Analytics Usage Improves: Results of SANS' 2016 Survey on Security Analytics

BETHESDA, Md., Nov. 30, 2016 /PRNewswire-USNewswire/ -- Cyber security professionals have become more aware of the value of analytics and have moved beyond using analytics for detection and response to using analytics to measure and improve their overall risk posture, according to results of a new survey to be released by SANS Institute in a two-part webcast on December 7 and December 8, 2016.

"Each year more and more organizations look to security analytics to shore up their cyber security defenses," says SANS senior instructor and author of the report, Dave Shackleford. In the survey, only 11% of survey respondents either don't use analytics or don't know that they do.

Of the 44% who were able to quantify improvements, 17% reported increased visibility into actual events or breaches, and 11% reported improved detection of unknown threats, with an equal percentage noting reduced duration of events.

Utilization of security analytics is slowly rising, but there is much room for improvement in the use of analytics, results show.

As in previous SANS surveys on security analytics, the greatest impediments to implementing analytics and reaping the advantages of security analytics continue to be lack of qualified staff and funding/resources to implement programs. Because of these shortcomings, 49% have prioritized investment in personnel/training, 42% are looking to make detection and security operations center upgrades and 29% plan to invest in integrating incident response into their analytics programs in the coming years.

"One of the best ways to overcome shortages in staffing and funding is through automation," adds Shackleford. "Machine learning offers insights that could help less-skilled analysts with faster detection, automatic reuse of patterns detected and more, leading to related improvements in risk posture."

In this survey, 54% of respondents rated their programs as being "Fairly automated," while only 4% considered their programs to be fully automated. Unfortunately, only 22% said they deployed machine analytics to enable better, faster decision making, while 54% said their programs did not use machine learning as part of their analytics programs, and 24% didn't know.

Full results will be shared during a two-part webcast at 1 PM EDT on both December 7 and December 8, sponsored by AlienVault, Anomali, LogRhythm, LookingGlass Cyber Solutions, and Rapid7, and hosted by SANS.

The Part 1 webcast, held December 7, which focuses on how organizations are utilizing security analytics during real threat events, how they're utilizing analytics and intelligence, and how automated their processes are: Register for Part 1 at  www.sans.org/webcasts/102630. 

The Part 2 webcast, held the following day on December 8, focuses on improvements in risk posture associated with security analytics as well as best practices for implementing analytics programs: Register at www.sans.org/webcasts/102635

Those who register for the webcasts will also receive access to the published results paper developed by SANS Analyst and cyber security expert, Dave Shackleford.

Tweet This:

Catch the two part webcast series unveiling results of the SANS 2016 Security Analytics Survey | 12/7 & 12/8 | www.sans.org/u/ntB

"Each year more & more organizations look to security analytics to shore up their cyber security defenses"- Full story w/ Dave Shackleford |12/7 & 12/8 | www.sans.org/u/ntB 

About SANS Institute
The SANS Institute was established in 1989 as a cooperative research and education organization. SANS is the most trusted and, by far, the largest provider of training and certification to professionals at governments and commercial institutions world-wide. Renowned SANS instructors teach over 50 different courses at more than 200 live cyber security training events as well as online. GIAC, an affiliate of the SANS Institute, validates employee qualifications via 30 hands-on, technical certifications in information security. The SANS Technology Institute, a regionally accredited independent subsidiary, offers master's degrees in cyber security. SANS offers a myriad of free resources to the InfoSec community including consensus projects, research reports, and newsletters; it also operates the Internet's early warning system--the Internet Storm Center. At the heart of SANS are the many security practitioners, representing varied global organizations from corporations to universities, working together to help the entire information security community. (www.SANS.org)

SOURCE SANS Institute

Related Links

http://www.sans.org