False positives — when a security system flags an event as a potential threat when in reality it is not — are a major problem in the field of cybersecurity. In fact, it is estimated that the majority of security alerts are false positives, which is incredibly disruptive to an organization, leading to wasted time, resources and even missed real threats. Ultimately, this can lead to “alert fatigue” and can even cause turnover and internal friction within an organization. Recent research by Panther Labs found that 80% of security engineers feel some level of burn out, with 67% of them actively looking for a new job in the next 12 months.
The problem of inordinate amounts of false positives is rooted in a couple key areas. First, the increasing complexity of security systems can make it difficult to differentiate between real threats and false alarms. Combine that complexity with outdated or legacy security systems and false positives can happen due to outdated algorithms or techniques.
How to fix this problem? Simple: reduce false positives to net zero. By eliminating false positives, security teams can focus on real threats and not waste time and resources on investigating fake ones. This is especially important in today’s fast-paced, digital environment, where security teams are inundated with cloud security alerts on a daily basis. In fact, 59% of respondents in a recent survey say they receive more than 500 public cloud security alerts per day! With such a high volume of alerts, it is easy to see how critical alerts can be missed (which is a problem that 55% of respondents said they experience on a weekly or even daily basis).
Here are some actionable methods you can employ to reduce false positives in your security program:
- Start by regularly tuning your security systems to help reduce the number of false positives generated. Begin by analyzing the false positives that were generated and look for common patterns. Review the configuration settings and ensure the thresholds for alerts are set correctly. Update the whitelists to reduce the number of false positives that are triggered when legitimate activity occurs.
- Improve the quality and accuracy of security analysis to reduce the number of false positives. Improving correlation to help identify patterns in security events and correlate them with other events to identify real threats. Work with your preferred vendor to ensure all patches are made to your security solutions. Vendors may also have best practices and recommendations for tuning their solutions to reduce false positives. After the updates are done, you need to test and ensure that the application behavior hasn’t been affected.
- Deploying advanced technologies can help to improve the accuracy of security systems and reduce false positives to net zero. Look at any rule that you were having an issue on false positives with or that’s not within your threshold of tolerance. Security-as-Code rules are human readable and don’t require redeployments or restarts to take effect – simplify choose the rule you want to deploy, the confines of the rule, and press save. Due to the security being applied in the running application, there’s no room for bad actors to bypass and the protection is instantaneous.
It is more important than ever to take steps to reduce the impact of false positives to protect your organization from real threats. Reducing false positives to zero obviously reduces the overall noise and workload on security teams. This can lead to better focus and attention to detail, which can ultimately lead to a stronger and more effective security posture. Additionally, when all security alerts are real, it can help to improve the psyche of employees. With so many false positives, it can be easy to become jaded and cynical about security alerts. When all alerts are real, the security team can operate with confidence and other employees can trust that their actions won’t jeopardize the organization.
