Dr Anton Chuvakin Blog (Original)

Security writing since the mid-2000s. New posts are mirrored from Anton on Security on Medium.

Who Validates Alerts Validated by Your Alert Validator Software?

By Anton Chuvakin
Historical Archive Note: This post was originally published on the Gartner Blog Network on March 6, 2015 by Anton Chuvakin.
Original URL: http://blogs.gartner.com/anton-chuvakin/2015/03/06/who-validates-alerts-validated-by-your-alert-validator-software/ | Archive.org Snapshot

Pardon the idiotic title, but some recent discussions around security analytics have made this question practically relevant.

So:

  1. You have a SIEM and other security technologies focused on detection and alerting
  2. As a result, you have lots of security alerts – and you think it is too damn many!
  3. You don’t have enough people to tune the systems that produced the alerts so that they produce fewer/better alerts
  4. Also, you do not have enough skilled SIEM people to triage / validate the alerts
  5. Instead, you want to buy a new, “magic bullet” tool that promises to “make better alerts”
  6. Your security budget: $$$$$. Budget after the magic tool purchase: $$
  7. The magic tool is deployed and – abracadabra! – your 23,543 alerts become 17 alerts
  8. What just happened? Where did they go?!
  9. Now you need skilled people to a) confirm that alerts that remained really do matter, b) that these alerts matter the most to you and also to c) confirm that alerts that vanished don’t matter
  10. If a), b) and c) are not to your perfect satisfaction, you now need skilled people to tune the new tool.
  11. Result? You bought a new tool to avoid hiring people, and now you need to hire people to run this tool. In fact, you needed, 3 security analysts @ $80K/year, and now you need a security data scientist @ $240K/year …
  12. Explain :–)

On a more serious note, we make a lot of exciting predictions on the rise of smart machines, but for the foreseeable future said machines will require smart people to run them …

Blog posts on the security analytics topic: