{"id":42640,"date":"2021-05-25T00:00:00","date_gmt":"2021-05-25T00:00:00","guid":{"rendered":"https:\/\/www.trendmicro.com\/en_us\/research\/21\/e\/personal-professional-challenges-facing-secops-teams.html"},"modified":"2021-05-25T00:00:00","modified_gmt":"2021-05-25T00:00:00","slug":"personal-professional-challenges-facing-secops-teams","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/personal-professional-challenges-facing-secops-teams\/","title":{"rendered":"Personal & Professional Challenges Facing SecOps Teams"},"content":{"rendered":"

<\/p>\n

<\/div>\n

It\u2019s easy to forget that cybersecurity is fundamentally about people. Attacks are launched by threat actors, phishing emails are opened by employees, and it is your SecOps team that has to try and detect and respond to increasing volumes of these threats. As good as technology systems are, we haven\u2019t got to the point where all of this defensive work can be automated. So what happens when your most precious resource, your security team, feels overwhelmed by their workload?<\/p>\n

According to new research from Trend Micro, it\u2019s a question an increasing number of organisations are facing\u2014but few have a satisfactory answer to. The reality is that under pressure SecOps teams need better tools to correlate and prioritise alerts, so they can work more efficiently.<\/p>\n

On the back foot<\/span><\/b><\/p>\n

Trend Micro\u2019s global study is based on interviews with 2,303 IT security decision makers in 21 regions working in organisations of all sizes. <\/i>We found that three-quarters (74%) of them are already dealing with a breach or expecting one within the year.<\/p>\n

It\u2019s not hard to see why. Today it\u2019s a case of \u201cwhen not if\u201d your organisation is breached. It\u2019s simply too easy for attackers to phish, crack or buy employee credentials off the dark web. Once inside they can use legitimate tools to move laterally across corporate networks<\/a> without being spotted. They have a readymade underground market on which to sell stolen data. And the affiliate ransomware sector is thriving: we detected<\/a> a 34% year-on-year increase in new ransomware families in 2020.<\/p>\n

At the same time, SecOps teams are under-resourced and many may still be working from home, with all the distractions that entails. The daily threat of major breach-related financial and reputational damage hanging over their work is immense.<\/p>\n

Taking its toll<\/span><\/b><\/p>\n

Over the years, organisations have amassed a large number of point products to deal with the escalating cyber-threat\u2014all of which generate alerts. But there\u2019s little in the way of co-ordination and correlation of these signals. We found that over half (51%) of SecOps teams feel overwhelmed by alerts, rising to 54% for those working in Security Operations Centres (SOCs). Even more (55%) admitted they aren\u2019t confident in their ability to prioritise or respond to these alerts. The result: on average SecOps spends 27% of its time dealing with false positives.<\/p>\n

This doesn\u2019t just have an impact on the organisation\u2019s ability to defend itself. It\u2019s taking a real toll on those on the frontline. Around 70% of respondents told us they feel emotionally affected by their work. The pressure has become so great that many have:<\/p>\n