Devices generate an average of 10,000 security events per day

The number of security events sheds light on why recent high profile attacks go undetected for so long.


Devices in an average company's network are generating an aggregate average of 10,000 security events per day, with the most active generating around 150,000 events per day, a new report said.

In addition, large, globally-dispersed enterprises were averaging 97 active infected devices each day and leaking an aggregate average of more than 10GB of data per day, according to Damballa's Q1 2014 State of Infections Report, compiled from analysis of 50 percent of North American ISP Internet traffic and 33 percent of mobile traffic, plus large volumes of traffic from global ISPs and enterprise customers.

That is just one small indication showing how daunting it is for security staff to manually go through mountains of alerts in order to discover which (if any) constitute a real and present threat.

It also sheds light on why recent high profile attacks at organizations like Target ended up not detected for so long, since alerts don't equal infections. The only way to determine if a device has an infection is to correlate logged activity, which takes far too much time and man hours.

Advanced techniques such as Domain Generation Algorithms (DGA), used by threat actors to generate vast quantities of random domain names, can evade prevention controls and delay identification of actual infections. These techniques require security teams to wade through thousands of anomalous IP domains in order to find the IP address that carries the real payload.

In a test conducted by Damballa Labs, where "dirty" network traffic ended up replayed past more than 1,200 simulated endpoints, they were able to collect and correlate 538 pieces of evidence for each actual infection.

"We are already facing a profound scarcity of skilled security professionals, which the latest Frost & Sullivan figures estimate will equate to a 47 percent shortfall by 2017," said Brian Foster, CTO of Damballa. "If we compound this fact with the increase in data breaches and the scope of work required to identify a genuine infection from the deluge of security events hitting businesses every day, we can see why security staff are struggling to cope."

As previously stated, the enterprises studied averaged 97 infections daily. The ability to reduce the time spent to find these infected devices is significant. The Ponemon Institute reported it takes companies an average of nearly three months (90 days) to discover a malicious breach and four months or longer to resolve it.

The ability to reduce the time-to-discovery from 90 days to 1 day, across those 97 infected devices, would result in a savings of 89 man-days per device, or 8,633 man-days (23.65 years) per enterprise. Not only is this a tremendous saving in time, but it significantly shrinks the window of when an enterprise is vulnerable to that particular attack.

Gregory Hale is the editor and founder of Industrial Safety and Security Source (, a news and information website covering safety and security issues in the manufacturing automation sector. This content originally appeared on Edited by Brittany Merchut, Project Manager, CFE Media, bmerchut(at) 

No comments
The Top Plant program honors outstanding manufacturing facilities in North America. View the 2013 Top Plant.
The Product of the Year program recognizes products newly released in the manufacturing industries.
The Engineering Leaders Under 40 program identifies and gives recognition to young engineers who...
A cool solution: Collaboration, chemistry leads to foundry coat product development; See the 2015 Product of the Year Finalists
Raising the standard: What's new with NFPA 70E; A global view of manufacturing; Maintenance data; Fit bearings properly
Sister act: Building on their father's legacy, a new generation moves Bales Metal Surface Solutions forward; Meet the 2015 Engineering Leaders Under 40
Cyber security cost-efficient for industrial control systems; Extracting full value from operational data; Managing cyber security risks
Drilling for Big Data: Managing the flow of information; Big data drilldown series: Challenge and opportunity; OT to IT: Creating a circle of improvement; Industry loses best workers, again
Pipeline vulnerabilities? Securing hydrocarbon transit; Predictive analytics hit the mainstream; Dirty pipelines decrease flow, production—pig your line; Ensuring pipeline physical and cyber security
Upgrading secondary control systems; Keeping enclosures conditioned; Diagnostics increase equipment uptime; Mechatronics simplifies machine design
Designing positive-energy buildings; Ensuring power quality; Complying with NFPA 110; Minimizing arc flash hazards
Building high availability into industrial computers; Of key metrics and myth busting; The truth about five common VFD myths

Annual Salary Survey

After almost a decade of uncertainty, the confidence of plant floor managers is soaring. Even with a number of challenges and while implementing new technologies, there is a renewed sense of optimism among plant managers about their business and their future.

The respondents to the 2014 Plant Engineering Salary Survey come from throughout the U.S. and serve a variety of industries, but they are uniform in their optimism about manufacturing. This year’s survey found 79% consider manufacturing a secure career. That’s up from 75% in 2013 and significantly higher than the 63% figure when Plant Engineering first started asking that question a decade ago.

Read more: 2014 Salary Survey: Confidence rises amid the challenges

Maintenance and reliability tips and best practices from the maintenance and reliability coaches at Allied Reliability Group.
The One Voice for Manufacturing blog reports on federal public policy issues impacting the manufacturing sector. One Voice is a joint effort by the National Tooling and Machining...
The Society for Maintenance and Reliability Professionals an organization devoted...
Join this ongoing discussion of machine guarding topics, including solutions assessments, regulatory compliance, gap analysis...
IMS Research, recently acquired by IHS Inc., is a leading independent supplier of market research and consultancy to the global electronics industry.
Maintenance is not optional in manufacturing. It’s a profit center, driving productivity and uptime while reducing overall repair costs.
The Lachance on CMMS blog is about current maintenance topics. Blogger Paul Lachance is president and chief technology officer for Smartware Group.