According to the 2020 State of Security Operations report, 99% of security leaders have said that high alert volumes have caused problems for their security teams. Known as “alert fatigue”, this sense of being overwhelmed by the number of alerts received in any given day, to the point of becoming desensitized, can lead to major consequences.

In some cases, teams experience thousands, if not hundreds of thousands, of alarms per month, leading to loss of efficiency and staff burnout. When these symptoms set in, identifying and responding to legitimate threats becomes much more difficult and operators can easily overlook or dismiss important information. With over 70% of security professionals saying they have seen the volume of security alerts almost double since 2015, identifying and combating alert fatigue among team members should be a top priority for security leaders.

Here are five tactics to deploy within your SOC.

1. Have clear and actionable alarms
One of the biggest causes of alert fatigue is the operator’s inability to manage the volume of alarms coming into their SOC. When alarms are complex and don’t have clear action plans, the time to respond to each incident becomes painstakingly drawn out. According to the Cloud Alliance survey, 40% of analysts had a difficult time responding to alerts because there was no actionable information to investigate. When time is of the essence, a delayed response can detract from a successful outcome. Create clear, simple, and actionable alarms so that operators can quickly determine the criticality of each event and how to efficiently set forth a plan of action.

2. Prioritize the health of your system
Security systems frequently become products of disjointed actions over the years. As a result, the value of having a healthy system becomes overlooked or even unattainable. For those systems plagued with shunted alarms or faulty card readers, an environment of false positives or overactive alarms can drive operators to quickly become burned out. Conducting regular preventative maintenance testing and device testing will ensure devices are creating the right alerts at the right times. If you’re feeling overwhelmed with this process, start by looking to see if there is a pattern of false positives or if certain devices are generating more alarms than others.

3. Leverage automation to your benefit
In today’s world of security operations, it’s becoming increasingly impossible for humans alone to monitor the unprecedented amount of data that systems can generate. By leveraging automation, particularly in the form of artificial intelligence, teams can better filter through the noise and determine which alarms are legitimate and which can be consciously dismissed. These complex algorithms can be used to improve investigation speeds and response times without a heavy investment in additional personnel.

4. Create schedules to reduce false alarms during peak hours
If your systems experience an unusually high number of alarms during certain hours, creating a schedule to shunt low-priority alarms can lessen the burden on SOC teams. Consider separating perimeter doors from interior doors to create shunting schedules that will help your SOC reduce the number of false alarms during periods of high activity, such as employee arrival or lunchtime. For example, depending on the sensitivity of your systems, a long hold of a door could trigger an unnecessary alarm when large groups of people enter a building together. Compared to this same alarm after hours, a door held open for main entrances or primary doors is less concerning during regular business hours than its after-hours counterpart. Setting a schedule and defining parameters for these types of alarms can bring a sense of calmness to a SOC and focus operator time on monitoring and responding to alarms that present genuine threats during these times.

Alarm schedules aren’t the only application for reducing alert fatigue. Due to constant repetition and monotonous false alarms, alert fatigue can lead to operators becoming desensitized to alarms of all types. When this happens, it is more likely that a critical alarm could slip through the cracks. Creating schedules and task rotations for your people is also a great way to keep your operators alert and mentally engaged throughout the day.

5. Rely on outsourced support to fill gaps
Relying on a shared resource model, security operations as a service can provide full time or part time monitoring services for teams struggling to manage the number of alerts being filtered through their SOC. This type of outsourced security model acts as a force multiplier, bringing additional personnel, experience, and resources to the table. With more time to focus on what matters, alert fatigue is better managed and ultimately avoided.

The overall goal for teams combating alert fatigue is to dial down the noise and focus on the alarms that matter. With over 83% of surveyed security professionals identifying that their staff experiences alert fatigue, implementing these practices can help create a more efficient and safer environment within your company.

If you’re interested in learning more about how to implement these strategies or how an outsourced model could support your team, contact us at info@northlandcontrols.com.