Stop the noise: Combating analyst fatigue with contextual threat information
analyst dashboard • Jul 25, 2018
In the age of the 24-hour news cycle and rapid evolution of cyber threats, security analysts are constantly bombarded with a never-ending stream of security alerts, reports and a widening array of security tools designed to help guard their systems. With red lights frequently going off and the stakes higher than ever, analyst fatigue has become an unwelcome part of the security operations and mitigation process.
What is analyst fatigue?
A typical organization faces a 40% increase in persistent threats and data breaches year over year. Over the past year, there were more than 1,500 breaches in the US alone that led to the exposure of nearly 179 million records. Pairing the ever-expanding threat landscape with the rising shortage of cybersecurity skills, and increased threat alerts, analyst fatigue is hard to avoid.
When SOC or CIRT analysts become overburdened and analyst fatigue sets in, they may eventually burn out, become overwhelmed by the large number of vulnerabilities and threat alerts, and ultimately lose urgency.
Alert fatigue occurs when an analyst is overwhelmed by the trove of alerts and becomes desensitized to them, particularly when the same or similar alerts keep popping up. Swamped with the sheer number of threats and alerts, the analyst may overlook them or miss threat alerts that require immediate attention. This leads to a higher probability of security analysts missing a critical threat and increased organizational cyber risk.
Growing pandemic
According to a recent survey conducted by LogicHub at RSA 2018, a whopping 78% of respondents said they have experienced alert fatigue. About 79% of respondents believe both human expertise and security automation is required for a powerful security infrastructure to safeguard enterprises against threats and breaches.
Analyst fatigue can be dangerous for any security analyst, operational team and organization safeguarding against emerging threats everyday. To keep this growing pandemic in check and serious issue at bay from your SecOps and Intel team, alerting and security incident response systems must be equipped with both automation and the data required to help them make informed decisions.
For instance, an SIEM system can provide alerts for every new threat that could potentially threaten an organization. However, if it doesn’t come equipped with relevant, contextual or prioritized data required for security professionals to connect the dots and simplify their analysis, it only creates more work for them and adds to their burdens.
Reducing fatigue with the perfect analyst dashboard
Cyware Fusion and Incident Response (CFIR) system simplifies the process of investigating alerts by keeping SecOps professionals focused in a consolidated analyst dashboard , infusing valuable threat data from multiple sources and leveraging the data for greater alert context and prioritization.
Leveraging this analyst dashboard, analysts can quickly analyze and escalate alerts that matter most to their organization in record time. Similarly, security professionals that investigate such alerts are not overwhelmed by the rising volume and vectors facing their company. Rather, they are equipped with meaningful context to better categorize , prioritize and appropriately respond to various alerts from multiple incidents.
To assist security professionals in addressing adversarial threats earlier in the attack process, CFIR helps reduce noise and create context by separating small-scale events from the more critical incidents. When the analyst dashboard is enriched with the most contextually relevant information around threat attackers, attack campaigns, vulnerabilities, malware, targeted assets and other data, analysts are better equipped to address threats and apply valuable human perspective to slice and dice important threats. CFIR allows them to o correlate and gain greater visibility of threats.
Raw intelligence without context, relevance and analysis is just data. Giving them the right analyst dashboard and tools that combine both automation and human insight is the only way to truly inoculate against analyst fatigue, improve SecOps maturity and overall efficiency.
