What Is Security Analytics?
Security analytics is a combination of software, algorithms, and analytic processes used to detect potential threats to IT systems. The need for security analytics technologies is growing thanks to rapid advancements in malware and other cyberexploits.
Based on a Data Breach Investigations Report from Verizon, it takes a cybercriminal just minutes, even seconds, to steal sensitive data. But IT departments may not discover that breach for hours, sometimes even days or weeks. In many cases, the breach is discovered by an outside party, such as law enforcement or a customer.
Hackers are using innovative tactics to worm their way into IT systems. They leverage vulnerabilities in unpatched applications, create memory-resident scripts that can't be detected by malware scanners, and use phishing and other types social engineering to evade IT security systems.
The Verizon report found that nearly three-quarters (73%) of cyberattacks were by outsiders, half of whom were members of organized crime groups, and 12% were by hostile nations or government agencies. These creative approaches make it difficult for the average IT department to detect and block a potential attacker before they've made off with the data. It's only going to get worse, say analysts. Trellix's researchers predict that criminal organizations will consolidate into larger, stronger malware-as-a-service businesses with the resources to develop more sophisticated exploits.
To keep ahead of these professional criminal groups, traditional security solutions—antivirus software, firewalls, and intrusion detection and prevention systems—will require automation and real-time analysis to detect and prevent cyberattacks. That will require security analytics.
What is a security analytics solution?
Security analytics applications use both real-time and historical data to detect and diagnose threats. Sources of information include:
- Real-time alerts from workstations, servers, sensors, mobile devices, and other endpoints
- Real-time feeds from other IT security applications (firewalls, intrusion prevention, endpoint detection and response, etc.)
- Network traffic volume and types
- Server logs
- Third-party threat intelligence feeds
Security analytics combines data from the various sources and looks for correlations and anomalies within the data.
A security analytics tool may use different methods for analyzing the data. These include traditional rules-based methods, as well as statistical analysis and machine learning. The application can also incorporate other components to automate and orchestrate events.
The main elements of a security analytics solution are summarized below.
- Behavioral analytics. Abnormal behavior of end-users or applications often indicates a security breach or attack. Behavioral analytics studies patterns of user, application, and device behavior to identify anomalies. For example, financial services companies employ behavioral analysis to detect credit card fraud. An unusually high withdrawal (or a $1 test withdrawal) might signal a stolen card number. Likewise, an end-user who logs on at 2 a.m. to access systems not required for work, or an application that begins sending unusual queries and commands, could indicate a breach.
- Network analysis and visibility (NAV). A NAV application or device analyzes traffic from end users and applications as it flows across the network. Security Analytics Platforms report from Forrester Wave describes NAV as a collection of tools that includes network discovery, flow data analysis, network metadata analysis, packet capture and analysis, and network forensics.
- Security orchestration, automation, and response (SOAR). Security orchestration, automation, and response (SOAR) is the orchestration hub that handles communication between data gathering, the analysis engine, and threat response applications. Either the security analytics application or an external product such as a security information and event management (SIEM) application can provide SOAR capabilities. A SIEM collects data on network traffic, system events, and potential risks. It then performs analytical functions, such as correlation and statistical analysis.
- Forensics. Security data analytics solutions provide tools to investigate past or ongoing attacks, determine how the IT systems were compromised, and identify remaining vulnerabilities. This can help to ensure that similar incidents don't occur in the future.
- External threat intelligence. Threat intelligence (TI) itself is not security analytics. However, TI platforms (TIPs) add context to an analytical process. A security software and services company may include a threat intelligence feed as part of its solution. Examples of intelligence feeds are the Department of Homeland Security's free Automated Indicator Sharing (AIS) and Ransomware Tracker, a Swiss security site that focuses on tracking and monitoring the status of domain names, IP addresses, and URLs that are associated with ransomware.
These components help a security analytics application detect and prevent complex cyberattacks, including advanced persistent threats (APT). APTs are conducted in stages, each of which might seem innocuous, but that together can create a breach. APTs are often called blended attacks, as they use multiple tactics. An APT may start with an email containing a malicious attachment or link. Once an endpoint is infected, the attacker can gain access to other systems.
Benefits of security analytics
Security analytics tools can deliver benefits for:
- Rapid detection and response. Security analytics speeds detection and response to cyberthreats. Fast response can help IT to either prevent or lessen the damage that a breach causes.
- Compliance. A major driver of the security analytics market is the need to comply with government and industry regulations. Some regulations require monitoring and log collection for auditing and forensics, and security analysis applications can provide a unified view of all data events taking place. This provides both proof of compliance and the ability to quickly detect and fix instances of potential non-compliance.
Security analytics can help an IT department make sense of the volumes of data flowing in and out of its network and to quickly detect potential threats. By providing real-time intelligence and a historical record of past threats, a security analytics application can protect an organization from a potentially costly data breach or cyberattack. The safety of an organization's data and IT systems increasingly depends on having an effective security analytics solution.