Cyber Defense eMagazine December 2019

89
Faced with an overwhelming volume of alerts and the draining reality of false alarms at the SOC (Security
Operations Center), you begin to wear down. Just like the jaded townspeople in the story of the boy who
cried wolf, you become apathetic and start turning a blind eye. Similar to 31.9 percent of your security
colleagues, you begin to ignore alerts due to the high number of false positives.
And that’s how we get here: Of the typical 17,000 alerts received per week, only 4 percent ever get
investigated. Ouch. Cyber wolves everywhere lick their virtual chops at these numbers as the odds of
slipping real threats past overwhelmed, alert-fatigued defenses become quite favorable.
Misconfigured detection tools are to blame for triggering many of the false positives, and with the growing
security stack and increasing complexity of current defense technology, this trend doesn’t appear to be
slowing. Expanding cloud and Internet of Things (IoT) adoption is only expanding the attack surface and
encouraging organizations to invest in more security tools.
Where does all this leave worn-out analysts and overloaded security operations centers? In desperate
need of an ally. Thankfully machine-learning enabled automation is emerging as a method to streamline
alert handling.
Provides Context
Context is a critical factor in identifying and confirming the validity of threats. Data drives these contextual
relationships, and automation excels collecting, organizing and correlating data in real time. It leverages
the data necessary to identify contextually related alerts, cross-references case details from multiple
systems, spots trends, prioritizes cases and drives faster response.
Manual workflows can’t process or analyze data fast enough to keep pace with evolving threat
landscapes or deliver at scale. Besides, humans are notoriously awful at following a consistent standard.
Programmed cognitive automation removes the “people risk” by adhering to a regular, repeatable
standard when managing and analyzing data.
Shrinks Volume
Automation shrinks the pool of alerts by swiftly weeding the potentially malicious from the benign.
Machine learning quickly recognize the familiar “seen-before” alerts as false positives and removes them
from the queue. The smaller number of “not-seen-before” alerts can then be passed on for further
investigation.
This validation works a massive glut of alerts down to a manageable number for human examination.
With the assistance of the right automation tools, cases can be reduced up to 80 percent. Automated
triage saves time, and lets humans utilize superior cognition for higher-level tasks, rather than burn out
on the mind-numbing process of examining each alert.