It’s one thing to ensure that all of the possible threat entry points are covered by an organization’s security infrastructure, it’s another to ensure proactive protection.

Amid the ever-increasing volume and sophistication of online threats, organizations need to keep up by constantly enhancing their network defense through the accumulation of threat intelligence. But the buck doesn’t stop there, they need to make sense of the data collected and connect the dots to maintain a threat-free environment.

Effective threat correlation is a key ingredient to proactive protection, that is, the ability to defend against not just known but also unknown threats. This is what organizations typically look for in IT security solutions and systems. That said, should they be relying on outsourcers for their security needs, it’s also what they would expect from their respective providers. 

Elements of Effective Threat Correlation

Guaranteeing the safety of a client’s network requires security service providers to reduce false positives and negatives and verify sensor performance and availability. And these challenges can be addressed by effective threat correlation.

Through proper threat correlation, security response teams can focus on their topmost priority. This increases their efficiency while reducing potential risks and corporate liabilities brought on by stricter privacy protection guidelines and laws. But what makes for effective threat correlation?

To effectively connect the pieces that make up today’s blended threats, security providers need high-quality data. The information added to a client’s solutions and systems must be both timely and relevant.

The ideal correlation process is one that uses near real-time information. The sooner a security provider finds out about an active incursion, the sooner it can deal with it. It is also more cost-effective to identify and monitor potential threat sources than to address an attack’s effects after the fact. Once a breach is reported, the victim is required to make amends in the form of financial remuneration to those who own the affected data.

Security outsources are also expected to use relevant information. They need to deliver the appropriate information to the right people at the right time. If a client’s firewall, for instance, can’t be reached due to a network failure, the network operations center (NOC) should be alerted instead of the security team. Add to this the fact that they need to filter out irrelevant noise so as not to swamp operators with false positives and negatives. They need to detect high-risk threats that can be missed by a manual log survey or a tool that simply looks at a single device. Each device in its network needs to work with all others in a seamless fashion.

Security providers need to ensure that their infrastructure can address clients’ threat intelligence collection, consolidation and correlation requirements.

3Cs of an Effective Threat Correlation Architecture

An effective threat correlation architecture comprises at least three essential steps: collection, consolidation and correlation.

Collection
Some security solutions simply pull sensor log files from a corporate network that these then upload to a central repository. Compression may be employed to reduce network bandwidth demands. Others typically perform collection and initial analysis on individual devices to distribute the collection process, essentially reducing bandwidth requirements. Regardless of how the work is distributed and accomplished, this step simply gathers all available threat intelligence and data feeds that need to be normalized or aggregated.

Consolidation
Also known as “normalization” or “aggregation,” this phase involves filtering out irrelevant data to focus on what’s important typically defined by security solutions and their users. In this step, many of the false positives are eliminated.

Consolidation weeds out duplicate data and makes sure that each is in a standard format. This way, when correlated, the information can be easily compared with everything else. Even if the data came from different sources (systems with varying configurations, solutions from different vendors, etc.), interrelationships can still be formed.

Correlation
The ultimate goal is to pull data from multiple security platforms, correlate it and provide timely, relevant and accurate intelligence for threat response teams.

For solutions that use a centralized database, analysts simply need to run the appropriate queries to get responses. This can, however, be hampered by scalability and performance problems. To analyze huge amounts of data, organizations need systems that can handle the massive processing requirements, as well as time, which may be limited given the fast pace by which threats can infiltrate a network.

Every organization needs an effective threat correlation architecture if they are to withstand the risks that the ever-increasing volume and sophistication of threats pose. Whether they rely on in-house or third-party providers for their security requirements, they have one thing in common. They need timely, relevant and accurate data—something that, fortunately, is not unattainable.