21st February, 2021
3 Min read
Book a Demo
Let’s start with the tricky truth: the problem with stopping data breaches is not about detection. We’ve seen this time and time again at GlobalDots, where we partner with security providers and customers alike to consult and provide security solutions to the new and evolving threats in the cloud.
Modern security systems detect a lot. In fact, they probably even detect too much: according to study by IT security firm Bricata, the average SOC receives over 10,000 alerts each day from an ever-growing array of monitoring and detection products. This has inevitably led to what is known as “alert fatigue”. So clearly, not enough detection is hardly the issue.
Reduce your AWS costs by over 50%
Discover your Cloud Saving Potential – Answer just 5 simple questions. AppsFlyer, Playtika, Lufthansa, IBM, top leading companies are already using our FinOps services.
An individual examination of each alert tells you almost nothing. Nearly every log can either be legitimate or illegitimate, depending on the context in which it is created.
Consider the following activities. Looking at each one out of context, could you tell the legitimate from the illegitimate ones?
The answer is, of course, no.
Working closely with security partners and analyzing data breaches, we’ve learned that in most cases, the malicious activities were indeed identified in time, but at the same time flew under the radar.
Here are some possible reasons:
As a result, any means of trying to manually analyze alerts and put them in context in order to identify malicious activity is bound to fail.
Correlation is the process of taking independent, seemingly-unrelated events, and correlating them across threat surfaces, resources, and time frames.
Think back of the list of example activities we listed earlier: On its own, each event was meaningless; we could not discern the intent behind it.
But consider the following chain of events:
Looking at these events in a linked chain of events looks very different than just analyzing each event individually, doesn’t it?
This is why correlation is so important: it allows you to identify a data breach in its entirety, not just the individual events that are part of it. It also helps prioritize a real attack from all the noise traditional security systems typically generate.
This is why automatic, AI-based correlation is such a crucial component of cybersecurity, and one that can make the difference between stopping a breach in time, or reading about it in the news.
Schedule a call with our experts. Discover new technology and get recommendations to improve your performance.