By Martin Potgieter, Technical Director at Nclose

Faced with increasingly frequent and sophisticated cyber-attacks, enterprises are scrambling to put technologies and processes in place to effectively detect and combat cyber risks. Research by Symantec found that ransomware attacks increased by 36% in 2017 following the introduction of more than 100 new malware families. In its annual Data Breach Year-End Review, the Identity Theft Resource Centre found there was a total of 1 579 publicly disclosed data breaches in 2017, a 41% increase over 2016.

Despite this, PwC's 2018 Global State of Information Security Survey found that 44% of respondents lacked an overall information security strategy. Amid rising fears of an increase in the volume and sophistication of cyber-attacks and the growing cybersecurity skills deficit, the lack of formal security strategy bodes ill for the global business community. Perhaps that is why 87% of enterprises say they need 50% more budget for cybersecurity, according to EY.

In response, many organisations have deployed a Security Operations Centre (SOC) to better protect critical information. The SOC offers an attractive value proposition: organisations were making costly investments into individual cyber security solutions, but the SOC would unify all the disparate elements and create a single access point where all security-related information would be sent and processed for insights and ensure compliance to regulations and laws governing their industries.

Unfortunately, many SOCs are purely compliance-driven initiatives that are not designed to detect and respond effectively to cyber threats. Core to the problem is that too many organisations believe cyber security is simply a tech matter: buy the correct mix of products and solutions, unify all the elements in the SOC, et voila! My data is secure; come what may, I am protected from cybercrime.

Security-in-a-box is not secure

Buying a piece of technology and expecting it to fulfil the role of a SOC is unwise. Cybersecurity is about much more than technology: there is significant interaction with the broader business needed to bring the value of a SOC to life. However, when SOCs are deployed there’s usually a large investment in various technologies and no engineering thereof, leaving the SOC with very little in the way of creative input to effectively detect suspicious activity.

The core of a SOC is security information and event management, which integrates various IT systems to process all data in a central point for deeper analysis. If suspicious behaviour or data is detected, an alert is sent to security analysts for further analysis. However, in most enterprise environments there are millions, even billions of events that can trigger thousands of alerts. Here, the amount of data that can be used for analysis and investigation is limited by a per-GB pricing model that forces you to choose specific sources in an effort to contain costs. Alert fatigue also sets in, undermining the organisation’s response capabilities by leaving security analysts blind to actual threats to the business.

Global shift to MDR

Organisations in more developed markets have started adopting a new way of active threat detection and response: the Managed Detection and Response (MDR) model. According to Gartner, MDR provides organisations with 24/7 threat monitoring, detection and response services through a combination of technologies, advanced analytics, threat intelligence and human expertise to improve the way they detect and respond to threats and incidents.

MDR's distinguishing feature however is its focus on dedicated security engineers supported by machine learning capabilities that provide real-time, continuous monitoring and threat detection. MDR craves information; it's not limited by events-per-second, so costs are easier to control. And as human and machine learning capabilities work in concert to analyse data, organisations are far better placed to start developing trend analyses that can significantly reduce the number of false alerts and make far better use of available resources.

Considering South Africa's growing cybersecurity skills deficit, having an external team of security engineers at hand plays an invaluable role in safeguarding the integrity of their security deployments.

KPIs for modern cybersecurity

But what should organisations look for when deciding which cybersecurity approach will work best for them? I would argue there are three critical KPIs that need to be considered, namely:

KPI 1: Visibility of threat coverage – organisations need to understand against which type of threats their security solutions will defend them. A process of threat coverage measurement needs to be undertaken, where a likely cyber-attack is broken into an attack chain, and then match available defences against each threat in the chain. This highlights vulnerabilities and equips chief security officers with insight into where they should deploy more resources.

KPI 2: Visibility of systems coverage – understanding where defences are currently active both at a network and geographical level. If you have defences on the endpoint but not at a gateway, the system is still vulnerable. Similarly, if your head office is well-protected, but a remote satellite office is vulnerable, it leaves the entire system open to threats.

KPI 3: Improved response capability – every organisation needs to have proper response procedures and capabilities in place. An incident response plan is critical, but it needs to be extremely detailed. However, the skills shortage and cost implications of having such skills in house means most organisations have vague response plans, if any. MDR plays a critical support role here: organisations gain access to the correct capabilities without having to employ expensive internal resources.

KPI 4: Constantly improving defence capability - static defences are no good in an environment of constantly evolving cyber threats. The defence capabilities provided by MDR should be constantly improving and evolving; it's not something that should be switched on and left. The best results emerge from a process of defence engineering; make sure your MDR partner can provide this.