Question: We can't handle all these security alerts! What can I do?
Chris Morales, head of security analytics at Vectra — Security operations must focus on three key areas: detection, response, and prediction.
Security analysts must continuously hunt for attackers already inside the network. They need to be able to respond to the threats that can cause real damage immediately, and correctly since not all attacks are the same. Finally, an organization needs to be equipped to learn from attacks, understand their own attack surface and exposure, know the type of attacks they are at risk from, and then combine all this knowledge to predict where an attack could happen next.
In short, where is the exposure, what is the motive, where do they need to focus. Doing all the above consistently every data clearly is not easy. Doing all the above quickly while staying consistent to stay ahead of attackers is borderline crazy.
Enterprises have three choices here. Hire lots of highly skilled people able to perform security processes consistently at speed day in and day out, use AI to augment existing analysts to be more effective and automation functions to respond in real time, or give up. I believe the most achievable option is to augment security analysts with AI to scale security operations effectively.
Related content:
The Edge is Dark Reading's home for features, threat data and in-depth perspectives on cybersecurity. View Full BioMore Insights
Support the originator by clicking the read the rest link below.
