CardinalOps, an AI-powered detection engineering company, released its 2022 Report on the State of SIEM Detection Risk. The company’s report analyzed aggregated and anonymized data from production security information and event management (SIEM) examples to understand security operations center (SOC) preparedness to detect the latest techniques in MITRE ATT&CK, the industry-standard catalog of common adversary behaviors based on real-world observations.
This is important because detecting malicious activity early in the intrusion lifecycle is key to preventing material impact to the organization.
The analysis shows actual detection coverage remains far below what most organizations expect, and many organizations are unaware of the gap between their assumed theoretical security and the defenses they have.
The data this analysis spanned diverse SIEM solutions – including Splunk, Microsoft Sentinel, and IBM QRadar – encompassing more than 14,000 log sources, thousands of detection rules and hundreds of log source types, spanning diverse industry verticals including financial services, manufacturing, telecommunications, and MSSP/MDR service providers. Using MITRE ATT&CK as the baseline, CardinalOps found that on average:
- Enterprise SIEMs contain detections for fewer than five of the top 14 ATT&CK techniques employed by adversaries in the wild
- SIEMs are missing detections for 80 percent of the list of more than 190 ATT&CK techniques
- 15 percent of SIEM rules are broken and will never fire, primarily because of fields that are not extracted correctly or log sources that are not sending the required data
- Only 25 percent of organizations that forward identity logs such as Active Directory and Okta to their SIEM, actually use them in their detection rules, which is concerning because identity monitoring is one of the most critical data sources for strengthening zero trust
- 75 percent of generic out-of-the-box detection content provided by SIEM vendors is disabled due to noise and customization challenges experienced by detection engineering teams
These gaps in detection can be attributed to challenges SOCs and detection engineering teams face. At the top of the list is constant change in the threat landscape, organizational attack surfaces and business priorities combined with an increase in configuration complexity resulting from an increasing number of log source types and telemetry from diverse data sources (endpoint, identity, cloud, etc.).
Difficulty in recruiting and retaining skilled security personnel is also a factor. Many enterprises still rely on manual and error-prone processes for developing new detections, which makes it difficult for engineering teams to scale effectively and reduce their backlogs.
“Organizations need to become more intentional about detection in their SOCs. What should we detect? Do we have use cases for those scenarios? Do they actually work? Do they help my SOC analysts effectively triage and respond?” said Dr. Anton Chuvakin, head of Security Solution Strategy, Google Cloud. “Detection use cases are the core of security monitoring activities. Having structured and repeatable processes is essential for prioritization, aligning monitoring efforts to security strategy, and maximizing the value obtained from your security monitoring tools.”
To help organizations address their detection challenges, the 2022 CardinalOps report includes a series of best practices to help SOC teams measure and increase the robustness of their detection coverage, so they can improve their detection posture over time.
“Our goal with creating this report was not to shame security teams for having blind spots, but rather to draw management-level attention to the disparity between perceived security and actual detection quality and coverage, using MITRE ATT&CK as the benchmark,” said Michael Mumcuoglu, CEO and co-founder at CardinalOps. “If we’re spending all this time and money on more security tools, why are we still being hacked? We believe the answer lies in the need to apply automation and analytics to identify and fix misconfigurations in existing tools and remediate the riskiest detection gaps, in order to free detection engineers to focus on more strategic activities such as investigating new and novel attack scenarios.”
You can download the full report here.
For more information, please visit https://www.cardinalops.com/.