Saving the SOC from overload by operationalizing digital risk protection

The latest research from Digital Shadows' Photon Research team explores the increasing phenomenon of Account Takeover (ATO) and it’s dramatic impact on companies around the globe.  

Compromised credentials are a key part of ATO attacks, with the adversary obtaining these login details and using them to access corporate accounts.  The latest research shows more than 15 billion credentials in circulation, an increase of over 300% since 2018.  

This is clearly a major issue for all corporations and their security teams.  Fortunately, there are several providers of breached credential data that can send alerts to security teams when one or more of their credentials appear in criminal forums, marketplaces, or are made public in some other capacity. Many of these tools are limited in some way. Many do not provide the passwords themselves. Others lack collection from closed sources. However, the biggest challenge for security teams is that these tools require too much wasted effort working out what constitutes a real risk.

Modern SOCs Under Siege

Armed with this visibility, security teams can then look to see if those credentials are legitimate and live in their authentication mechanisms, and if so reset the passwords before damage can be done.

Unfortunately, there is a big difference between a security team receiving those alerts, and putting them into action to protect a company.  The modern SOC is under siege not just from the attackers, but from the sheer volume of incidents they have to manage on a daily basis. 

According to ESG Research, “Forty-two percent of cybersecurity professionals say their organization ignores a significant number of security alerts because they can’t keep up with the volume”.  In a world where the majority of ‘new’ breached credentials are duplicates, this is a particularly big issue when it comes to teams dealing with ATO.  At Digital Shadows, we have also seen a trend over the last few years where breaches are increasingly being rolled together and re-released into even bigger breach files with millions of aggregate credential dumps, creating further havoc for security operations teams trying to manage all the alerts.

Secondly, in addition to raw volume according to a survey by Fidelis, “A lack of integration of security controls also hampers the speed of investigation and remediation, the report stated: 70% of respondents said that at least half of their security controls were not integrated.”

It’s unsurprising that Gartner stated  in their new report Hype Cycle for Security Operations, 2020: “Turnkey and low-complexity solutions have increased in demand, especially among smaller, less security-mature organizations looking for technologies and services that require few specialist skills or minimal infrastructure to be retained internally.*”

New Functionality Dramatically Reduces Triage Effort

Understanding this, Digital Shadows is pleased to announce that as part its'new breached credential detection and remediation Digital Shadows is trying to be the SOC’s best friend, putting the primary focus on operationalizing the breached credentials we send across, saving the SOC time, increasing response times and reducing fatigue:

1. Faster alert triage by suppressing duplicate alerts
2. Validation of password format

These new features are backed up by our NIST-mapped playbooks and integrated takedown capabilities. 

You can read more about this new piece of functionality in this blog: https://www.digitalshadows.com/blog-and-research/searchlights-credential-validation/

Focus on Mitigation, Not Noise

As part of our overall approach to Digital Risk Protection, each of these measures helps companies to not only detect breached credentials, but mitigate the resulting risks in the most efficient ways possible.  As Gartner notes in the same report on Digital Risk Protection Services (DRPS) “This technology accelerates the breadth and depth of protecting digital assets in an organization by significantly improving the ability to take action and mitigate impact. (Gartner, Hype Cycle for Security Operations, Pete Shoard, 23 June 2020)

To see how Digital Shadows puts DRPS into action, including for Account Takeover (ATO) protection, contact us for a custom demo for your organization here.

This article was originally published by Alastair Paterson on https://www.digitalshadows.com/blog-and-research/saving-the-soc-from-ove...