NC1701

FEATUREREAL-TIME DETECTION
DISAMBIGUATING REAL-TIME THREATS
EYAL BENISHTI, CEO OF IRONSCALES, SAYS THAT EFFECTIVE
DETECTION OF IMMINENT SECURITY THREATS SHOULD BE
COLLABORATIVE AND MULTI-TIERED
Real-time threat detection is a commonly
used term in cybersecurity. Typically,
most organisations interpret this as a
clear indication of either an imminent or
actual security compromise. However, the
past reality is somewhat different: it is most
likely that organisations used real-time
detection software and were observing a
correlation of detections from different
sources. To be of any use, this visibility would
require some informed, expert, manual
analysis to fully understand the data.
Some organisations continue to embrace
this antiquated definition of real-time threat
detection, but doing so is misguided. Realtime
threat detection should provide clear
and actionable information concerning
potentially malicious activity, which can then
be shared and used as a real-time trigger for
real-time remediation. If real-time threat
detection is to add any value, it must provide
visibility of any imminent anomaly, suspicion,
evidence, trend, threat or attack signatures
that can in turn be acted on immediately,
using either human intervention or an
automated response.
THE REAL-TIME REQUIREMENT
Full visibility and insight into your
organisation's networks, servers, cloud,
endpoints and other assets is imperative
given the nature of the threat landscape.
Significant and devastating damage can be
unleashed by attacks that all too often
remain undetected for days, weeks, months,
and even years.
Having said this, there are some specific
reasons why real-time threat detection is now
more important than ever. Firstly, there is a
severe shortage of security professionals to
analyse and remediate events. According to
ISACA, over 84 per cent of organisations
worldwide believe that less than half of
applicants for security jobs are qualified for
the role.
Then there is the frequency of cyber events
requiring expert attention. This can surpass
500 per day for large organisations and adds
a significantly increased risk. Finally, skilled
attackers who have time to expertly hide
within a network or cloud are highly effective
- and they are becoming difficult and
expensive to locate.
INVESTMENTS IN REAL-TIME THREAT
DETECTION
In recent years, Managed Security Service
Providers (MSSPs) have emerged as a
tremendous resource to assist organisations
with 24/7 monitoring and response.
According to the analyst firm Frost & Sullivan,
the MSSP market is expected to surpass
$12.78 billion in annual revenue by 2018,
largely because companies of all sizes can
derive benefit. MSSPs are particularly effective
for small and medium sized enterprises that
are frequently hit by cyber-attack debris or
second wave attacks.
However, no organisation should rely
entirely on MSSPs for their real-time threat
detection. Organisations must invest in
technology to collect and aggregate data,
detect anomalous activity and behaviour, and
automatically respond to events that are
discovered either by internal defence
solutions or by human analysis.
With so many cybersecurity solutions
available, how can an organisation start the
selection process? Since there is no longer a
defined perimeter and with new types of
malware being discovered daily, it's critical to
build a defence-in-depth strategy which
establishes multiple layers of protection and is
served by an automated response to
confirmed attacks.
Since the plethora of cybersecurity products
and solutions show disparate views of an
organisation's defences, security information
and event management (SIEM) software
products that show a unified situational
analysis are a wise investment, especially for
companies understaffed in security. In
addition, it's imperative for organisations to
create a culture of security in which all
employees throughout the organisation are
educated, vigilant, and empowered to protect
company assets.
Embracing a more modern definition of realtime
threat detection requires the collaboration
of products and services, employees, the
security operations centre (SOC) team, IT, the
C-suite and the Board all working together.
Using this unified approach, enterprises can
establish a much better chance of surviving
inevitable cyber-attacks. NC
10 NETWORKcomputing JANUARY/FEBRUARY 2017 @NCMagAndAwards
WWW.NETWORKCOMPUTING.CO.UK