Usage of Security Analytics on the Rise, Finds SANS’ Survey
January 2017 by SANS INSTITUTE
Cyber security professionals have
become more aware of the value of analytics and have moved beyond using
analytics for detection and response to using analytics to measure and improve
their overall risk posture, according to the results of SANS’ 2016 Survey on
Security Analytics.
"Traditionally, cyber security has been focused around protection and
prevention. But with the growing complexity of the threat landscape, businesses
are realizing the need to take a more proactive approach," explained Ned
Baltagi, Managing Director, Middle East & Africa at SANS. "Organizations are now
tapping into the wealth of data being generated by their security
infrastructures and using this to identify patterns, uncover vulnerabilities and
stay one step ahead of would be attackers."
In the survey, only 11% of survey respondents either don’t use analytics or
don’t know that they do. Of the 44% who were able to quantify improvements, 17%
reported increased visibility into actual events or breaches, and 11% reported
improved detection of unknown threats, with an equal percentage noting reduced
duration of events.
As in previous SANS surveys on security analytics, the greatest impediments to
implementing analytics and reaping the advantages of security analytics continue
to be lack of qualified staff and funding/resources to implement programs.
Because of these shortcomings, 49% have prioritized investment in
personnel/training, 42% are looking to make detection and security operations
centre upgrades and 29% plan to invest in integrating incident response into
their analytics programs in the coming years.
"One of the best ways to overcome shortages in staffing and funding is through
automation," said SANS senior instructor and author of the report, Dave
Shackleford. "Machine learning offers insights that could help less-skilled
analysts with faster detection, automatic reuse of patterns detected and more,
leading to related improvements in risk posture."
In this survey, 54% of respondents rated their programs as being "Fairly
automated," while only 4% considered their programs to be fully automated.
Unfortunately, only 22% said they deployed machine analytics to enable better,
faster decision making, while 54% said their programs did not use machine
learning as part of their analytics programs, and 24% didn’t know.
"Analytics are an absolute necessity in today’s threat environment and it is
encouraging to see that IT teams are making positive advances in this regard.
But while results show an increasing usage, our survey highlights that there is
still much room for improvement in the use of security analytics," concluded
Baltagi.