Gartner发布2024年安全运营成熟度曲线：改变安全运营策略、能力和效果的23项技术发展趋势

网络安全

需积分: 5 148 浏览量 2024-08-01 09:42:00 上传评论收藏 1.27MB PDF 举报

资源推荐

资源详情

资源评论

Gartner, Inc. | G00810451 Page 1 of 81

Hype Cycle for Security Operations, 2024

29 July 2024 - ID G00810451 - 92 min read

By Analyst(s): Jonathan Nunez, Andrew Davies

Initiatives: Security Operations; Meet Daily Cybersecurity Needs

Security operations technology and services defend IT/OT

systems, cloud workloads, applications and other digital assets

from attack by identifying threats, vulnerability and exposures.

This Hype Cycle helps security and risk management leaders

strategize and deliver SecOps capability and functions.

SRM leaders continue to sharpen their threat detection and response efforts. This year’s

Hype Cycle features signiﬁcant movement for identity threat detection and response

(ITDR), extended detection and response (XDR) and co-managed monitoring services.

SRM leaders are called to action to fortify digital identities and identity infrastructure

using ITDR products and services. Those that have already implemented these

technologies should look to integrate ITDR outcomes into the SOC for improved threat

detection (see 5 Initiatives to Move Toward Security Operations Excellence).

A substantial subset of organizations face challenges with organizing their threat

detection, investigation and response (TDIR) function. Security information and event

management (SIEM) is a mature technology, and recent market shake-ups have created

uncertainty (see Quick Answer: How to React to Recent SIEM M&A Announcements).

Smaller organizations aim at preconﬁgured technologies that accelerate time to value,

using a predeﬁned set of analytics, prebuilt automation and some out-of-the-box response

capabilities. XDR providers promise to deliver that, and are adding AI assistants to make it

even easier for anyone to get information from the tools.

Enterprises look for partners that can help them handle greater customizability. Co-

managed monitoring services providers offer more ﬂexibility in terms of technologies and

service augmentation, allowing customers to directly contribute to operational

performance and outcomes. Managed detection and response (MDR) providers add

managed incident response for organizations that cannot — or are not willing to —

support this function internally.

This research note is restricted to the personal use of liuyang17@qianxin.com.

Gartner, Inc. | G00810451 Page 2 of 81

Continuous Threat Exposure Management

A number of new proﬁles appear on this Hype Cycle this year, reﬂecting evolving

vulnerability and exposure management approaches, more aligned with the continuous

threat exposure management (CTEM) framework:

CTEM is a program helping organizations to improve their maturity when they govern and

operationalize the ﬁve recommended phases of exposure management: scoping,

discovery, prioritization, validation and mobilization.

Threat exposure management entered the Hype Cycle last year. Its proﬁle represents a

broader domain, encompassing innovations in processes such as the CTEM approach.

Exposure assessment platforms and adversarial exposure validation solutions are

examples of technology platforms that could be used to execute against threat exposure

management programs. Organizations should employ proper governance and

repeatability to make their threat exposure management programs continuous (see Top

Strategic Technology Trends for 2024: Continuous Threat Exposure Management).

Exposure assessment platforms aim to consolidate vulnerability assessment and

vulnerability prioritization technologies all in one platform. This affords the end user

greater simplicity and potentially greater efﬁcacy in discovering their relevant attack

surfaces, optimizing exposure prioritization and providing greater ﬂexibility in

mobilization.

Adversarial exposure validation technologies offer offensive security technologies

simulating threat actor tactics, techniques and procedures to validate the existence of

exploitable exposures and test security control effectiveness. Within this proﬁle, Gartner

has consolidated breach attack simulation and autonomous penetration testing and red

teaming.

Evaluating the Hype Cycle

Some key recommendations for evaluating this year’s Hype Cycle:

Threat exposure management

■

Exposure assessment platforms

■

Adversarial exposure validation

■

This research note is restricted to the personal use of liuyang17@qianxin.com.

Gartner, Inc. | G00810451 Page 3 of 81

Innovation Trigger

This year’s Innovation Trigger is a call to action for SRM leaders to play a larger role in

transformational security initiatives and be more inﬂuential in optimizing existing security

investments. While transformational initiatives like cybersecurity mesh architecture

(CSMA) and CTEM are on the horizon for some, we recommend making incremental shifts

early on the journey, leveraging technology and service consolidation and automation

opportunities, reducing time to value and administrative overhead.

Greater emphasis is being put on achieving a higher degree of threat detection

performance and faster incident response. To do this, more data is often required to

broaden visibility, enabling detections across technology and business domains. However,

stafﬁng and budget limitations are key impediments preventing organizations from

meeting these objectives. Gartner recommends considering technologies that can reduce

data management costs, like those noted in the telemetry pipelines proﬁle, as well as

scaling operational efﬁciency by leveraging cybersecurity AI assistants.

Peak of Inflated Expectations

Enterprises are aiming to gain visibility of expanding attack surfaces (CPS security, threat

exposure management, cyber asset attack surface management) and test the resilience of

technology domains (penetration testing as a service). Reﬁning their requirements before

going to market can help to avoid unrealistic expectations promoted by vendor marketing

teams. Market capabilities expand and contract; stay aligned with your requirements to

avoid false hype.

Trough of Disillusionment

Consider the objectives and initial steps of transformational initiatives like CSMA to

anticipate long-term evolutions of the security operation function.

■

Initiate tactical or more profound threat exposure management initiatives based on

your current vulnerability management program maturity.

■

Apply rigorous governance of SecOps requirements to ﬁght the marketing noise

around unproven capabilities.

■

Test provider technology and service delivery for assurances of performance

outcomes.

■

Evaluate AI cybersecurity assistants for operational efﬁciency gains and skills

augmentation.

■

This research note is restricted to the personal use of liuyang17@qianxin.com.

剩余85页未读，继续阅读

评论收藏

内容反馈

lurenjia404

粉丝: 5448
资源: 176

Gartner发布2024年安全运营成熟度曲线：改变安全运营策略、能力和效果的23项技术发展趋势

Gartner发布2024年应用安全成熟度曲线：26项应用安全最新技术发展及应用状况和趋势.pdf

Gartner发布2024年中国安全技术成熟度曲线：17项网络安全技术发展和应用现状及趋势.pdf

Gartner发布2024年数据安全成熟度曲线：人工智能和量子计算驱动的32项数据安全相关技术发展变化 全文

Gartner发布2024年终端和工作空间安全成熟度曲线：24项相关技术发展和应用状况及趋势.pdf

Gartner发布2024年人工智能技术成熟度曲线：29项决定人工智能领域发展方向的前沿和趋势性技术（全文）

Gartner发布2023年中国ICT技术成熟度曲线：数字化目标改变带来的25项IT和安全技术应用和发展趋势

Gartner发布2024年网络风险管理成熟度曲线：使网络安全战略与业务目标保持一致的概念、方法、流程和技术

2021-2023年中型企业新兴技术路线图

通信行业AI视觉与语音专题分析报告：人工智能‘视’‘听’盛宴来临-20190319-国金证券-23页.pdf

相关实用应用程序（Windows可用）

李飞飞自传 我看见的世界 The World I see

ChatGPT使用总结：150个ChatGPT提示词模板（完整版）

全国计算机二级WPSoffice精选350道选择题题库（含答案）.pdf

Visio2013 安装包及破解方法

bppid BP神经网络 PID控制 simulink仿真 基于S函数.m文件的BP神经网络 可以运行出结果，有说明文档跟对应文章，包括一篇基于bppid的无刷直流电机控制的本科lunwen，很容易看

交流微电网仿真模型(包含PCS) 储能变流器PCS光伏交流微网三相并网 三相光伏微电网交流微电网储能PCS 个人学习笔记和建模笔记 仿真主要包含光伏＋boost、蓄电池储能系统、储能变流器PCS、三

DBeaver 序列码， DBeaver Ultimate 24.3.0 可用

哈尔滨工业大学-ChatGPT调研报告-2023.3.6-94页.pdf

eetop.cn-07-1射频电路设计理论与应用-王子宇 -课后答案1-10章

学术海报模板+论文科研+研究生

4个亲测好用的ChatGPT4渠道

车载毫米波雷达DOA估计综述博文仿真代码

ST语言规则编程手册全面讲解ST语言

visio2021-64位.7z

python大作业 含爬虫、数据可视化、地图、报告、及源码（2016-2021全国各地区粮食产量）.rar

chromedriver-win64.zip

ST-LINK Utility 4.6.0

软件著作权参考材料-模板

The Worlds I See 我看见的世界【Fei-Fei-Li 李飞飞】

基于Matlab的模糊PID温度控制系统仿真 代码仿真

最新资源

Gartner发布2024年数据安全成熟度曲线：人工智能和量子计算驱动的32项数据安全相关技术发展变化全文

李飞飞自传我看见的世界 The World I see

bppid BP神经网络 PID控制 simulink仿真基于S函数.m文件的BP神经网络可以运行出结果，有说明文档跟对应文章，包括一篇基于bppid的无刷直流电机控制的本科lunwen，很容易看

交流微电网仿真模型(包含PCS) 储能变流器PCS光伏交流微网三相并网三相光伏微电网交流微电网储能PCS 个人学习笔记和建模笔记仿真主要包含光伏＋boost、蓄电池储能系统、储能变流器PCS、三

python大作业含爬虫、数据可视化、地图、报告、及源码（2016-2021全国各地区粮食产量）.rar

基于Matlab的模糊PID温度控制系统仿真代码仿真