LLC (www.accessdata.com)
  • E-Mail
Why Middle East enterprises need a new cybersec approach A virtual war room, with integrated and automated monitoring, and real time collaboration between different technical teams is the way forward for incident response, says Mical.
By  Jason Mical Published  November 20, 2013

Traditional security models focus too much on alerting and prevention tools that can only catch ‘known’ threats, leaving serious gaps in security infrastructure, writes Jason Mical, vice president of Cyber Security, AccessData.

Protecting against cyber threats is an ongoing management challenge for organisations. There are many weaknesses in traditional cyber security models, but there are also new and improved solutions arising in the market. Today’s cyber security infrastructure contains a number of detection, analysis and remediation gaps. Organisations should be focusing on two things: detecting unknown threats and responding faster and more comprehensively to security incidents. However, currently organisations focus most of their attention on alerting and prevention tools.

This is undoubtedly why the majority of security breaches are not discovered until months after the fact. When it comes to detection, most organisations rely primarily on signature-based alerting and prevention solutions, such as intrusion detection systems and antivirus, and they rely on data leakage prevention tools to catch data spills. These products only catch what you tell them to look for, which leaves serious detection, analysis and remediation gaps in your cyber security program.

Additionally, even when a compromise triggers an alert, it is difficult to identify the real threats among the tens of thousands of alerts these tools bubble up. There is very little integration among the tools within a traditional cyber security infrastructure, and the majority of them are designed to dump tons of information in your lap with no remediation functionality. You’re then tasked with sifting through all the noise and correlating data manually to figure out what is really happening.

Once an incident is detected, the response team is normally comprised of members from several disparate information security teams such as network security, forensics, information assurance and malware teams. These various teams each juggle their own sets of tools to analyse the data that is most critical in chasing down a threat. This includes network communications, computers, malware and so on. This approach is particularly dangerous when attempting to address an advanced persistent threat.

Most organisations do not have an integrated incident response platform that enables all this critical analysis within a single interface, and they have no real-time collaboration capabilities. They must correlate network, host and malware information manually and usually in person at ‘war room’ meetings. Operating under this model, I believe we will see response times increase as the number and sophistication of exploits increase.

The key to improving response times is automated and integrated analysis, as well as real-time collaboration. Organisations should implement an integrated incident response platform that allows groups such as network security, forensics, malware and information assurance teams to perform their respective analysis within a single dashboard. It becomes a virtual war room of sorts. When all of this information is available in a single platform and teams are collaborating in real time, all critical analysis can be conducted through a single interface and actionable intelligence is gathered in minutes, as opposed to hours, days or even months.

These tools that offer better real-time collaboration and integrated analysis, are the way of the future, better equipping organisations to protect their domains against the ever-changing and evolving cyber security threats of today.

Add a Comment

Your display name This field is mandatory

Your e-mail address This field is mandatory (Your e-mail address won't be published)

Security code