Big Changes Coming to Cybersecurity Technology

As 2019 winds down, security analysts like me tend to compile a list of industry predictions. I’m still working on a comprehensive list, but I’m extremely confident that we are about to see some unprecedented changes in enterprise security technology. These changes are already happening behind the scenes, but they will become much more visible in 2020 and beyond.

Topics: Cybersecurity SOAPA

Toward Continuous Automated Penetration and Attack Testing (CAPAT)

According to ESG research, 73% of security professionals say that cyber-risk management is more difficult at their organization today than it was 2 years ago. Why? Survey respondents point to things like the growing attack surface, the rising number of software vulnerabilities, and the increasing technical prowess of cyber-adversaries. 

Topics: Cybersecurity SOAPA

SOAPA versus SOAR

I first came up with the SOAPA concept in late 2016. Here’s the blog I wrote in November of that year describing the architecture and its rationale. 

Topics: Cybersecurity SOAPA SOAR

SOAPA Video with SAS Software (Part 2)

Stu Bradley, VP of fraud and cybersecurity intelligence, recently stopped by the ESG video studio to participate in our SOAPA video series. In part 2, Stu and I discuss:

  • Cybersecurity analytics readiness. SAS talks about analytics readiness, so I pressed Stu on what the company means. Stu spoke about preparing core security analytics models that act as a foundation and can be adjusted and fine tuned for new types of threats. In other words, SAS Software works to guide customers through the cyber analytics lifecycle so they can gain business value early and often.
Topics: Cybersecurity SOAPA

SOAPA Video with SAS Software (Part 1)

Stu Bradley, VP of fraud and security intelligence stopped by the ESG video studio to participate in our latest SOAPA video. 

If you are a cybersecurity professional and you don’t know SAS, I strongly suggest you watch this video (and part 2 which is posted here). SAS Software has had a leadership role in data analytics for years and is now applying its craft to cybersecurity. In part 1 of this SOAPA video, Stu and I discuss:

Topics: Cybersecurity SOAPA

SOAPA Video with Devo (Part 2)

In part 2 of my SOAPA video with old friend Dimitri Vlachos from Devo, we discuss:

  1. Devo use cases. Dimitri describes some of the most popular security use cases for Devo, including threat detection, security analytics/investigations, and threat hunting. I’ve got to hand it to Dimitri as he came up with one of the best SOAPA video soundbites ever, “You can’t use old tools to cover new security analytics needs.”
Topics: Cybersecurity SOAPA

SOAPA Video with Devo (Part 1)

Whip it good--as old friend Dimitri Vlachos from Devo stopped by the ESG video studio to kick off our 2019 SOAPA video series. If you are unfamiliar with Devo, the company describes itself as follows:

Devo delivers real-time operational and business insights from analytics on streaming and historical data to operations, IT, security, and business teams at the world’s largest organizations.

Topics: Cybersecurity SOAPA security operations security analytics

OpenC2 Can Accelerate Security Operations, Automation, and Orchestration

Over the past few years, ESG has promoted the security operations and analytics platform architecture (SOAPA). Just what is SOAPA? A multi-layered heterogenous architecture designed to integrate disparate security analytics and operations tools. This architecture glues incongruent security analytics tools together to improve threat detection, and then tightly-couples security analytics with operations tools to accelerate and automate risk mitigation and incident response. After all, you can have great security analytics for investigations, threat hunting, and root-cause analysis, but this all means diddlysquat if you can’t use these analytics to make and execute timely incident response and risk mitigation decisions.

Topics: Cybersecurity SOAPA

Thoughts on IBM Think and Cybersecurity

I just got back from attending IBM Think in San Francisco. Though it was a quick trip across the country, I was inundated with IBM’s vision, covering topics from A (i.e., artificial intelligence) to Z (i.e., System Z) and everything in between. 

Despite the wide-ranging discussion, IBM’s main focus was on three areas: 1) Hybrid cloud, 2) Advanced analytics, and 3) Security. For example, IBM’s hybrid cloud discussion centered on digital transformation and leaned heavily on its Red Hat acquisition, while advanced analytics included artificial intelligence, cognitive computing (Watson), neural networks, etc. To demonstrate its capabilities in these areas, IBM paraded out customers like Geico, Hyundai Credit Corporation, and Santander Bank, who are betting on IBM for game-changing digital transformation projects.

Topics: Cybersecurity SOAPA

Security Point Tools Problems

At most enterprise organizations, cybersecurity infrastructure grew organically over time. The security team implemented each security control in response to a particular threat, such as if antivirus software appeared on desktops, gateways were added to the network, sandboxes were deployed to detect malicious files, etc. 

Topics: Cybersecurity SOAPA