Security

5 Steps to Integrate a Business' Security Solutions

Security tools provide a wide range of capabilities, but their true power comes when you integrate them.

Mike Chapple is associate teaching professor of IT, analytics and operations at the University of Notre Dame.

Your organization probably has a diverse set of security tools working to help reduce your risk profile and combat active threats. You might have a vulnerability scanner seeking out unpatched systems, an intrusion prevention system monitoring network traffic, a firewall controlling the border, and a threat intelligence vendor feeding you current information about the adversary.

But how well do these tools work with each other? If you’re like many of us, these tools may exist in silos only to be linked together by the work of cybersecurity analysts. One of the best ways to quickly improve the efficiency of your team is to build integrations between security tools, allowing them to work in harmony while minimizing user intervention.

Let’s take a look at five things that you can do right now to better integrate your security tools.

1. Log and Monitor Security Systems Centrally

One of the quickest ways to improve your security posture is to centralize the collection and analysis of all the logs generated by your security tools.

If you don’t already have a security information and event management (SIEM) solution, adding one to your environment will do the trick. If you already have a SIEM in place, take an inventory of the tools sending it logs and see if you have an opportunity to expand its use.

2. Track Vulnerabilities with Tickets

Vulnerability scanners create a lot of work for engineers, developers, and managers throughout the organization. While a security team might be responsible for configuring and running scans, the issues these scans detect typically require that the system or application owner correct them.

Integrating your vulnerability scanner with your service ticketing system allows you to automatically open and assign tickets for new vulnerabilities and close them out when the issue is resolved.

3. Test Code Security Automatically During Deployment

Automated testing of code is an important part of the DevOps lifecycle. Developers typically submit their code to a deployment process that automatically runs tests to ensure that the code functions properly before releasing it into production. This is a great opportunity to inject automated security testing, allowing you to block the deployment of code that fails to pass baseline security testing.

4. Feed Threat Intelligence to Your Firewall

Threat intelligence vendors collect tons of information on potential adversaries and share it with their clients to help build a robust defensive posture.

In addition to informative research reports, threat intelligence products often include an automated feed of known malicious IP addresses. Feed this information directly to your firewall or intrusion prevention system and automatically block malicious hosts as soon as they’re detected on the internet.

5. Integrate Cloud Infrastructure Security Tools

As your organization moves to the cloud, be sure that you’re also thinking about integrating those cloud environments with your security toolset. For example, many cloud-centric organizations choose to use a cloud infrastructure security monitoring tool, such as Evident.io, CloudLock, or Dome9.

When you configure these tools, set them up to feed information directly into your SIEM for single-pane-of-glass monitoring. You may also wish to configure these tools to automatically open service tickets for high severity issues.