Report Summary – Achieving High-Fidelity Security

The “High-Fidelity” research project was created to understand more about organizations’ data collection and use habits with regard to security. Specifically, the research focused on the collection and use of network and endpoint data and examined how these data types are used individually and in tandem to create an information stream that provides high-value telemetry to its users about their environments.

Both network and endpoint data can be highly valuable in identifying threats from breaches (incursions into a secured environment) and compromises (the extraction of private/sensitive data or information) as well as malicious and negligent insider activities. However, these two data sources have their own strengths and weaknesses. Endpoints may suffer from inoperative/inoperable agents or a lack of deployment. Network segments may not have monitoring systems turned on or even installed, or their log detail and collection settings may not be high enough to provide sufficient detail.

Even in the cases where both network and endpoint data sources are active and operating as designed, neither data type is perfect for all use cases. But together network and endpoint data create a greater visibility than either can individually. Here the whole is truly greater than the sum of its parts.

This report outlines issues with data collection and use and shows how these gaps can impact an organization’s ability to maintain high-fidelity security.