Cybersecurity will never be a ‘one fits all approach’ that global enterprises can just implement as a ‘tick box’ template and then forget about. Security is a journey, not a destination.
Enterprises employ diverse strategies to manage security operations, driven by factors such as budget, staffing, and risk tolerance.
Some establish in-house Security Operations Centers (SOC) to maintain control and enhance visibility, while others utilize Managed Detection and Response (MDR) providers for expertise and 24/7 monitoring.
Additionally, some businesses opt for a combination of both approaches, tailoring their choice to meet specific needs for cost-effectiveness and scalability.
In all cases, enterprises need to focus on employing AI, behavioral analytics and security orchestration, automation and response (SOAR) playbooks to increase the efficiency of the security operations team.
It is tough being a CISO right now. Security leaders say understanding which tools they need is becoming more complex (75%).1 One third admit they don’t know what caused data security incidents, according to Foundry research.2
Adaptable security
Security leaders need to optimize their technology if they are to deal with growing threats without increasing complexity. This means tailoring their approach to specific operational and business needs.
In times of challenging economic conditions and stagnant budgets, they need to make smart investments and think strategically before implementing another tool to address point problems.
As Chris Thatcher, director in the Global Security Practice at EPAM says, the challenge is to make the best of the available tools while being agile and able to adapt to new risks.
“The basic blocking and tackling of security hasn’t changed. What we have seen change significantly, as we’ve moved from the data center to the cloud, is there is no longer a perimeter… and as defenders get better, as technology changes, the bad guys evolve too.”
This is prompting IT security teams to invest in areas such as MDR, automation, and external expertise.
“The average enterprise is getting 500 plus security events per day. All of those events need to be investigated,” notes Thatcher.
“How many analysts do you need to investigate 500 security events? That’s why we see so much emphasis on automation and in triage and contextualizing events in security operations, to filter out as much noise as possible. Then the analysts can focus on the things that matter.”
No security team can hope to block all attacks. According to Thatcher, optimizing cyber defenses buys the organization time. “It’s not so much to keep attackers out, but to give us more time to detect and respond to those attacks,” he says.
Tailored defenses
Optimizing security operations, though, demands both resources and skilled staff. This is especially true for building a modern SOC, and for automation. Although the largest businesses can do this in-house, others are choosing outsourcing or partnering.
“If you don’t have the budget or staff to manage security operations effectively, it’s better to partner with someone who’s an expert,” advises EPAM’s Thatcher. “It’s better suited to people who do it for a living.”
Unfortunately, many managed service providers are inflexible in their approach. However, EPAM offers custom solutions that meet customer needs.
Businesses can outsource their entire SOC, adopt a co-managed solution or just have partners monitor non-business hours. They can create their own incident response teams, or they can partner for incident response (IR) services. The key is to find the right match for the business. Regardless of approach, preparation is key to effective response when bad things happen.
Security leaders don’t need more tools. They need to build on the tools they already have. They want to make them as effective as possible, fully integrated, and compatible with emerging technologies including automation and AI.
Picking the right partner is critical. A good partner challenges traditional thinking and helps prioritize the projects that will have the most impact on security and risk. It brings the right technologies and know-how that allows the business to focus on what it does best.
1 Foundry, CSO Security Priorities Study 2024, p4
2 Ibid