Is your security bugging you with false alarms? You are not alone....
Monday, January 19, 2015 at 12:29AM For anyone who has freaked out when an antivirus alert popped up on their screen and spent time researching it only to find out it was a false alarm, a recent survey will hit home.
A survey of information-technology professionals published on Friday found that the average large organization has to sift through nearly 17,000 malware alerts each week to find the 19 percent that are considered reliable. The efforts at triage waste employees’ time—to the tune of a total estimated annual productivity loss of $1.3 million per organization. In the end, security professionals only have time to investigate four percent of the warnings, according to the survey conducted by the market researcher Ponemon Institute.
The survey results show the problems posed by security software that alerts for any potential threat, says Brian Foster, chief technology officer of network-security firm Damballa, the sponsor of the research.
“At the end of the day, all of these security products are spitting out more alerts than humans have time to deal with,” Foster said. “And at the end of the day, if your software is overwhelming the analysts, you are part of the problem, not part of the solution.”
The deluge of unreliable alerts—a problem known in the industry as “false positives”—is a well-known issue for many types of security systems. Typically, security-conscious users and IT security professionals have a choice: turn on more features in their security products and deal with the increased alerts or disable features and risk missing a real attack.
Unfortunately, companies often choose the latter. But even when security professionals choose the most stringent options, the increase in unreliable alerts overwhelms users and those responsible for IT security. Instead of investigating every warning, they are trained to ignore the warnings.
In 2013, for example, when cybercriminals broke into Target’s systems and loaded malware, the company’s FireEye security system issued an alert for the activity, but the company ignored the alerts. As a result, a District Court judge in Minnesota has given the go-ahead for banks to sue the retailer.
In the past, Damballa’s Foster has built a few products at other companies that produce a large number of alerts. Security firms are more concerned with catching every attack, even if doing so means burying a critical alert in a haystack of irrelevant warnings. The industry has to change, Foster says, especially with trained security analysts in short supply.
“These products rely on a smart, skilled human to make sense of all the alerts in order to be effective, and unfortunately, there are not enough technically trained professionals to go around,” he said.
Of course, from the security industry’s perspective, solving the problem involves buying more security, not less. By combining existing systems with more data and automated analysis, the triage of alerts can be automated, whittling down the number of warnings that humans actually have to investigate.
“Find ways to corroborate those alerts,” Foster said. “Try to get at the problem from multiple angles instead of relying on a single silver bullet.”
For home users, few solutions exist. Security-conscious users who use more stringent security software will have to deal with more alerts produced by security systems tuned to warn more often. Deciding whether an alert is serious will continue to be up to the user until security services crop up to help users manage their systems.
