7 Threat Detection Challenges Faced by CISOs and Key Strategies to Tackle Them

Security Operations (SecOps) teams are constantly bombarded by the latest attacks and malware variants. Recent research shows that there were over 170 million new malware variants in 2021 alone. Identifying and blocking these new threats represents unprecedented pressure for CISOs and their teams. In addition, they face many challenges such as talent and skill shortages, manual data correlation, identifying false positives, and lengthy investigations.

CISOs need to ensure the efficient execution of Threat Detection, Investigation, and Response (TDIR) security operations programs. Here are 7 directions CISOs need to focus on and ponder:

▌01 Inability to Identify True Threats

With so many Indicators of Compromise (IOCs) or security events occurring on the network, no CISO wants their team wasting time on events like login failures caused by users entering incorrect passwords multiple times. CISOs need to find advanced tools that can effectively correlate and analyze this data to eliminate false positives.

Key Questions:

• Can I correlate data from any source (e.g., logs, cloud, applications, network, endpoints, etc.)?

• Can I comprehensively monitor all these systems, capture all the telemetry data needed, and automate correlation?

• What is the cost (security vendor pricing) to correlate all this data?

▌02 Difficulty in Correlating Data Over Time

Data correlation becomes increasingly difficult over time. A single attack may not be hard to identify, but once attackers gain access to an environment, they often carry out minor activities over an extended period (sometimes days, weeks, or months later). It is almost impossible for analysts to process these seemingly disparate events over time and correlate them to generate holistic insights. Most tools also struggle to correlate these seemingly independent events as part of the same attack because they do not appear related on a long timeline. CISOs need to provide their teams with everything they need, within a limited budget, to correlate attack data before damage is done.

Key Questions:

• Do I have a wide variety of data sources and analytics tools that can effectively process events and correlate them over time?

• Are out-of-the-box tools included for real-time attack detection?

▌03 Manual Correlation is Time-consuming and Labor-intensive

When piecing together and analyzing attack campaigns, manually correlating and investigating disparate threat sources consumes a significant amount of the time and resources that CISOs and their teams need. For security teams to find out what is wrong and respond, they must pull data from multiple systems at once. But by that time, the damage may have already been done. This challenge can easily frustrate CISOs who have invested heavily in time and money to establish a security operations program.

Key Questions:

• Does your current team have to do a lot of manual correlation, and how do they manually correlate events spanning weeks or even months?

• When collaborating with other IT teams, does your team have to rely on multiple tools and piece together the context themselves to find patterns for formulating a response plan?

▌04 Security Team Skills Gap

With a shortage of trained, experienced practitioners in networking, servers, and other aspects of IT in today's market, CISOs are forced to hire more security-focused analysts. These analysts require more on-the-job training and need to accumulate more experience to be fully competent in their current roles.

Key Questions:

• How does the TDIR platform automate certain tasks?

• How does it provide the necessary context to help less experienced analysts learn and improve?

▌05 Security Vendors Over-promising and Under-delivering

In threat detection, too many security vendors mislead or exaggerate their product capabilities, claiming support for Machine Learning (ML), Artificial Intelligence (AI), multi-cloud support, and/or application risk metrics, but many often fail to deliver on these claimed capabilities.

Key Questions:

• Does the solution provided by the vendor truly use rule-based machine learning/artificial intelligence?

• Is multi-cloud just about doing correlation, leaving it to the analyst in the end to determine if an attack occurred across multi-cloud?

• Is the risk score just an aggregated score from public sources, rather than an analytics-based enterprise risk engine?

▌06 Trade-off Between Security Investment and Protection Effectiveness

Platforms commonly used by CISOs (such as SIEM) charge based on data volume. As a business grows, volume-based pricing is unpredictable and leads to rapidly rising licensing and storage costs. Therefore, CISOs are looking for solutions that can reduce this cost burden without hindering the enterprise from ingesting and processing as much data as possible, achieving better SOC visibility and more effective TDIR.

Key Questions:

• For solutions that truly employ machine learning, the more data the better, so will the solution charge more for processing more data?

• Is there a need to ingest more data to provide better visibility? Do they offer flexible licensing?

• How do security vendors help enterprises reduce storage costs?

▌07 Improving Detection Efficiency Through Automation

Automation technology allows security team members to focus their attention on more complex, higher-value tasks. When operated properly, it can also reduce the time spent on high-value tasks, saving operational expenses. Transparent analysis and automated workflows can provide a better experience for junior analysts, helping them learn and improve. But not all automation is created equal; if a solution generates too much noise and false positives, it is difficult to prioritize investigations and achieve automated response. The more accurate the threat detection, the more targeted the automated response.

Key Questions:

• Is automation in the solution integrated across the entire SOC lifecycle?

• How do I know automation is working and optimizing operations (e.g., does it show that I blocked a threat early in the kill chain)?

As CISOs and their security operations teams seek to improve threat detection, they will inevitably face various questions regarding visibility, cost, flexibility, analytics, prioritization, and contextual data. Security verification platforms like SecOps validation are designed precisely from the perspective of enterprise managers, CISOs, and security operations personnel, focusing on the practical challenges and current realities faced by security operations to help enterprises achieve cost reduction and efficiency gains in their security defense work.

The Security Measure Validation Platform continuously validates the effectiveness of the defense system 24/7 by recreating real attack scenarios, helping the security team identify the weak points in the security defense system. At the same time, it helps enterprises optimize their security architecture, putting each security product in the right place, and running them with fully implemented practical configurations. This also avoids redundancy of security products, reduces repetitive investment, and ensures that every penny of the enterprise's security investment can reap the corresponding protection effect.

Furthermore, during simulated attacks, the platform can make up for the lack of skills and experience of the team members, ensuring that the security team's response process is correct, exercising their tracing and analytical skills, and thus properly coping with the same type of incidents that may occur in the future.

| Reference Source

https://www.helpnetsecurity.com/2022/05/05/cisos-threat-detection-challenges/