Security Tool Sprawl Reaches Tipping Point

How a new open source initiative for interoperable security tools and a wave of consolidation could finally provide some relief for overwhelmed security analysts and SOCs.

The typical security team today continues to struggle with the same frustrating and potentially dangerous problem: a sea of security tools that churn out waves of alerts and siloed data that often requires manual correlation — or get altogether dismissed by overburdened security analysts.
If it takes a SOC analyst more than three clicks to make a decision, he/she is going to move on. They have thousands of other alerts waiting for them, says Jill Cagliostro, product strategist for security firm Anomali.
That frightening — but understandable — conundrum for security analysts who under so much pressure that they literally pitch some alerts that take too much time to investigate underscores the perils and real possibility of missing that one needle in a haystack in security operations centers (SOCs) today. At the root of the alert overload, of course, is a mix of multiple security tools from various vendors — most of which dont work together and security analysts dont even have time to fully master.
Organizations on average run some 25 to 49 security tools from up to 10 different vendors, according to the Enterprise Strategy Group (ESG), and 40% of organizations are so taxed, according to 451 Research, that they cant act upon at least a quarter of their security alerts. And in many cases, thats leading to organizations literally shutting off some alerting functions, SOC vendor CriticalStart found.
There have been a lot of research studies that find the whole issue of interoperability and scalability is largely ignored, so as a result the technologies dont actually work together and you have more [tools] than you need, Larry Ponemon, president of the Ponemon Group, said in an interview with Dark Reading in July. So many things are generating reports [and alerts] ... you are in a state of information overload pretty quickly.
But the tipping point may finally be near. A gradual wave of security-tool consolidation and aggregation — thanks in part to some strategic acquisitions — as well as a new vendor effort led by IBM and McAfee for an open source set of specifications for tool interoperability, could finally streamline and integrate tools and, ultimately, workloads for SOC analysts.
The newly formed Open Security Consortium (OCA), part of the OASIS open source standards organization, will come up a common way for security tools to present data and communicate with and message one another. Essentially, the
goals of the alliance
are interoperability, and collaboration around various different standards, tools, procedures, and open source libraries to enable that interoperability, says Jason Keirstead, chief architect for IBM Security Threat Management.
The alliance isnt all about creating new standards, Keirstead says, although new ones could emerge eventually. Its around collaborating on how we interoperate with each other.
OCA — which also includes members Advanced Cyber Security Corp., Corsa, CrowdStrike, CyberArk, Cybereason, DFLabs, EclecticIQ, Electric Power Research Institute, Fortinet, Indegy, New Context, ReversingLabs, SafeBreach, Syncurity, ThreatQuotient, and Tufin — initially announced its first two protocols, existing work from its co-founders IBM and McAfee. The first is IBMs open source data library STIX-Shifter, based on the STIX2 data model standard, which grabs threat information from various data repositories and converts it to a common format for all security tools that adopt STIX-Shifter. OCA also released McAfees OpenDXL Standard Ontology, which supports the OpenDXL (based on the Data Exchange Layer standard) messaging standard for communicating and sharing security information among different security products.
The OCAs open source releases are available to all security vendors, even nonmembers of the consortium, as well as enterprises that want to incorporate the technologies. The goal, according to the OCA, is to easily integrate security detection, threat hunting, analytics, and other tools so they can operate together out of the box.
Its less about combining [security tool] screens and more about assuring the multiple tools a customer has all interoperate with each other and [enterprises] dont have to spend so much time maintaining those integrations, IBMs Keirstead says. A customer can swap out any one vendor and add a competitors and they will work seamlessly.
Several security experts welcomed the OCAs effort. I think its a step in the right direction, says Jon Oltsik, senior principal analyst with Enterprise Strategy Group. Security organizations for years have been collecting and storing security data in various places and trying to analyze the same data across different tools, he says. And an open source integration layer effort lowers vendors R&D burden, he adds.
Even so, Oltsik says he wonders why more large organizations themselves arent driving such an effort rather than the vendors. One thing that concerns me is you would think the demand side would be driving this versus the supply side, such as large financial firms, he says. Id like to see some big buy-side organizations calling for vendors to support these open source standards if they want to sell to them, he says.
Current Consolidation Situation
MSSPs also face some of the same challenges as enterprise SOCs when it comes to integrating and streamlining tools. Kevin Hanes, COO at Secureworks, says the OCA effort for data normalization is a positive step by the industry. Its not an easy task today, he admits: We have solved that through a variety of ways, with us doing the hard work to bring the normalization to our platform, Hanes says. The more that can be solved at a higher plane ... that helps everyone.
Its common for startups to get funding to focus on a specific pain point in security and then roll out these very focused tools, he notes. But these and other tools then dont actually work together, he says.
The OCA effort comes at a time when several security tool vendors already have been adding products and features that aggregate others products, as well as the consolidation of security orchestration and automation (SOAR) into bigger platforms. Splunk now owns SOAR vendor Phantom, and Palo Alto Networks owns SOAR vendor Demisto, for example, and Elastic recently acquired endpoint security firm Endgame. Experts say more technology acquisitions and integrations are on the horizon.
Theres some pretty significant consolidation happening in the market right now, says James Carder, CISO at LogRhythm. The reason being, I think, is that SIEM as promised decades ago was the be-all, end-all, single pane of glass for the modern SOC. Now theres SOAR, endpoint security, network components, and all those pieces that are in the SOC.
Carder says vendors are trying to consolidate SOC tools, including endpoint, SIEM, and SOAR, into single platforms, and build appropriate integration among the tools. Thats a trend were seeing now in the SOC itself.
LogRhythm is doing that with its updated SIEM platform, NexGen SIEM Platform, which combines SOAR, log management, security analytics, and network monitoring, for example, he says. We may look at other acquisitions that could bolster [it] and give a SOC-in-a-box offering, he says.
The OCA security-tool interoperability effort is a sound approach, Carder says. Having a standard taxonomy and language and method for all different security technologies out there is a dream state of the industry where you dont have to build these special integrations with multiple products, he says.
Even so, the industry is a long way from achieving that reality, he notes. There also are the non-security applications that have security ties to consider, he says, such as physical security systems like cameras or badging systems in an organization, and even human resources applications. For example, if a user logs in from an atypical location and suspicious network activity ensues, an HR app cant necessarily be queried to automatically check if he or she is on vacation, or if the users credentials have been compromised. Youre still building one-off integration with products outside security, Carder explains.
Some recently announced security tool integrations also demonstrate the pressure for vendors to unite disparate security tools. Security management platform vendor ReliaQuest, for example,
acquired Threatcare
earlier this month and plans to add its attack simulation technology to its GreyMatter security platform.
{Continued on Next Page}

{Continued from Page 1}
GreyMatter basically aggregates security data from SIEMs, endpoint detection and response tools, firewalls, threat intelligence feeds, and other security tools, in addition to providing some of its own analytics and automation functions. The main problem we want to solve is tools fatigue and vendor sprawl, says Joe Partlow, CTO of ReliaQuest. CISOs are trying to adapt and get greater coverage of their attack surface, but the opposite is happening: not greater visibility ... but instead more complexity and data residing in silos and more alerts than they can handle, he says.
GreyMatter basically does the dirty work of pulling together the different tools and their data. It gathers the data from the tools and then normalizes that data into a standard format for the platform. That replaces the spreadsheet-merging approach many organizations use to sort and correlate data from various tools.
Aaron Sherrill, a senior analyst at 451 Research, says many security tools are mostly just narrowly focused security features that ultimately get swallowed up by other vendors or get wrapped inside existing platforms — or fall by the wayside. I view GreyMatter as aggregating a few different security approaches, [including] a managed service provider, SOAR, attack simulation, and some other security tools, Sherrill says. Its [also] an opportunity for them to go a little deeper and look at the effectiveness of the tools in place, too, by providing the status and health of the various security tools in the organizations environment.
Anomalis Cagliostro, meanwhile, points out that one of the big drivers of security tool consolidation is security team turnover, which often results in losing expertise in specific security tools. When an analyst with expertise in reverse engineering gets hired away, for instance, notes Cagliostro, institutional knowledge goes out the door with him.
Her firms newly released Lens tool aims to provide all levels of the organization, including SOC analysts as well as company executives, alerts of an attack underway and what to do about it. Lens basically creates automated threat bulletins out of content it gathers online from threat intelligence findings, cybersecurity news articles, security logs, and other sources of threat information. Those bulletins then get absorbed into Anomalis threat intel system. Lens, the threat intel platform, and Anomali Match, an analysis tool, together make up Anomalis Altitude security management platform.
Related Content:
7 Stats That Show What It Takes to Run a Modern SOC
Suffering SOC Saga Continues
Overburdened SOC Analysts Shift Priorities
4 Reasons Why SOC Superstars Quit
Check out
The Edge
, Dark Readings new section for features, threat data, and in-depth perspectives. Todays top story:
Can the Girl Scouts Save the Moon from Cyberattack?

Last News
▸ Scan suggests Heartbleed patches may not have been successful. ◂ Discovered: 23/12/2024 Category: security	▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security	▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Security Tool Sprawl Reaches Tipping Point