Overreliance on Detection Solutions in Security Stacks

The typical approach to detection used by organizations is to employ a variety of methods, such as antivirus software, sandbox engines, extensive data analysis, and anomaly detection, among others. This depends on the organization. Through monitoring and spotting, these technologies seek to discover and eliminate any malicious code or malware that might reach an endpoint and be executed by it. 

The only way to believe in the effectiveness of detection solutions is to see them in action. In the absence of detecting a threat, how are you supposed to know whether it is a threat or not? This is a fundamental principle that defines the foundation of such technologies. After the detection of a threat on the network, this involves searching for it, taking action against it, and moving to isolate and neutralize it. This is done as soon as the threat is confirmed. There are several problems associated with this approach.  

A detection solution is generally focused on identifying what is malicious and benign, which results in them having similar limitations as viruses. These methodologies can indeed produce false positives and negatives. Layering these technologies on top of each other can be very expensive. 

It is also imperative to note that relying solely on detection puts

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.