Many security leaders are on a quest to find more efficiencies in their operations, but there are significant barriers to achieving efficiency nirvana. Too many tools, lengthy investigations, staffing challenges, and the never-ending deluge of alerts all strain even the most resilient security program.
Today, security teams are forced to do more with the same. With budgets stagnating, the focus must be on increasing efficiency in two areas: The security program processes and the technology being leveraged.
A sure sign cybersecurity is maturing as an industry is the availability of trusted frameworks that organize investigation and response efforts. Frameworks like MITRE ATT&CK, which categorize attacker behaviors into a library of tactics, techniques, and procedures, help analysts understand the details of an adversary's behavior quickly to cut down on response time. Other worthy frameworks include ISO, NIST, and the Lockheed Martin Cyber Kill Chain.
Learn how you can leverage the MITRE ATT&CK Framework to improve your security operations
Things move quickly in cybersecurity, and staying current on TTPs, supply chain attacks, ransomware, and industry-specific attack trends, is a daily process.
Where you go for information matters, and getting an early warning from a trusted source could save valuable hours in a response when the next supply-chain attack happens.
Do I have a peer in a similar job function I can share sanitized information with and get tips in return? Where do I look when there is breaking news in the cyber community on a new attack or IOC? Twitter has a vibrant infosec community, with experts and even small-time influencers that share everything from DFIR tips to TTP’s to interesting anecdotes from investigations. There are many freely available resources to sharpen your security ax.
BRIDGING THE CYBER-BUSINESS DIVIDE
Will Regulation Reduce Cyber Risk and Improve Resiliency?
Sourcing talent is understandably difficult. Experienced analysts should be valued for their experience, but new talent should also be considered. Applicants from technical backgrounds in IT or other areas could ramp up quickly if given a chance in the right conditions and environment. Leaders should strive to create an environment where junior team members learn and become senior team members under their watch.
Hiring itself is a challenge, but after creating the right team and the right team environment, retention of the team becomes the next hurdle. Teams with active enablement and information sharing, alongside an ethos of gaining efficiencies across all operations, help analysts avoid burnout from redundancy in tasks.
While not a problem for Cybereason customers, it may be necessary to step back from the daily detection, investigation, and response cycle and tune a current solution to be more effective. Spending cycles configuring solutions to be most effective is not an ideal use of time due to the backlog it may create, but the benefits can be enormous. Are there noisy behaviors you can block and see less of? Are there repeat false positives that can be added to an allowlist? What about DNS? These types of configurations can reduce the overall burden of alerts that require investigation.
Practice makes perfect. Incident response shouldn’t be an uncoordinated fire drill but rather the fluid application of predetermined steps to an urgent situation. Tabletop scenarios with the team on what to do in a severe ransomware incident or handling a supply chain attack where adversaries piggy-backed trusted software to infiltrate the environment makes everyone prepared and polished for the real event.
Walk through an example Tabletop Exercise emulating the steps and effects of the REvil ransomware attack as if it were on your infrastructure
The MalOp™ (Malicious Operation) Detection Engine provides industry-leading graph analysis that detects and deciphers a threat. Not all graphs are created equal, some are mensa-like in their AI capabilities, and Cybereason falls into that camp.
We make sense of complex data relationships. The MalOp Detection Engine is the big brain behind the scenes that stitches together the operation or the full understanding of the attack. Attacks span multiple devices and users, and once an adversary infiltrates, they can access swaths of the enterprise. If you are using a technology that alerts individually and can’t piece together the story and timeline of the attack from across many endpoints, then you are incurring a massive efficiency cost.
See the MalOp Detection Engine in action during a Live Attack Simulation
Register HereAnalysts benefit immensely from actionability. Anything a solution can do to cut down on the manual time the team spends digging into a given alert or investigation is beneficial, and technology should be expected to make up for any gaps in analyst skill level or alert volume. Detections should arrive in a way where it is quickly understood what occurred, why it was malicious, how severe the operation was, and how to respond.
The MalOp consolidates alerts and displays the full attack narrative in an intuitive view that can be easily digested by analysts of any skill level and then responded to comprehensively. The MalOp is a central concept within the Cybereason EDR UI, and analysts of any skill level can easily pivot to threat hunting dashboards or other areas to advance the investigation if needed.
Efficiency gains made possible by the Cybereason Defense Platform mean small teams perform at the same output levels as larger, better-resourced teams.
Cybereason MDR takes alert fatigue off the table through a managed service that detects in 1 minute, triages in 5 minutes, and responds within 30 minutes. This clears bandwidth cycles for overtaxed teams to focus on higher priority tasks. Our experts bring not only industry-leading SLOs to the table but also an adversarial mindset and decades of experience in offensive cyber operations. Cybereason’s understanding of how adversaries operate and escalate is invaluable in a managed partner.
Learn more about the trends, capabilities and use cases that help organizations evaluate MDR vendors in the Gartner Market Guide Report
Get The ReportThreat Hunting is historically reserved for Tier III and more experienced investigators. This high entry bar creates a backlog of investigation-worthy events that slows the overall mean-time-to-response. Cybereason solves this problem by lowering the bar of entry to threat hunting. Analysts don’t need to bring years of query language dev skills to the table, but rather any available talent can build threat hunting queries in point and click fashion within the Cybereason console.
Underperforming solutions can seriously hamper a team's effectiveness. Cybereason moves your security posture to a future-ready state that is capable against even the most advanced adversary TTPs. Next-gen prevention blocks ransomware and sophisticated malware at the first signs of malicious activity. Fallback detection and response capabilities consolidate the individual malicious components into a full-scale view of the attack designed to process high alert volumes and integrate with dozens of data sources and XDR integrations.
View an on-demand Cybereason Ransomware Range to witness the operations employed by ransomware gangs and how these tactics can be stopped dead in their tracks.
Watch Now
Check out Cybereason's new white paper, Eliminate Alert Fatigue: A Guide to More Efficient & Effective SOC Teams.
The paper explores the challenges that create alert fatigue, the impact that alert fatigue has on security outcomes, and Cybereason's primary differentiator—the ability to consolidate alerts into a single malicious operation—what Cybereason calls a MalOp™.
See Cybereason in action. Demo the Cybereason Defense Platform to see the efficiency and effectiveness boost we can provide.
JJ Cranford is a Senior Product Marketing Manager at Cybereason, He was previously with OpenText after the acquisition of Guidance Software where he was responsible for the go-to-market strategy for endpoint security products. JJ provides insight into market trends, industry challenges, and solutions in the areas of incident response, endpoint security, risk management, and compliance.
All Posts by JJ Cranford
Cybereason has announced the availability of Cybereason DFIR, a solution designed to automate incident response (IR) investigations by incorporating nuanced forensics artifacts into threat hunting, reducing remediation time by enabling security analysts to contain cyberattacks in minutes...
Here's a look at the many ways Cybereason Threat Intelligence tells the difference between benign and malicious activity to keep your security team focused...
