Agencies Turn to Dozens of Tools to Improve Network Visibility

Where Agencies Are Investing to Boost Network Visibility

The tools that are most effective at providing visibility into an organization’s environment are those that use security information and event management, respondents said. SIEM combines event, threat and risk data into one system to detect and fix security issues. More than 88 percent of respondents said such technology was “very effective” or “somewhat effective.”

Other popular strategies included investing in network monitoring, identity and access management and data governance/access management, the survey found.

“More tools means more at risk and more visibility to that risk, so they feel like they have overall greater visibility to it,” says Buck Bell, global security strategy office leader at CDW.

A higher number of tools can also create distractions, false positives and an abundance of data — all of which can be difficult to manage, he adds.

“One of the challenges, at least in theory, of adding a bunch of tools is it disfavorably begins to bias the signal-to-noise ratio,” Bell says. “All of a sudden, you have an awful lot of data that security operations center teams, by way of example, might have to wade through  — and all of a sudden, they’re beat.”

Agencies’ Cyber Training Conundrum

The report also found that training to improve security was one of the most helpful tools and services for organizations’ cyber efforts. More than 77 percent of respondents “somewhat” or “strongly” agreed that training was helpful.

Training was also the top task leaders were outsourcing (46 percent of respondents), but at the same time, training was the part of the approach that most respondents said was missing from their cybersecurity strategy (40 percent).

“There’s staffing overhead involved,” Hagopian says. “The more tools, the more people who have to learn the tool and manage the tool. It’s really difficult when you have staffing issues and staffing limitations.

Hagopian adds she isn’t surprised training remains an issue, given how hard it is to find talent familiar with the sheer breadth of tools out there. About 21 percent of respondents said their agency’s IT department was understaffed or “severely understaffed.”

However, conducted properly, spending on new training can also help government agencies adopt more automation.

“Automation is to fulfill the low-value tasks, and then you have to build up your workforce to focus on the high value of the tough stuff,” Hagopian says. “Training’s really essential so that people are equipped to handle the tough stuff. And a lot of it relates back to tool sprawl. It’s product training to ensure they understand how to operationalize it.”

That training can also be another way for government leaders to show IT workers they’re invested in their career success.

“Everybody wants to feel, as a human, I believe, like they’re contributors,” Bell says. “They want to feel like their work matters. And looking at the 80,000th false incident from some system, not only is that stressful, but it’s just deadening. Your attention span goes away.”

Job rotation can help by putting people into new roles to let them gain additional experience.

“Obviously, putting together some kind of training strategy for these people, as a way to help them secure and develop their own careers, I think that’s a huge value-add for companies looking to retain staff,” Bell says.