Information Overload is Not the Problem: It’s the Symptom
Information overload is a symptom of the problem of too many disparate point solutions that are not integrated and correlated, explained Adrian Sanabria (@sawaba), senior security analyst, 451 Research, in our conversation at the 2015 Black Hat Conference in Las Vegas.
“When we have all these point products that don’t talk to each other, all the information is isolated. If correlation isn’t automated we have to do that manually,” added Sanabria. “Everybody’s got an API now, but not everybody has security developers to connect all these applications … This is key to killing the problem of information overload. It makes it much easier to filter out the noise when you can pull in your indicators from all your disparate products, network, endpoints, all over the place, and do detection.”
None of that can happen until you have visibility.
“Customers aren’t going to be comfortable taking any automated action or automating security until they have visibility,” said Sanabria. “Visibility has to come first.”
Endpoints can now be correlated to something that happens in the email system and also a SaaS application in the cloud. You can now watch a single employee as they travel from application to application, or from device to device, explained Sanabria.
When you take a holistic approach to security, “it really gives you the level of visibility necessary to make decisions about your policy, what you’re going to allow employees to do, and actually detect and respond to anomalies and issues and threats,” said Sanabria.
Related Articles
How A CNAPP Can Take You From Cloud Security Novice To Native In 10 Steps
May 23, 2024Context is critical in cloud security. In a recent RSA presentation, Tenable's Shai Morag offered ten tips for end-to-end cloud infrastructure security.
Logs of Our Fathers
September 22, 2009<p>At USENIX in Anaheim, back in 2005, George Dyson treated us to a fantastic keynote speech about the early history of computing. You can catch a videotaped reprise of it <a href="http://www.ted.com/talks/lang/eng/george_dyson_at_the_birth_of_the_computer.html" target="_blank">here, on the TED site</a>. I highly recommend it - there's lots of interesting and quirky stuff. I managed to talk him into giving me a copy of his powerpoint file, and subsequently tracked him down and am re-posting this material with his permission.</p> <h3>November, 1951 </h3> <p style="TEXT-ALIGN: center"><a href="http://www.ranum.com/security/computer_security/papers/ur-syslogs/first_syslog.jpg" target="_blank"><img border="0" height="375" src="http://www.ranum.com/security/computer_security/papers/ur-syslogs/t/first_syslog.jpg" width="500" /></a> <br /><strong>Machine Log #1</strong></p>
ShmooCon 2009 - Playing Poker for Charity
February 12, 2009Tenable sponsored a booth at this year's ShmooCon and ran a Texas Hold'em table to help raise money for the Hackers for Charity organization. We raised close to $400 from conference attendees ...
CVE-2024-7593: Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
August 14, 2024Ivanti released a patch for a critical severity authentication bypass vulnerability and a warning that exploit code is publicly available
Microsoft’s August 2024 Patch Tuesday Addresses 88 CVEs
August 13, 2024Microsoft addresses 88 CVEs with seven critical vulnerabilities and 10 zero-day vulnerabilities, six of which were exploited in the wild.
Compromising Microsoft's AI Healthcare Chatbot Service
August 13, 2024Tenable Research discovered multiple privilege-escalation issues in the Azure Health Bot Service via a server-side request forgery (SSRF), which allowed researchers access to cross-tenant resources.
- Conferences