Improving threat detection with a detection development life cycle

Augusto Barros
Additional contact information
Augusto Barros: Securonix, USA

Cyber Security: A Peer-Reviewed Journal, 2021, vol. 5, issue 2, 113-125

Abstract: Threat detection is one of the main activities of an information security programme. Performing threat detection goes beyond deploying threat detection technologies. These technologies can be highly effective in their job of detecting threats, but their effectiveness is dependent on what detection specialists usually call detection content. Detection content is usually detached from the data analytics capabilities of the tool and needs to be constantly updated to ensure the most recent threats can be detected. These updates are generally developed by the detection technology provider as part of a subscription service, or by the organisation deploying and operating the technology, as part of activities commonly described as detection engineering. This paper describes the implementation and operation of a detection development life cycle (DDLC) process, which can be used to control the selection, creation and management of threat detection content.

Keywords: security information and event management (SIEM); detection engineering; detection use cases; detection content; detection development life cycle (DDLC) (search for similar items in EconPapers)
JEL-codes: M15 (search for similar items in EconPapers)
Date: 2021
References: Add references at CitEc
Citations:

Downloads: (external link)
https://hstalks.com/article/6677/download/ (application/pdf)
https://hstalks.com/article/6677/ (text/html)
Requires a paid subscription for full access.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:aza:csj000:y:2021:v:5:i:2:p:113-125

Access Statistics for this article

More articles in Cyber Security: A Peer-Reviewed Journal from Henry Stewart Publications
Bibliographic data for series maintained by Henry Stewart Talks ().