Observability's role in mitigating IT security risks

How observability expands security visibility and early detection

Observability surpasses network security by providing granular visibility and insight into what is happening in networks, containers, applications and other infrastructure. It does this by analyzing logs, metrics, transactions and system behavior to uncover abnormal or suspicious activity. It complements alert-driven monitoring with behavior-driven observability to improve detection accuracy.

Observability can also expand the scope of what IT security teams can research.

For instance, past practice had enterprises relying on security monitoring vendors to inform them about what is likely to become future cybersecurity threats and how to be ready for them. Today, however, a growing number of enterprises are doing some of this future-looking research themselves with the help of observability tools.

These enterprises are often in highly sensitive industries, such as military and defense, telecommunications, healthcare and finance. They proactively research the external cybersecurity landscape using observability tools to identify the most likely "next big thing" for bad actors.

Observability can also report at granular levels on network health and can predict where network problems and security incidents are most likely to occur in the future. It is at these future "break points" that malicious code often enters. With the advanced intelligence observability provides, IT can proactively seal off these break points before anything adverse happens, thanks to observability predictions.

Strengthening incident response, mitigation and forensics

Because of the granular visibility that observability provides, IT can accelerate investigation, triage, containment and coordination during security incidents. This enables detailed forensics and root cause analysis.

With observability tools, network professionals can perform forensics after a cyberattack, inspecting layer after layer of system and event logs to determine how, when and why a breach occurred, and then take steps to prevent it from happening again.

Orchestrating security, observability and IT operations tools

The challenge for IT will be to integrate observability platforms with existing security and IT tools to create a shared, real-time visibility of network and system events.

The integration of observability and traditional network monitoring will require revisions to IT security and network management practices. It will also require retraining personnel as IT builds end-to-end workflows that support detection, response, recovery and collaboration on security and networks, incorporating the best elements of both network monitoring and observability.

Skills, collaboration and readiness for modern IT operations

Observability will equip IT to both fight and anticipate security attacks, but the tools only help if IT has the requisite skills to use them.

To capitalize on observability, IT must use observability tracking, tracing and log reports to assess whether a new or revised application is failing the performance metrics set for it, whether it's consuming more resources than it should and whether a security or user authorization issue is causing the problem. Individual traces can also be performed on application logic and pathways, as well as on container event logs.

For the IT security staff, observability tools will detect system, network and container abnormalities at deep internal levels that standard network monitoring can't. In the worst-case scenarios, computer forensics experts can use observability tools in post-mortem exercises to discover how, why, when and where a particular security breach occurred.

The first step is to get IT security teams and network personnel upskilled in observability tools. Then, define the working relationship between monitoring and observability tools in the IT network security toolkit. For example, teams might use standard network monitoring for initial detection and resolution of security anomalies, then move to observability for more detailed research and to uncover hidden events affecting IT security, whether in the past, present or future.

Mary E. Shacklett is president of Transworld Data, a technology analytics, market research and consulting firm.