Modern KPIs for effective cybersecurity

Martin Potgieter, technical director at Nclose

Research by Symantec found that ransomware attacks increased by 36% in 2017 following the introduction of more than 100 new malware families.

In its annual Data Breach Year-End Review, the Identity Theft Resource Centre found there was a total of 1,579 publicly disclosed data breaches in 2017, a 41% increase over 2016.

Despite this, PwC's 2018 Global State of Information Security Survey found that 44% of respondents lacked an overall information security strategy. Amid rising fears of an increase in the volume and sophistication of cyber-attacks and the growing cybersecurity skills deficit, the lack of formal security strategy bodes ill for the global business community. Perhaps that is why 87% of enterprises say they need 50% more budget for cybersecurity, according to EY.

In response, many organisations have deployed a Security Operations Centre (SOC) to better protect critical information. The SOC offers an attractive value proposition: organisations were making costly investments into individual cybersecurity solutions, but the SOC would unify all the disparate elements and create a single access point where all security-related information would be sent and processed for insights and ensure compliance to regulations and laws governing their industries.

Unfortunately, many SOCs are purely compliance-driven initiatives that are not designed to detect and respond effectively to cyber threats. Core to the problem is that too many organisations believe cybersecurity is simply a tech matter: buy the correct mix of products and solutions, unify all the elements in the SOC, et voila! My data is secure; come what may, I am protected from cybercrime.

Security-in-a-box is not secure

Buying a piece of technology and expecting it to fulfil the role of a SOC is unwise. Cybersecurity is about much more than technology: there is significant interaction with the broader business needed to bring the value of a SOC to life. However, when SOCs are deployed there’s usually a large investment in various technologies and no engineering thereof, leaving the SOC with very little in the way of creative input to effectively detect suspicious activity.

The core of a SOC is security information and event management, which integrates various IT systems to process all data in a central point for deeper analysis. If suspicious behaviour or data is detected, an alert is sent to security analysts for further analysis. However, in most enterprise environments there are millions, even billions of events that can trigger thousands of alerts. Here, the amount of data that can be used for analysis and investigation is limited by a per-GB pricing model that forces you to choose specific sources in an effort to contain costs. Alert fatigue also sets in, undermining the organisation’s response capabilities by leaving security analysts blind to actual threats to the business.

Global shift to MDR

Organisations in more developed markets have started adopting a new way of active threat detection and response: the Managed Detection and Response (MDR) model. According to Gartner, MDR provides organisations with 24/7 threat monitoring, detection and response services through a combination of technologies, advanced analytics, threat intelligence and human expertise to improve the way they detect and respond to threats and incidents.

MDR's distinguishing feature, however, is its focus on dedicated security engineers supported by machine learning capabilities that provide real-time, continuous monitoring and threat detection. MDR craves information; it's not limited by events-per-second, so costs are easier to control. And as human and machine learning capabilities work in concert to analyse data, organisations are far better placed to start developing trend analyses that can significantly reduce the number of false alerts and make far better use of available resources.

Considering South Africa's growing cybersecurity skills deficit, having an external team of security engineers at hand plays an invaluable role in safeguarding the integrity of their security deployments.

KPIs for modern cybersecurity

But what should organisations look for when deciding which cybersecurity approach will work best for them? I would argue there are four critical KPIs that need to be considered, namely: