Cyber Defense eMagazine March Edition for 2022

More documents

Recommendations

Info

Why the Future of Threat Detection and Prevention is Unified Security and Risk Analytics Why True AI/ML Capabilities are Essential for Next-Gen Risk Analytics By Sanjay Raja, VP of Product Marketing at Gurucul As cloud adoption continues to grow and remote work becomes the new normal, security teams are facing increased challenges with decreased visibility and a larger influx of security event data. As ransomware attacks continues to rise (i.e., recent SonicWall data showed 148% increase through Q3’21), SecOps teams are struggling to identify attacks before damage is done. As a result, they’re chasing solutions that accelerate detection and response, while increasing operational efficiencies. Unfortunately, in many cases vendor claims only provided minimal improvements that are not keeping pace with the today’s threat actors. Traditional SIEMs and Endpoint-focused XDR are not fulfilling the promise of reducing the burden on understaffed security teams. The volume of alerts and false positives make it an uphill battle. For organizations wanting to reduce cyber risk across the on-prem, cloud, and remote infrastructures commonly supported today, security teams need to leverage unified data collection, a multitude of analytics, non-rule-based Machine Learning (ML) and Artificial Intelligence (AI), consolidated investigation interfaces, and targeted automation for faster response. Cyber Defense eMagazine – March 2022 Edition 56 Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.
A very small set of next-gen SIEM solutions are innovating through more unified security and risk analytics capabilities that are crucial for success today. In this article, I’d like to explore why the future of threat detection and response is stemming from these new advancements. SIEM was initially designed primarily for log collection and storage for compliance, then evolved to include the correlation of more log data sources for threat detection. Over time that functionality increased to integrate log, network, and endpoint data into a single location and match it up with security events. This helped analysts investigate commonalities or groups of related events. And as rules were developed around these related events, the SIEM could help to detect known threats. Then came the rise of the terms like Machine Learning and Artificial Intelligence (ML/AI) – offering the promise of a silver bullet to solve threat detection and response. However, these terms were commonly misused and in reality were just rule-based analytics engines that would conditionally gather more data for greater context. However, as attackers stayed hidden inside the network longer, rule-based analytics often failed to correlate seemingly disparate events across time and continued to focus on known attacks. As a result, new, unknown, and emerging attacks and variants were easily able to avoid detection. Furthermore, SIEM were also traditionally plagued by the lack of cloud-native offerings that were built to handle both cloud and hybrid infrastructures equally. Today, newer advancements in SIEM are focused in several areas designed to make it the primary platform for the security operations center (SOC). This includes security monitoring, improved threat detection, and playbooks to drive faster response. Many EDR, XDR and SIEM solutions that claim to use ML/AI continue to use rule-based engines with finite models, patterns and signatures that are not updated fast enough when new attacks are discovered. However, there are next-gen SIEM solutions incorporating unified security and risk analytics that are taking the extra step to deliver out-of-the-box advanced data modeling across cloud, user, network, asset, endpoint, and log telemetry. The few that offer true ML/AI can automatically detect new, unknown, and emerging attacks, including subtle variants. Along with an understanding of user access and entitlements, behavioral modeling, and risk metrics, the end goal of next generation SIEM is to streamline every facet of the SOC. This includes reducing noise and false positives, prioritizing which IoCs need to be investigated, consolidating data for easier investigations, and providing a high confidence, low-risk automated response to prevent a successful attack. What does that mean? Let’s look at the key elements of unified security and risk analytics in a nextgeneration SIEM. • Unified Correlation, Continuous Risk Profiling and Behavioral Anomaly Detection – A Nextgeneration SIEM must unify data collection across the entire infrastructure, on-prem, cloud and remote, by gathering endpoint, log, user, access, entity/asset, network, and other data to provide greater context. With risk profiling applied to abnormal behaviors, a behavior-based risk can be calculated to elevate which events are truly relevant for investigation, or can even be used to determine an immediate threat with conviction. This shrinks the noise created by false positives and provides more context to enable a much more targeted response, ideally before an attack campaign starts to establish itself. Cyber Defense eMagazine – March 2022 Edition 57 Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.
Page 1 and 2:
Why Changing Classified Document St
Page 3 and 4:
Tips And Trends for OT Cybersecurit
Page 5 and 6: @MILIEFSKY From the Publisher… De
Page 7 and 8: Welcome to CDM’s March 2022 Issue
Page 9 and 10: Cyber Defense eMagazine - March 202
Page 19 and 20: level of concern while working remo
Page 21 and 22: The Fragility of a GPS Centric Worl
Page 23 and 24: Formerly known as LOng-RAnge Naviga
Page 25 and 26: The Role of The CFO In Enterprise C
Page 27 and 28: Help them mitigate potential risks
Page 29 and 30: The Safest Ways for Bitcoin Trading
Page 31 and 32: and clear instructions through a "N
Page 33 and 34: According to Cybereason’s “Rans
Page 35 and 36: If you implement these three tips,
Page 37 and 38: • Nearly half of zero-day malware
Page 39 and 40: Don’t Become a Horrible Headline:
Page 41 and 42: pandemic era. By empowering profess
Page 43 and 44: Have We Learned from Our Past Mista
Page 45 and 46: internet, etc. How much training is
Page 47 and 48: How to strengthen cyber resilience
Page 49 and 50: A BCDR solution with automated disa
Page 51 and 52: 1. Cybersecurity Incidents Will Bec
Page 53 and 54: Is XDR The Right Solution for Today
Page 55: How Open XDR Helps Open XDR address
Page 59 and 60: • What are my options for data la
Page 61 and 62: Additionally, we’ll witness the r
Page 63 and 64: Top 10 Reasons Cyber Defense Firms
Page 65 and 66: 4. Teamwork and individual responsi
Page 67 and 68: 5 Reasons Organizations Need Compre
Page 69 and 70: systems to manage identity and acce
Page 71 and 72: Directed Analytics - The Future of
Page 73 and 74: Directed analytics allow these insi
Page 75 and 76: InDesign and uploaded to indd.adobe
Page 77 and 78: Are You Prepared for the New Normal
Page 79 and 80: • Find Unseen Risk - The hardest
Page 81 and 82: intruders were able to gain control
Page 83 and 84: About the Authors Michael Cheng is
Page 85 and 86: Why am I rehashing this old trope?
Page 87 and 88: 1. Look for and minimize attack sur
Page 89 and 90: On The Frontline in The War Against
Page 91 and 92: How to Fix Mid-Market Security Usin
Page 93 and 94: the particular victims being target
Page 95 and 96: 5 Ways Cybersecurity Will Change In
Page 97 and 98: #3: Supply chains will be the big r
Page 99 and 100: Executive Order Instructs Certain O
Page 101 and 102: • Stay ahead of fraud. Fraud cost
Page 103 and 104: Too Hot to Handle:The case for Zero
Page 105 and 106: Critically, endpoint security only
Page 107 and 108:
To prevent lateral movement attacks
Page 109 and 110:
Redefining Resilience in The New Wo
Page 111 and 112:
About the Author Andrew Lawton is C
Page 113 and 114:
Cyber Defense eMagazine - March 202
Page 115 and 116:
Page 117 and 118:
Page 119 and 120:
Page 121 and 122:
Page 123 and 124:
Page 125 and 126:
Page 127 and 128:
Page 129 and 130:
Page 131 and 132:
Page 133 and 134:
Page 135 and 136:
CyberDefense.TV now has 200 hotseat
Page 137 and 138:
Books by our Publisher: https://www
Page 139 and 140:
show all

Cyber Defense eMagazine March Edition for 2022

Create successful ePaper yourself

Delete template?

Save as template?