An alarming study revealed the stress and strains that the average cybersecurity team experiences daily. Nearly 70% of teams report feeling emotionally devastated by security alerts. These alerts come at such increased volume, elevated velocity, and high intensity that they become an extreme source of stress. Extreme such that people’s home lives are negatively affected. Alert overload is not good who work in cybersecurity. But it’s even worse for everyone who depends on cybersecurity.
It was a big issue in the industry, yet few people even acknowledged that let alone deal with it. Cynet aims to correct that in the guide by shining a light on the cause of the problem and the full extent of its developments, then offer a few ways that lean security teams can pull their analysts out of the ocean of false positives and get them back to shore. It also incorporates tips and tricks on lowering alerts using automation and shares guidance for organizations considering outsourcing their managed detection and response (MDR). The guide also shares how security teams can detangle the web of security tools necessary for automation.
Solving alert overload
Security teams of all sizes need to lower the number of alerts they encounter and refine how they respond to the alerts to take action before the damage starts. Below are the tactics covered in the guide.
Consider outsourcing to MDR: Outsourcing managed detection and response (MDR) is a good option if you need to scale quickly and don’t have the resources. MDRs can help reduce stress and give your team time back. Another consideration is cost. You also will need to invest time in finding an MDR that’s right for your business. As the guide shows, outsourcing can definitely be an asset. But it’s never a comprehensive solution.
Also read,
Strategize reducing alerts: It starts with strategy. Look at your current tech and make sure you’ve optimized their settings and your tools are under calibration. Ultimately, it’s not regarding reducing alerts so much as it’s about how you’ve set your team up to respond.
For example, find ways to expedite how you scrutinize alerts that you can’t eliminate or aggregate. One way is to associate alarms with known activities, like when a planned patch installation disables security tools in bulk as the system recycles. Any other time, the security team would want to know that security tools are going offline, but there’s a simple explanation during patching. Calibrating the tools to “quiet” alerts during known events or intended times will give the security team more time to focus on the actual emergencies.
Introducing automated response: Even the leanest security teams can venture threats if automation was used. Automation allows security squads to respond to alerts at scale quickly. But one of the biggest challenges with automation is knowing how to set it up in the first place properly.
One of the downsides of automated response, we need to try to avoid happening when an automated response, particularly when the kind is driven by machine learning, blocks both malicious and legitimate traffic. These unpredictable instances can be annoying for the security team and users throughout the organization. Problems can also be hard to undo if the actions taken by automation have not been documented along the way. The guide suggests new ways to solve this problem as well.
Use tools that facilitate automation: Setting up automation is not a ‘walk in the park’ because of the plenty of security and IT solutions that need integration (for example, IPS, NDR, EPP, firewalls, DNS filtering, and more.). The key is to put all of these tools in one place. The guide suggests new ways to do just that.
The complete guide can be downloaded from https://go.cynet.com/solving_alert_overload_and_handling_guide?utm_source=thn
Source: https://thehackernews.com/2022/02/guide-alert-overload-and-handling-for.html
