Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

4/18/2019
03:55 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

The Cybersecurity Automation Paradox

Recent studies show that before automation can reduce the burden on understaffed cybersecurity teams, they need to bring in enough automation skills to run the tools.

Cybersecurity organizations face a chicken-and-egg conundrum when it comes to automation and the security skills gap. Automated systems stand to reduce many of the burdens weighing on understaffed security teams that struggle to recruit enough skilled workers. But at the same time, security teams find that a lack of automation expertise keeps them from getting the most out of cybersecurity automation. 

A new study out this week from Ponemon Institute on behalf of DomainTools shows that most organizations today are placing bets on security automation. Approximately 79% of respondents either use automation currently or plan to do so in the near-term future.

For many, automation investments are justified to management as a way to beat back the effects of the cybersecurity skills gap that some industry pundits say has created a 3 million person shortfall in the industry. Close to half of the respondents to Ponemon's study report that the inability to properly staff skilled security personnel has increased their organizations' investments in cybersecurity automation. 

Nevertheless, the fact remains that automation isn't magical. It takes boots on the ground to roll out cybersecurity automation and true expertise at the helm of these tools to reap significant security benefits from them over the long haul. Ponemon's study shows that 56% of organizations report a lack of in-house expertise is one of the biggest challenges impeding adoption of security automation. In fact, it was the No. 1 obstacle, named more frequently than legacy IT challenges, lack of budget, and interoperability issues.  

Sentiments are relatively evenly split between those who think automation will cause a net increase, net decrease, or have no effect on headcount over time. However, those who think it'll mean hiring more staff still have the plurality on that count — 40% of respondents say they'll need to hire more people to support security automation.

In another report released by SANS Institute on security automation, SANS analyst Barbara Filkins warns that organizations must fight the misconception that automation is easy or quick to implement.

"Automation takes a tremendous amount of effort to arrive at the point where it makes things look easy," Filkins writes. "Don't underestimate the resources needed to define the processes — in the light of more effective tools — and close the semantic gaps in the data gathered."

That study shows while automation is on the uptick at most organizations, only a scant 5.1% are at a high level of maturity with extensive automation of key security processes. 

Part of the difficulty in assessing or measuring the level of automation maturity and its effect on the security industry is that experiences vary wildly. A huge chasm between the haves and have-nots of cybersecurity automation currently exists in the industry, explains Gartner's Anton Chuvakin. On one end, he says, there are plenty of organizations that don't even have the resources to run security automation, let alone effectively operationalize it.

"They do not have the people to install a tool and to keep it running. I've met people who say they don't have time to install and configure a basic log management tool," Chuvakin writes. "On the other edge of the chasm, we have organizations with resources to WRITE tools superior to many/most commercial tools." 

This chasm may impact the staffing equation to some degree, as more than likely it will precipitate the creation of more quality service providers to fill the gap in expertise for those organizations that simply do not have the staff to add more layers of complicated automation tools. 

Related Content:

  

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
4/22/2019 | 8:45:46 AM
Three points
Automation works great on detection and remediation.  We have to move FAST and infections move FASTER than the human hand.  I have pointed this out to my Malware department and remember well when Cryptolocker wiped out a small 501C3 I supported in 2014 - arrived 1;45 AM and bounced to server.  I had offsite backup and restored 90% of everything in 3 hours or less.  I planned well and tested well.  That said, infection moves fast and automation is just as fast.  The rub is in evaluation of threat - can automation catch all false positives?  Over time, more yes than no but even so a human mind can touch facts and suppositions that a system cannot or ever do.  A dentist once told me that robotic surgery may be fine BUT it lacks the ability to finger touch into a body and then evaluate what it just touched.  Maybe in 20 years but not now.  Like Norad, human decision has to be in the loop.  Otherwise we would lack the famous Russian in their silo who did NOT launch the warheads some years  back and saved the world.  

Remember what Spock said to Kirk about V'Ger - it lacked the ability for a simple human hand-to-hand grasp.
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "SpearPhish! Everyone out of the office!"
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-1919
PUBLISHED: 2019-07-17
A vulnerability in the Cisco FindIT Network Management Software virtual machine (VM) images could allow an unauthenticated, local attacker who has access to the VM console to log in to the device with a static account that has root privileges. The vulnerability is due to the presence of an account w...
CVE-2019-1920
PUBLISHED: 2019-07-17
A vulnerability in the 802.11r Fast Transition (FT) implementation for Cisco IOS Access Points (APs) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected interface. The vulnerability is due to a lack of complete error handling conditi...
CVE-2019-1923
PUBLISHED: 2019-07-17
A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to improper input validation in the device configuration interface. An attacker could exploit this vulnerability by access...
CVE-2019-1940
PUBLISHED: 2019-07-17
A vulnerability in the Web Services Management Agent (WSMA) feature of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data using an invalid X.509 certificate. The vulnerability is due to insufficient X.509 certifi...
CVE-2019-1941
PUBLISHED: 2019-07-17
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability exists because th...