As the number of different digital touchpoints grows exponentially as hybrid working cements itself, so too have the number of attack surfaces available for cybercriminals to exploit. In a world where cybercrime is evolving at a rapid pace and the threat landscape remains unpredictable and constantly shifting, one thing is clear: data increasingly underpins future security.
Paul Kelly, Director, Security Business Group, Microsoft UK.
The role of a cybersecurity professional within this context is one of high stakes and constant vigilance. IDC data reveals that the vast majority (83 per cent) of cybersecurity professionals report that they are struggling to cope with the sheer volume of security alerts, revealing that this can lead to missed cyber threats as well as difficulties recruiting and retaining staff. As the volume of data and cyber attacks increases year on year, this is especially concerning for a sector that is already experiencing a talent shortage and skills gap.
As enterprises wrestle with these concerns, there has never been a more important time to ensure that your organization's security operations are up to scratch. By taking a consolidated approach to cybersecurity, enabling teams to access the right data at the right time, with the tools to analyze it, you can equip them to respond to pressing threats before they have crippling consequences for your organization, whilst enabling them to do the best job possible with the time they have available.
Data is everything – both a blessing and a curse
The repercussions of an enterprising cyber attacker gaining access to critical data such as private financial and medical data or industrial control systems can be severe, meaning the security team’s job is often a highly pressurized and difficult one. This is made all the more prevalent as organizations migrate to more secure cloud environments and the mobile workforce continues to dissolve the network boundary beyond its traditional office-based confines.
With the world’s data set to reach 175 zettabytes by 2025, information is proving itself to be both a blessing and a curse. Data paralysis – whereby you have access to so much data that decision making becomes impossible and alert fatigue, where a high volume of repetitive, low-fidelity alerts clouds your team’s ability to spot important issues to take action on are two of the ways that data can have a heavy impact on the security infrastructure of an organization. This is only compounded by years of new security products being added to the mix, but never refined, causing double up alerts and incompatibilities which stop the cyber team from being able to run at their most effective.
Excessive alert volume naturally increases the chances of a serious threat slipping through the net and as attacks continue to grow in sophistication, the problem will only intensify. IDC found that cybersecurity teams at organizations of all sizes are struggling with alert fatigue, with up to 30 per cent of alerts going ignored or not being investigated at all. This is due to many of these alerts being false positives, but plenty are true positives that are low-risk and of low importance, but which distract from genuine events and threats that may warrant more immediate attention.
Ultimately, as the amount of data ramps up, security defenses must be streamlined in order to tackle it and then make the most of it through applying analytics. By delivering smart integration, simplicity, intelligence and consolidation, the tools you’re using can ease a huge amount of pressure on your frontline team – the skilled professionals who are defending your organization against unprecedented levels of threat sophistication year on year.
Gaining a birds-eye-view
To address the twin issues of data paralysis and alert fatigue but still maintain threat detection efficacy, organizations must seek out a consolidated approach to their cybersecurity strategy and employ effective data management. The goal is to be able to sift through the high volume of data and security alerts and narrow these down to a more manageable selection of insights and high-fidelity incidents. Creating this bird-eye-view of everything is especially essential for organizations adopting a multi-cloud strategy and will allow organizations to spot threats early, thereby significantly increasing detection rates and cutting resolution times.
Usually, the cybersecurity team is tasked with triaging alerts, where critical decisions need to be made as to whether each alert is worth investigating further or not, but human judgement is not always required here. Automation can have a huge impact in terms of alert noise reduction. An organization's security infrastructure can be simplified and streamlined hugely, by applying machine learning and artificial intelligence techniques in these situations, to automate alert prioritization [insert link 2] and identify the most critical risks to catch what the human eye may miss, as well as providing actionable intelligence to security teams when further contextual analysis is needed.
Cyber is key to the future success of the UK
Strength in cybersecurity and strong data management will be vital to the UK’s future competitiveness. In the UK Government’s autumn 2021 spending review the National Cyber Security Programme’s budget was increased by £114 million, forming a total of £2.6bn investment in cyber and legacy IT over the next spending review period.
The threats that businesses are facing are ubiquitous, sometimes existential and getting more sophisticated every day, which means they need a platform that can provide a robust security function that works seamlessly and proactively safeguards them and their customers. Without a thorough data management and cybersecurity strategy in place, organizations risk leaving themselves open to missing real threats, with cyber staff too overwhelmed to spot them before it's too late.
