Orchestrating security technology

The plethora of security analytics tools available to federal agencies has helped improve cyber incident and vulnerability prevention, detection, response and recovery. However, significant challenges remain as types of attacks and attack vectors increase. Indeed, agencies are finding they often need to integrate or “orchestrate” existing analytical tools, processes and data into repeatable, automated workflows to fully support solid security operations.

Concurrently, architectural challenges abound as cloud services, mobile technology and internet of things devices rapidly generate increasing amounts of data, new system endpoints and network traffic flows. Newer cyber analytics that use machine learning are of primary interest because rule-based or signature-based prevention tools struggle to detect or stop advanced cybersecurity threats.

Here are some key observations and lessons learned to date in the cyber analytics area: 

1. Security analytics require orchestration. There are a wide range of commercial products and open-source tools that agencies can use to perform analytics, but agencies should not fool themselves. The full value of enterprise security analytics cannot be gained simply by installing hardware or network appliances.

Federal agencies are building systems that ingest terabytes of security data, but their analysts can only read triaged data at a few events per minute. Even with fantastic visualization tools, analysts will only be able to mentally process tens of events per minute. Tools can help pare down the dataset to a smaller size, but analysts also must know what questions to ask for common use cases (e.g., cyberthreats, insider threats, data exfiltration and user account access abuse or misuse). As the saying goes, “A fool with a tool is still a fool.”

Moreover, agencies often have several security tools that are deployed in independent silos, and many of them invoke duplicative capabilities from different vendors, sometimes on the same system. Security analytics will need to connect those silos and automate processes and investigations across those tools until they evolve to the point where they function as a “force multiplier” for better threat detection.

2. Accurate inventories of networks, systems and endpoints are essential. Shadow IT — a combination of unauthorized and unidentified solutions — is a growing problem for federal agencies. Audits by inspectors general and the Government Accountability Office demonstrate the lack of complete knowledge about what resides on and interacts with agency networks (hardware, software, mobile, IoT, etc.). Agencies cannot protect what they don’t know about.

Fortunately, new tools are much better at tracing networks and detecting/identifying devices. Security analytics correctly applied to network traffic helps shine light into the shadows.

3. People trained in advanced analytical tools are crucial. Federal CIOs, CTOs and chief information security officers must hire and retain the right team for security analytics and treat it as an ongoing investment. Security analysts must be curious, explore the high-value anomaly data they collect, trace unusual patterns and follow the trail of an investigation wherever it leads.

Looking at individual or correlated events is not sufficient anymore. That approach is being augmented by a rise in “offensive hunting” in which highly trained analysts emulate bad actors (hired hacktivists, rogue nation-states, insider threats) and their tactics to penetrate networks, devices, applications and systems.

Advanced security analytics requires bridging two new professional domains: hacking and data science. Most experts specialize in one or the other but not both. Accordingly, data scientists and security experts need to work together to enable the use cases that are essential to good security diagnostics and continuous monitoring.

Agencies still need competent security analysts to tweak models, confirm “good” versus “bad” anomalies and analyze critical outputs of agentless appliances. Although red teams and hunt teams play a separate role in cyber defense in larger organizations, skills and experience are in short supply and often an outsourced capability.

Those capabilities, combined with effective incident response processes, are critical for continuous security improvements and a full understanding of different types of attacks, including commonly used phishing and other social engineering techniques.

More important, agencies must set up cyber analytics to fit their risk profile and threat vectors. It is not uncommon for agencies to drop sophisticated tools into their networks without having skilled employees do the required tuning to optimize detection and protection for specific and unique threat ecosystems. One size does not fit all, but going with default settings is creating such an environment, which is easy to breach and attack using zero-day exploits with far-ranging impacts.

4. Continuous monitoring must include continuous data sharing. Critical data for cyber analytics is typically not owned by the security departments. Instead, the business or program side of an agency is the data owner and access controller. Well-defined cyber and data governance and stakeholder management are needed to tackle that complication. Additionally, proper processes and technology are the key to collecting and delivering the right data.

Security officials should reset current approaches by clearly defining what they want to achieve with cyber analytics, followed by consideration of three key initial steps:

* For agencies still relatively new to the cyber analytics space, it might be worthwhile to explore the open-source versions of tools or, alternatively, pursue time-bound pilots or “proofs of value” that can be up and running with demonstrated results in days or weeks before jumping to advanced tool acquisitions. That approach can help garner executive support and gain the IT team some experience with the tools.

* Agencies should follow a strategy and roadmap that embraces the idea that there is no single tool, no single database and no single approach to solving a cyberthreat problem. Locking into a vendor/solution in an evolving market could be premature, particularly if that vendor is not tuned into changing threat environments. Security analytics should complement diverse strengths rather than compete against one another.

* Setbacks should be expected. Security analytics will not solve all detection problems or pinpoint every threat. The tools can, however, reduce alert volumes and false positives, identify previously unknown threats, and uncover abusive insider threats. Agencies must learn from each journey down thorny cybersecurity pathways — from their own mistakes and those of others. Continuous adaptation, learning and adjustment are necessary in such a complex and ever-changing cyberthreat environment.