A ‘Force Multiplier’ for Tackling the Security Skills Shortage

Many organizations struggle to staff and maintain a security operations teams due to a serious shortage of skilled cybersecurity professionals. The challenge isn't limited to filling open roles; it is equally hard to improve the skills of existing resources and focus them on the alerts that matter most. Meanwhile, the exploding number of alerts and the challenges combined with correlating security details from disparate tools makes it even harder for teams to understand the full scope of an attack. As a result, security analysts spend more time on manual correlation and analysis, and less time on more important activities, like investigating the incidents that put their organizations at greatest risk. Indeed, according to a survey conducted by Gatepoint Research on behalf of RSA, 93 percent of security operations center managers are unable to triage all potential threats or to even sufficiently investigate 25 percent of security alerts being received.¹  It's no wonder we continue to see breaches—and the damages they cause—rise year after year.   Given these challenges, security technology must become a force multiplier: It should have the effect of doubling or tripling the impact and productivity of security teams.  How can you tell if a security technology will function as a force multiplier? Look for these features and capabilities:   1. Expanded visibility: Gathers log, packet, NetFlow and endpoint data from across your IT infrastructure, including cloud-based applications and resources. 2. Data correlation: Correlates multiple indicators of compromise (IOCs) and reconstitutes full sessions to help analysts understand the full scope of an attack. 3. Automated threat detection: Leverages advanced analytics, comprehensive threat intelligence and optimized workflows to automate threat detection and ensure security analysts respond swiftly to the real threats hiding in their organization's data. 4. Streamlined UI: Features an intuitive user interface that makes it easy for analysts to see the most important alerts, understand the context of security incidents, and ultimately serves to improve their productivity and capabilities. No matter how many people are on your security operations team—whether one part-time analyst or 20 full-time employees in a follow-the-sun model—empower them with tools that help uncover the threats that matter most. In today's environment, organizations and their security analysts need every possible advantage in the continuing fight against advanced threats.

—Amy Blackshaw is the director of product marketing for RSA NetWitness Suite.