Các bài viết liên quan:
The Great Resignation — or the Great Reform as some are calling it — and the growing skills gap have dominated the headlines lately. But these problems are not new to the industry network security. While many have only recently heard about employee burnout, security teams have been dealing with the reality and dire consequences of burnout for years.
One of the biggest culprits? Overload warning.
The average security team receives tens of thousands of alerts per day. Many analysts feel like they can’t keep their heads above the water…and start giving up. This looks like physical exhaustion and even lethargy. Surveys show that some security analysts feel overwhelmed, they ignore warnings and even walk away from their computers.
In fact, these surveys show that 70% of security teams feel overwhelmed by alerts, and more than 55% of security professionals don’t feel fully confident that they can prioritize and respond to every single one. The warning really needs attention.
Sadly, there is not a moment to waste when there is a legitimate threat. The threat landscape is changing so rapidly, you need a security team that is not only at the top of their game, but has the foresight to anticipate emerging threats. So the problem of overload warnings is one of the key ingredients in the recipe for disaster when it comes to business risk. And the risk is only growing (think supply chains and attacks ransomware into important industries such as healthcare).
It goes without saying that if this lasts, it is only a matter of time before a legitimate threat goes undetected and leads to dire consequences for an organization and even private citizens. their data for that organization.
But according to XDR vendor Cynet, “…the problem is not the warning – it is the response.”
Security teams are at a critical juncture and need to figure out how to reduce alert overload and have a strategy in place. Luckily, there’s a guide for that.
Cynet’s recently released guide offers several ways that security clues can pull their analysts out of the ocean of missteps and bring them back to shore. It includes tips on how to reduce alerts using automation and shares guidance for organizations considering outsourcing their managed detection and response (MDR). Spoiler: the guide also shares how security teams can take down the site of security tools needed for automation.
In addition to providing context on why warnings are making cybersecurity worse and how these warnings become overwhelming, this guide also shares insights on:
Questions about outsourcing – Managed detection and response (MDR) outsourcing is a great choice if you need to scale quickly and don’t have enough resources. MDR can help reduce stress and give your team time back. Another consideration is cost. You will also need to invest time in finding an MDR that is right for your business. Outsourcing may be the right solution for your unique needs.
How to reduce warnings – It starts with strategy. Review your existing technologies and ensure that you have optimized their settings and that your tools are calibrated. In the end, it’s not about reducing multiple alerts but about how you set up your team to respond.
Introducing auto feedback – Even the best security teams can tackle threats if they use automation. Automation enables security teams to quickly respond to alerts at scale. But one of the biggest challenges with automation is knowing how to set it up properly in the first place.
Automation support tools – One of the reasons that setting up automation is such a challenge is the abundance of technology tools that need to be integrated (like EDR, NDR, IPS, firewall, anti-spam, DNS filtering, etc.) etc.). It is important that you know how to put all these tools in one place.
Easily protect autonomy violation – Again, it all comes down to integration. But having some of these tools in one place has some significant benefits: it’s easy and doesn’t require a lot of technical expertise, the all-in-one solution is more cost-effective, and it allows for faster detection. and more informative feedback.
The future is far away. Cynet tells us that “More than just a solution to alerting overloads, integrated tools and automated responses are the future of cybersecurity – a future where defenders win back. position.”
If you want to learn more and learn how to stop the overload warning, download the guide here.
.
