This is the third and final blog in our series on data-driven security and automation. We began by discussing the significance of deploying a data-driven approach to security now when the data is already available to you. Our second blog then dove deep into using data-driven Physical Identity and Access Management (PIAM) to expose insider threats, reduce risk, and even maximize space utilization. Blogs 1 and 2 are available to read now as we continue our conversation with the idea of using data-driven automation to optimize Security Operations Center (SOC) operations.
The Reality of Traditional SOC Operations
SOCs serves a unique and essential purpose; to protect people, property, and assets within a larger organization. This purpose is necessary, even admirable, but not without its own shortcomings. Traditional SOCs are regarded as primarily cost centers that function at less-than-optimal efficiency. This is a statement based on fact, not opinion.
In a traditional SOC, alerts from various security systems (surveillance, access control, alarm) enter the facility to be identified and responded to by an operator. In the best-case scenario, each notification requires between 2 and 10 minutes of the operator’s time to verify the alarm, initiate video verification to observe activity, and, if need be, dispatch a security officer to the source of the alarm to investigate. Unfortunately, there are many steps throughout this process where the error, risk, and inefficiency can creep in.
This is where data-driven automation comes into play. To best illustrate how data-driven automation solutions can best solve the challenges plaguing SOC operations, we’ve outlined applicable problems (manual SOC operations) vs. their solutions (data-driven automation).
SOC Inefficiencies: Problem vs. Solution
False Alarms: First, and the most common risk found within SOC operations, is the presence of false alarms. An analysis of the security marketplace has shown that 80-90% of all alarms are either false positives or nuisance alarms. Such a high rate of false alarms eventually leads to “alarm fatigue” wherein operators no longer respond to alarms with the speed or intent that they would otherwise because they know the alarm is likely to be false. Responding to false alarms also decreases a SOC’s efficiency, as so much of an operator’s time is lost spent chasing down false alarms instead of performing mission-critical tasks.
Data-driven automation can solve these inefficiencies by performing real-time analysis of all historic and live data from physical security devices, logs, and configurations, and then mathematically recalibrating the systems to systematically eliminate false alarms. In fact, Vector Flow’s SOC Automation solutions are proven to eliminate up to 99% of false alarms, and the first results can be seen within just 48 hours of deployment. Our suite of AI-driven algorithms is purpose-built to identify the root cause of false alarms and even begins automatically optimizing the devices that caused them. In a single solution, SOC operations can reduce time between detection and response, prevent alarm fatigue, reduce manual tasks, and enable operators to spend their time proactively resolving real alarms.
Governance: Operators working inside a SOC are responsible for real-time monitoring, detecting, investigating, and responding to threat events. We would like to believe these operators are doing everything they can to prevent security breaches and other dangerous events from escalating, however, that is not always the case. Human error and aforementioned alarm fatigue introduce the opportunity for less-than-ideal security outcomes. The good news is that operators generate substantial amounts of data themselves including MTTA (Median Time to Acknowledge Alarms), MTTR (Median Time to Resolve Alarms), Unacknowledged Alarms, Critical Alarms, and more. Unused, this data results in a reactive approach to SOC operations. But with Vector Flow’s SOC Governance Manager, the data produced by your SOC teams are transformed into actionable improvement plans for remediation. Our modern machine learning technology automates the auditing of each alarm and each response to help SOC supervisors determine if the alarm responses and investigation are done correctly and lets them analyze process issues at the individual operator level to identify training opportunities.
Device Maintenance: Security systems are complex, made up of potentially thousands of connected IoT devices. These devices are in a constant state of flux, with an unexpected device or network outages, firmware expirations, devices not behaving normally, power outages, devices approaching end-of-life, and additional challenges, many of which contribute directly to false alarms. Dispatching personnel to locate these faulty devices, identify the root cause, and provide remedial action on the scale required of SOC operations is all but impossible. Traditional SOC operators and managers also lack a single source of truth from which they can manage system health.
With experts predicting that more than 75 billion IoT devices will be connected to the web by 2025, now is the time to address these problems head-on. Vector Flow’s SOC Predictive Device Maintenance Manager autonomously finds trends in devices’ health, performs risk and criticality assessments, identifies failure modes, and automatically creates service tickets if repair is needed. The intelligent, AI-powered Recommendation Engine provides detailed, data-driven remediation instructions to help service technicians know what parts are needed and where the device is located, enabling them to fix the device more efficiently. Not only does this eliminate business disruptions and the associated risks (i.e., a critical surveillance camera in downtime), but also dramatically reduces repair costs.
Closing Thoughts
As we wrap up our series on data-driven automation, it is important to note that when we talk about automation the goal is not to remove or replace human operators. Rather, it is about empowering the human capital that is available with fact-based, data-driven insights that ultimately improve their effectiveness. Vector Flow’s automation solutions offload low-priority and repetitive tasks from system operators so personnel can focus on higher-value tasks and deliver additional services. In turn, there is less opportunity for error and more defined processes that deliver better physical security outcomes.
Data-driven automation is also not just a trending topic, but instead a meaningful and lasting approach to physical and cyber security. What were once high-level theoretical discussions surrounding data mining and AI are now our reality. This brings us back to the original question asked in this series: “Will we be talking about data-driven security in five years?”. I say, not only will we be talking about it in five years, those actually using it will be lightyears ahead of their competition in the way they prevent and respond to security events.
We understand that starting on your own data-driven automation can seem daunting. Vector Flow’s solutions are designed to deliver quick time-to-value with results available within minutes, not days or weeks. Our team of experts is highly knowledgeable, and our solutions have been proven in partnership with some of the world’s leading Fortune 1,000 companies. Contact us today to see how our data-driven solutions can deliver true value to your enterprise operation.
