Threat detection and response (TDR) - definition & overview

Threat detection is the ability of IT organizations to quickly and accurately identify threats to the network, applications or other assets within the network. Without the ability to recognize network intruders or other malicious adversaries in a timely fashion, IT security analysts have no hope of responding effectively to security events and effectively mitigating damage.

Data breaches are becoming increasingly common, and with more IT organizations moving assets into the cloud, there is more opportunity than ever for bad actors to conduct successful cyber attacks. Here are the primary challenges cyber security professionals face:

Complex cloud environments

With most companies now using more than one cloud environment and the average company deploying as many as twenty separate applications into the cloud, it has become increasingly difficult for SecOps to maintain adequate oversight of enterprise cloud environments.

Perimeter focus

Many IT organizations focus too much of their effort and attention on attacks from the perimeter. There are two problems with this approach:

1. The organization may have a great perimeter firewall but remains susceptible to vectors like phishing attacks that surpass perimeter firewalls.

2. Once the perimeter is breached, the organization may lack the capability to detect an attack.

Too much focus on the perimeter of the network can create a false sense of security while assets within the network remain vulnerable.

Infinite arms race

IT organizations are part of an infinite arms race against cyber attackers. As IT organizations develop new threat detection and response capabilities, cyber attackers continue to develop new types of threats to circumvent detection systems.

Disconnected tool suite

IT organizations rely on a range of cyber security tools to assist with threat detection and response. While more than one software tool is needed to support effective threat detection, a disconnected tool suite with disparate components can make it difficult and time-consuming to track security events.

Staffing challenges

Industry data suggests that cyber security job growth is outpacing IT jobs overall. And yet, the industry faces a skill shortage when it comes to qualified cyber security professionals.

The first step to an effective threat detection and response process is understanding what threats are in the cyber environment. This shortlist covers several of the most common types, but there are more out there and new ones appear all the time.

Malware includes any malicious software program. Malware programs include spyware, viruses, trojan horse applications and other applications that can infect your computer or network, stealing sensitive information and otherwise wreaking havoc and chaos.

Phishing attacks trick the recipient into volunteering sensitive data. They usually consist of an email that requests the recipient to provide sensitive information. They may also include a link to a web page that has been spoofed to resemble a familiar site where the visitor might enter login information or other personal details.

Ransomware is a type of malware that locks or disables a computer and asks the user to pay to regain access.

A DDoS attack happens when a cyber attacker uses a network of remotely controlled computers to flood a website or network with traffic, usually in an attempt to disable the server.

A botnet is a network of infected computers. Some hackers realized that instead of writing a virus that makes your computer go haywire, they could write a program that makes your computer send spam emails to others with malicious attachments or participate in a DDoS attack. You may not even know that your machines are affected.

A blended threat uses multiple techniques and attack vectors simultaneously to attack a system.

Zero-day threats are new threats that nobody has seen before. They result from the arms race between IT organizations and cyber attackers. Because they are brand new, zero-day threats are unpredictable and difficult to prepare for.

Advanced persistent threat (APT) a sophisticated cyber attack that includes long-term surveillance and intelligence gathering, punctuated by attempts to steal sensitive information or target vulnerable systems. APTs work best when the attacker remains undetected.

Just as cyber attackers may deploy a range of threats to target security vulnerabilities within a cloud infrastructure, IT organizations can leverage a variety of software tools and applications for threat intelligence. These include, but are not limited to:

• Cloud access and security brokers (CASB)

• Endpoint detection and response

• Intrusion detection prevention systems (IDS/IPS)

• Perimeter and application firewalls

• Threat intelligence platforms

Sumo Logic's cloud-native platform helps IT organizations expand their threat detection and response capabilities for cloud environments. With Sumo Logic, IT organizations can:

1. Collect and aggregate security event data from a broad range of security software solutions into a single unified system

2. Parse security logs with data analysis driven by machine learning and pattern recognition algorithms

3. Automate the discovery of trends and patterns that could indicate a security event while cross-referencing data with the newest threat intelligence from CrowdStrike

4. Configure alerts to cyber security professionals when a threat is detected, ensuring a timely human review and response

5. Program automated threat responses to begin damage mitigation and system restoration immediately when a threat is discovered

6. Quickly perform root cause analysis and patch vulnerabilities

Sumo Logic helps IT organizations move away from reactive IT security and proactively shield their cloud deployments from malicious cyber attacks.