5 threat management challenges and opportunities

SecOps teams need a single dashboard that provides visibility into each of the systems. Also, the information from systems such as SIEM, IAM, DLP, and IPS must be integrated, so data is normalized, consolidated, and analyzed comprehensively. Additionally, standard processes can be executed across the board to ensure that no system lost in the mix.

3. Human bottlenecks

We, humans, are often a bottleneck in the incident response process. Each minute following an incident potentially increases the damage to the company and its customers. By the time a team is assembled, and the incident response manual is consulted, the impact may have increased severalfold. There is a time for us to step out of the way to let computers do their job.

We have spent decades developing intricate response plans. Now is the time to turn those plans into workflows. The robust processes and procedures for handling incidents can be used to script appropriate workflows to detected and validated events. Response workflows can be executed quickly following identification to reduce damages. Incident response workflows also ensure consistency in the response. A response team can practice over and over, yet still make a mistake when the pressure is on, whereas computers will perform reliably over and over.

Machine learning is also improving where systems can more reliably validate incident indicators and select the appropriate response. Each new incident trains the system so that it is better able to respond to the next attack.

4. Credential trust

A recent statistic from Microsoft asserts that 63 percent of all network intrusions are due to compromised credentials. Successful phishing tactics, poor password management, or lax account management security have made it much more difficult to trust credentials alone.

The actions users perform must be evaluated for anomalies so that abnormal behavior prompts a response. There are tools available that can provide insight and action to prevent successful infiltration of systems and exfiltration of data. Credentials may need to be verified again as conditions change such as moving to a different location, performing a different set of tasks, or logging in at a different time. Two, three, or more forms of authentication can be used depending on the riskiness of the behavior.

5. Soft targets

It takes continual effort to stay on top of patches, best practices, and the latest hardening techniques, but these steps are vital in protecting systems from vulnerabilities and other weaknesses. Even one soft target can open a company up to attack.

Companies should have systems in place to audit and verify that systems are hardened and up to date. Vulnerability scanning, penetration testing, and patch management validation tools can be used to test systems and ensure that they are properly configured.

Seizing the opportunities

It is clear that something needs to be done now to address these five security challenges. Consider how your cybersecurity strategy will close these gaps. Identify an ideal mix of technologies and how those will be integrated to provide the most value, ease of management, and protection. Seek out automation whenever possible and build in more credential verification and behavioral analytics. We are approaching a new year full of new opportunities for cybersecurity threat management.