Silicon Shecky

Warning: I will be dropping company names in this article based on items I use or have used. These are meant as examples only from personal experience.

We live in a world where we do not have enough eyes on things, we suffer from burnout, work long hours, and generally are banging our heads against the wall. We also live in a world where almost every single product we deal with markets itself as the magic bullet in securing our company. The lack of interoperability though is as much a security hole as any bug or technique used against us.

There is an old, and true saying: The more complex something is the more chance that it can be defeated by something simple. It is a statement we, the people working in the security field understand. We deploy “SIEMS” (actually a function of data/log collecting), Anti-Virus, EDR, Firewalls, IDS/IPS, Web filtering, deep packet inspection, and so much more. More and more frequently these are becoming walled gardens, and complex ones at that. They are not talking to each other very easily, and worse, they are making it harder at times for us to find the problems.

Log/Data collectors (SIEMS) are supposed to be the one stop shop. You send your data there, usually logs, potentially Netflow streams, so you can then cross-reference and analyze the aggregated data. Simple enough, and with the proper AI/Machine Learning it should make our lives easier. Now, think about this, how many companies put their own spin on log formatting? Recently I had to write a log parser for Cisco’s syslog format because it is not using the standard style, and therefor Graylog would not parse it on its own. A simple thing that does have standardization, and open source project using that standard, and a large highly respected company saying “We will do things our way, deal with it.” Reminds me of the arguments/issues over Microsoft not using standards properly. Along the same lines, let’s look at another Cisco product, Umbrella. Hey, they put things in their cloud, you use their dashboard, and there is no simple way to forward that data to a SIEM. You have to jump through multiple hoops. This does not even address the lack of proper reporting in the console, the clunky search system, and poor information on how the whole thing works (or doesn’t) in identifying people/computers.So now you have your SIEM dashboards open and this Cisco Umbrella Console open, Just to keep an eye on things since it is now a manual cross reference situation.

Now add in an EDR solution that again causes you to use either a specific SIEM (like Splunk), or their console. Again It doesn’t give you full information in the console, requiring you to make guesses based on the information it does provide. It also does not play nicely with built in security services, so you have to put in allow or bypass rules for files and directories. It doesn’t even update known software certificates in any normal time, although a different piece of software from the same company does. Talk about software in a silo. Same ecosystem not even working similarly.

So we have console number 3 opened. You are a small business and have say 4 people on your whole security team, if you are lucky. Add on that at least one of these items has to be extra monitored due to false positive potential being extremely high (EDR) that can have a major negative impact on the company’s bottom line. Again more complexity, more eyes needed on items, more work to do.

Buying into an ecosystem is fine and all, but most companies tend to look for what software will work best in their environment (or more often suck the least). These solutions though are requiring more and more complexity in our setup. So you add onto the bottom line by outsourcing your SOC. The question is how long until they actually understand the environment for your company to be useful? How much turn over is there, and how many other companies are they monitoring at the same time with their own limited resources? Oh and now you have another layer of complexity added onto the whole ordeal.

The truth as I see it is this. There is no money in security, only in the products. The more products are in their own silo and do not communicate, the more people are needed. It is a system that is predicated on making money and helping other companies make money. If companies used standards, and made it less complex so say you can have one product, a SIEM, that allows for all the cross referencing and dashboards in one place (like it is suppose to), we can start focusing more on the real issues. We also can stop burning out our security teams due to product overload. Proper developing of the products for human consumption is needed. Interoperability is needed.

There was/is a conspiracy theory that Anti-Virus vendors actually write viruses and release them to the wild so that their products are needed. In a similar vein we are actually seeing that same type of idea in the security field/industry. It is helping cause burnout, and a huge employment gap. Not enough eyes and then we wonder why it takes so long to notice breaches. AI, machine learning and automation are fantastic tools, but we still need the human factor to confirm and monitor them. It is time we started simplifying certain things to make us more secure and cut down the burnout.