The intersection of big data and security analytics has officially arrived as large organizations collect, process, store, and analyze terabytes of internal and external security data. This trend is driving greater consumption of security intelligence for security analytics. ESG found that advanced organizations are gaining extensive value from security intelligence as it helps them address risk and detect/respond to incidents in a more rapid fashion. This brief discusses the best practices that proactively address risk these organizations utilize to maximize benefits from security intelligence.
Enterprises collect terabytes of data on a monthly basis. What makes security data “big data?“ One place to start is simply security data volume.
New ESG data reveals that enterprise organizations believe that the intersection of security analytics and big data is here today or will arrive very soon.
In order to assess the intersection of big data and security analytics in 2012 and beyond, ESG surveyed 257 IT and information security professionals working at enterprise-class (1,000 employees or more) organizations in North America. All respondents were directly involved in the planning, implementation, and/or operations of their organization’s information security policies, processes, or technical safeguards. They were all also familiar with their organization’s collection and/or analysis of security data in support of their organization’s risk management, security analysis, and incident detection/response strategies.
Large organizations are collecting, processing, storing, and analyzing more and more data to support security management and operations activities such as risk management and incident detection/response. Legacy security analytics tools cannot keep up with this data growth, which presents a new set of challenges and risks for CISOs. The data presented in this report identifies a transition in place--large organizations will alter processes, replace technologies, and enhance internal skills in order to build a scalable, integrated, and highly intelligent "big data" security analytics architecture.
This month, Sourcefire announced new security software, new network security appliances, and AMD/P functionality for FirePOWER appliances. This announcement alone was pretty impressive, but along with Sourcefire’s host-based AMD/P, next-generation network security offerings, and cloud-based big data intelligence and analytics, Sourcefire offers an enterprise-class security architecture. This will likely make Sourcefire extremely popular with CISOs and large organizations.
Motivated by Advanced Persistent Threats (APTs), insider attacks, and the ominous threat landscape, many large organizations are investing in new database security controls. This is a good start, but ESG believes that databases must become part of an overall security strategy and not simply secured in isolation. To maximize protection while streamlining operations, a database security strategy should encompass people, processes, and technology while tightly integrating into the overall enterprise security architecture.
Bipartisan rhetoric sounds good but cybersecurity action is likely to languish.
Pity the poor CISO working in small enterprise organizations. Faced with a dangerous threat landscape and a multitude of new IT initiatives, security executives are forced to address new security requirements with legacy point tools, short-staffed security groups, and manual processes. This can’t—and won’t—work for long. What’s needed are new intelligent, automated, and tightly integrated security management systems that are designed for both compliance automation and incident detection/response. Available solutions are few and far between, but eIQ is one vendor offering this type of next-generation functionality today.
Common market and skills, complementary technologies, and opportunities for services play.
New SIEM functionality from LogRhythm baselines behavior for anomaly detection and security automation
Many CISOs are in a no-win situation. On the one hand, they face a dangerous threat landscape and need to secure new IT initiatives such as cloud computing, mobile computing, and social media. On the other hand, they continue to rely on discrete point tools, under-staffed organizations, and manual processes as the basis of their security defenses. This mismatch leads to ever-increasing risk to organizations and IT assets—an unacceptable situation. ESG believes that information security discontinuity is driving fundamental changes across enterprise security that encompasses people, process, and technology. As this transition occurs, IBM may be one of few vendors with the appropriate enterprise products, resources, and expertise to address new enterprise security requirements.
Familiar caution is welcome but perpetual inaction is the real problem.
ESG surveyed security professionals to find out about their current and planned use of third-party professional or managed security service providers to fulfill some or all of their organizations’ security requirements. The research revealed that many organizations are increasing their use of security services for multiple reasons, and most of those reasons relate to the ongoing security skills gap and staff shortage. The most requested security services? Security design and threat management.
Jon Oltsik is an ESG senior principal analyst and the founder of the firm’s cybersecurity service. With almost 30 years of technology industry experience, Jon is widely recognized as an expert in all aspects of cybersecurity and is often called upon to help customers understand a CISO's perspective and strategies.
© 2015 by The Enterprise Strategy Group, 20 Asylum Street, Milford, MA 01757 508.482.0188