REPORT

2022 Gartner® Magic Quadrant™ for APM and Observability Read the Report

DevOps and Security Glossary Terms

Glossary Terms
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Threat detection and response (TDR) - Definition & Overview

In this article
What is threat detection and response?
Five threat detection and response challenges
What threats are the focus of threat detection and response?
Sumo Logic supports threat detection in the cloud
What is threat detection and response?
Five threat detection and response challenges
What threats are the focus of threat detection and response?
Sumo Logic supports threat detection in the cloud

What is threat detection and response?

Threat detection is the ability of IT organizations to quickly and accurately identify threats to the network, applications or other assets within the network. Without the ability to recognize network intruders or other malicious adversaries in a timely fashion, IT security analysts have no hope of responding effectively to security events and effectively mitigating damage.

Key takeaways

  • Threat detection describes the ability of IT organizations to quickly and accurately identify threats to the network, applications, or other assets within the network.
  • The first step to an effective threat detection and response process is understanding what threats are present in the cyber environment.
  • Cybersecurity professionals face unprecedented challenges in threat detection and response: complex cloud environments, disconnected tool suites, staffing challenges.
  • There are many types of cybersecurity software solutions that can be deployed by enterprise IT organizations to support the timely detection of threats and help streamline or even automate the response.

Five threat detection and response challenges

Data breaches are becoming increasingly common, and with more IT organizations moving assets into the cloud, there is more opportunity than ever for bad actors to conduct successful cyber attacks. Here are the primary challenges cybersecurity professionals face:

Complex cloud environments

With most companies now using more than one cloud environment and the average company deploying as many as twenty separate applications into the cloud, it has become increasingly difficult for SecOps to maintain adequate oversight of enterprise cloud environments.

Perimeter focus

Many IT organizations focus too much of their effort and attention on attacks from the perimeter. There are two problems with this approach:

  1. The organization may have a great perimeter firewall but remains susceptible to vectors like phishing attacks that surpass perimeter firewalls.

  2. Once the perimeter is breached, the organization may lack the capability to detect an attack.

Too much focus on the perimeter of the network can create a false sense of security while assets within the network remain vulnerable.

Infinite arms race

IT organizations are part of an infinite arms race against cyber attackers. As IT organizations develop new threat detection and response capabilities, cyber attackers continue to develop new types of threats to circumvent detection systems.

Disconnected tool suite

IT organizations rely on a range of cybersecurity tools to assist with threat detection and response. While more than one software tool is needed to support effective threat detection, a disconnected tool suite with disparate components can make it difficult and time-consuming to track security events.

Staffing challenges

Industry data suggests that cybersecurity job growth it outpacing IT jobs overall. And yet, the industry faces a skill shortage when it comes to qualified cybersecurity professionals.


What threats are the focus of threat detection and response?

The first step to an effective threat detection and response process is understanding what threats are in the cyber environment. This shortlist covers several of the most common types, but there are more out there and new ones appear all the time.

Malware includes any malicious software program. Malware programs include spyware, viruses, trojan horse applications and other applications that can infect your computer or network, stealing sensitive information and otherwise wreaking havoc and chaos.

Phishing attacks trick the recipient into volunteering sensitive data. They usually consist of an email that requests the recipient to provide sensitive information. They may also include a link to a web page that has been spoofed to resemble a familiar site where the visitor might enter login information or other personal details.

Ransomware is a type of malware that locks or disables a computer and asks the user to pay to regain access.

A DDoS attack happens when a cyber attacker uses a network of remotely controlled computers to flood a website or network with traffic, usually in an attempt to disable the server.

A botnet is a network of infected computers. Some hackers realized that instead of writing a virus that makes your computer go haywire, they could write a program that makes your computer send spam emails to others with malicious attachments or participate in a DDoS attack. You may not even know that your machines are affected.

A blended threat uses multiple techniques and attacks vectors simultaneously to attack a system.

Zero-day threats are new threats that nobody has seen before. They result from the arms race between IT organizations and cyber attackers. Because they are brand new, zero-day threats are unpredictable and difficult to prepare for.

Advanced persistent threat (APT) a sophisticated cyber attack that includes long-term surveillance and intelligence gathering, punctuated by attempts to steal sensitive information or target vulnerable systems. APTs work best when the attacker remains undetected.


Sumo Logic supports threat detection in the cloud

Just as cyber attackers may deploy a range of threats to target security vulnerabilities within a cloud infrastructure, IT organizations can leverage a variety of software tools and applications threat intelligence. These include, but are not limited to:

  • Cloud access and security brokers (CASB)

  • Endpoint detection and response

  • Intrusion detectionprevention systems (IDS/IPS)

  • Perimeter and application firewalls

  • Threat intelligence platforms

Sumo Logic's cloud-native platform helps IT organizations expand their threat detection and response capabilities for cloud environments. With Sumo Logic, IT organizations can:

  1. Collect and aggregate security event data from a broad range of security software solutions into a single unified system

  2. Parse security logs with data analysis driven by machine learning and pattern recognition algorithms

  3. Automate the discovery of trends and patterns that could indicate a security event while cross-referencing data with the newest threat intelligence from CrowdStrike

  4. Configure alerts to cyber security professionals when a threat is detected, ensuring a timely human review and response

  5. Program automated threat responses to begin damage mitigation and system restoration immediately when a threat is discovered

  6. Quickly perform root cause analysis and patch vulnerabilities

Sumo Logic helps IT organizations move away from reactive IT security and proactively shield their cloud deployments from malicious cyber attacks.

Complete visibility for DevSecOps

Reduce downtime and move from reactive to proactive monitoring.