Smarter Security, Smarter Everything

In many cases, organizations do not discover their own security threats/breaches—the discovery is made by an external third party and then reported to the victim organization. When breaches are discovered internally, they typically come from either active methods designed specifically for detection or passive methods in which an incident is uncovered by a non-security process.

The security model of 10 to 12 years ago is no longer adequate to meet contemporary challenges, as “Internet hooliganism” has given way to organized criminal activity. The older model is outmoded and does not scale in the face of today’s threats and IT environment. Perimeter-based security has evolved to a highly distributed model as employees, partners and customers conduct business remotely across the Internet and criminals exploit new attack vectors and misplaced user trust. Government and industry regulatory mandates emerged and were given “teeth” through stronger penalties and more diligent enforcement.

The security industry has responded with new and enhanced products to meet each threat. All of these tools add value to overall enterprise security, but they are, in effect, islands of security technology. They are not conducive to a risk-based, enterprise-wide security program, and the overall effort tends to be fragmented.

In many cases, organizations must deal with incomplete data because a given security tool may not recognize a threat or risk for what it is without correlation from other data sources. On the other hand, even when data is collected from disparate sources, analysts are challenged by the sheer volume, making it extremely difficult to distill actionable information.

Security intelligence addresses these problems across the spectrum of the security lifecycle, centralizing data from disparate silos, normalizing it and running automated analyses. This enables organizations to prioritize risk and cost-effectively deploy security resources for detection, prevention, response and remediation.

Moving Beyond Log Management and SIEM

The concept of security intelligence is partially realized in security information and event management (SIEM) tools, which correlate and analyze aggregated and normalized log data. Log management tools centralize and automate the query process, but they lack the flexibility and sophisticated correlation and analysis capabilities of SIEM and, ultimately, security intelligence.

But SIEM should be regarded as a point along the way rather than a destination—the end goal is comprehensive security intelligence. SIEM is very strong from an event-management perspective and plays a particularly important role in threat detection. Comprehensive security intelligence, however, must encompass and analyze a far broader range of information. It requires continuous monitoring of all relevant data sources across the IT infrastructure, as well as evaluating information in contexts that extend beyond typical SIEM capabilities.

Security intelligence should include a much broader range of data, leveraging the full context in which systems are operating. That context includes, but is not limited to, security and network device logs, vulnerabilities, configuration data, network traffic telemetry, application events and activities, user identities, assets, geo-location, and application content.

This produces a staggering amount of data. Security intelligence provides great value in leveraging that data to establish very specific context around each potential area of concern and executes sophisticated analytics to accurately detect more and different types of threats.

For example, a potential exploit of a web server reported by an intrusion detection system can be validated by unusual outbound network activity detected by network behavioral anomaly detection (NBAD) capabilities.

Or, you have a report that a server has a potential vulnerability that has just been disclosed. But it’s one of hundreds in your organization, so how do you evaluate the threat for this particular server? Security intelligence can analyze all available data and tell you:

The presence or absence of the vulnerability
The value the organization assigns to the asset or data
The likelihood of an exploit based on attack-path threat models
Configuration information, which may indicate, for example, that the server is not accessible because a default setting has been changed
The presence of protective controls, such as an intrusion prevention system

Or, consider the insider threat. The 260,000 diplomatic cables on military issues given to WikiLeaks in 2010 were obtained by a U.S. Army insider with a security clearance who, according to charges, did “intentionally exceed his authorized access.” According to news reports, he took advantage of a loophole in policies intended to prevent unauthorized downloading. It is possible that analysis of correlated data, applying contexts from multiple sources, may have stopped the leak before it could cause damage.

A key value point for security intelligence beyond SIEM is the ability to apply context from across an extensive range of sources. This can reduce false positives, tell users not only what has been exploited but also what kind of activity is taking place as a result, and provide quicker detection and incident response.

Schedule a consultation today to learn how Flagship can help you design and implement an effective security intellience solution.

Educational materials on this topic can be found at: https://flagshipsg.com/security

Stay connected online:

Facebook | Twitter | LinkedIn | Instagram

Moving Beyond Log Management and SIEM

Blog Archives

Categories

Recent Posts

Follow @Flagshipsg1 on Twitter

RESOURCES

PRODUCT EXPERTISE

RESOURCES

PRODUCT EXPERTISE