ROOTCON Blog

This is an original article we received from Christian Falco of IBM Security and that ROOTCON is glad to publish it because IBM has helped us in making ROOTCON X happen:

Over the years, companies have responded to threats by backing up the security tool truck and unloading it onto their IT environments. An expanding security arsenal of fragmented, disconnected point products and perimeter solutions can add complexity without vastly improving the organization’s overall security posture.

The burgeoning infrastructure makes it more difficult to monitor the whole network, to the point where security teams are operating in the dark. As each tool is added, costs associated with installing, configuring, managing, upgrading and patching continue to scale. Not to mention the skills gap plaguing the industry, where the expertise needed to manage and keep up with the latest threats isn’t always available.

More threats, more vendors and more tools make for more headaches.

To see through the chaos, enterprises should approach security like an immune system. Rather than a jumbled set of tools and capabilities, picture an integrated framework of key security capabilities.

At the core of this structure is security intelligence and analytics. This serves as the key piece, ingesting security data across an IT environment (e.g., logs, flows, incidents, events, packets and anomalies) as well as information beyond the enterprise (e.g., blogs, research and websites) to understand threats and take action.

This action mimics the body’s immune response. When exposed to a cold or flu, your body’s integrated network of cells and organs transmits vital information through the nervous system to help pinpoint the virus, disrupt it with antibodies and normalize the body.

Similarly, a healthy security infrastructure uses its own network of integrated security capabilities to intelligently detect the symptoms of a cyberattack — a breach on the network, an abnormal login on a high-value server, rogue cloud app usage, whatever it may be — and respond appropriately.




With analytics at the core, integrated capabilities deliver a level of visibility and defense that no single security solution can provide on its own.

Attackers continue to break through conventionally siloed safeguards using techniques that impact the entire IT environment. Consider two of today’s biggest issues: advanced threats and insider threats. Yesterday’s perimeter solutions are no match for the sophistication of these threats.

An integrated threat protection system requires strong network protection, endpoint management and security, data activity monitoring and incident response to fully disrupt and respond to an attack. The system continuously consumes threat intelligence to understand the latest attack vectors. Insider threats are responsible for many of today’s high-profile cybersecurity incidents. To mitigate this risk, enterprises need strong identity controls, which in turn should be integrated with data monitoring and security intelligence that analyzes user behavior to alert, confirm or prevent unauthorized access to sensitive data sources.

In a world where multifaceted threats necessitate integrated solutions, adding more disconnected tools is simply not enough. These fragmented products and services are expensive, complex and cannot fully solve today’s challenges.

Companies are taking a strategic approach to upgrading their defenses. We’re seeing a major shift in demand for platforms that offer integrated, intelligent security solutions backed by a collaborative, extensive partner ecosystem. Boost your security hygiene with a healthy immune system approach. 

Credits:https://securityintelligence.com/news/unleashing-the-immune-system-how-to-boost-your-security-hygiene/