Exploring the Convergence of Observability and Security - Part 4: Dashboards
June 08, 2023

Pete Goldin
APMdigest

Share this

With input from industry experts — both analysts and vendors — this 8-part blog series will explore what is driving the convergence of observability and security, the challenges and advantages, and how it may transform the IT landscape.

Start with: Exploring the Convergence of Observability and Security - Part 1

Start with: Exploring the Convergence of Observability and Security - Part 2: Logs, Metrics and Traces

Start with: Exploring the Convergence of Observability and Security - Part 3: Tools

In Part 3 of this blog series, most experts concurred that observability and security tools should be combined, or at least integrated. Interestingly, some experts say that — although convergence is happening, and sharing the data has great value — the security dashboards should not necessarily be combined with observability dashboards for ITOps, NetOps or DevOps.

"I think security and ops will need different dashboards — security staff and operations staff are asking different questions about similar data," Mike Loukides, VP of Emerging Tech Content at O'Reilly Media predicts.

"Are there intruders on the site?" isn't the same as "Is the load too high on server 7 in the Amsterdam colo?" At a minimum, they will remain distinct specialties, with their own tools and dashboards, Loukides says.

Roger Floren, Principal Product Manager at Red Hat suggests that there may be challenges with combining security and observability dashboards. "Using a single platform will ensure the data to be consistent and up-to-date. This will lead to more actionable insights for security and observability. On the other hand the integration challenges to bring this together can be complex and time consuming, leading to compatibility issues and vendor lock-in. You would also risk some feature trade-offs."

Ajit Sancheti, GM, Falcon LogScale at CrowdStrike explains that DevOps, ITOps and SecOps teams will likely want their own dashboards and views of data. Each team will care about different priorities, such as threats, resource utilization or VM health monitoring, and their individual dashboards will reflect their areas of interest.

Dashboards Converging Over Time

Over time, we will see combined dashboards for security, ITOps, NetOps and DevOps, according to other experts.

"As NetOps, SecOps, and DevOps come together, having tools that can integrate both log data and network-derived intelligence into a single interface or dashboard will provide the deep observability they require to enhance business agility, ensure cloud security, and contain hybrid cloud cost and complexity," says Chaim Mazal, Chief Security Officer at Gigamon.

Colin Fallwell, Field CTO of Sumo Logic agrees, "I do see more convergence happening here. DevOps and SRE teams are interested in overlaying security data, intel threat feeds and such, and security teams are seeing the value in operational metrics and top-level application health."

Ideally, merging security and observability should include the dashboards, given they provide a clear visual of application health and availability, and provide flexibility to enable security information from the application to also be integrated to broader reaching SEIM tools as well, Gregg Ostrowski, CTO Adviser at Cisco AppDynamics concludes. "To take full advantage of application monitoring with observability and security insights, customizable dashboards are a great way to extend visibility and support cross-team collaboration, showcasing all the performance data in one place."

Different Organizations Have Different Needs

Prashant Prahlad, VP of Cloud Security Products at Datadog believes the level of dashboard convergence depends on the organization. "Dashboards may converge, but it depends on the size and maturity levels of the teams involved. At startups and smaller organizations where there is no centralized security function, you will likely see the same dashboards used for security and operations. But as organizations mature and security becomes a central function, dashboards may separate."

"In even more advanced organizations, however, the reverse may start happening where centralized security dashboards exist but security starts becoming part of the operations dashboards to provide more context to DevOps or SecOps teams for remediation efforts."

Shamus McGillicuddy, VP of Research, Network Infrastructure and Operations, at Enterprise Management Associates (EMA) says, "Some dashboards will be converged, usually the ones used for tier 1 response and event management. But tier 2 and tier 3 support will involve specialists with siloed dashboards and specialized tools."

McGillicuddy suggests that convergence of tools will depend on the individual organization. "Users/owners of security tools and users/owners of observability tools have very different skillsets, processes, and cultures. These differences will present barriers to converging on shared tools. However, some organizations will welcome this, especially smaller ones that have fewer silos and more IT generalists than specialists. NetOps teams have told me that they want more security insights in their network observability solutions, but not necessarily because they're sharing those tools with the cybersecurity team. They simply want more context."

Use the player or download the MP3 below to listen to EMA-APMdigest Podcast Episode 2 — Shamus McGillicuddy talks about Network Observability, the convergence of observability and security, and more.

Click here for a direct MP3 download of Episode 2 - Part 1

Similarly, Asaf Yigal, CTO of Logz.io feels that different teams, or even unique use cases, will probably always demand unique dashboards for specific workflows that drive a related response, such as monitoring app performance, threat detection, and prioritization of alerts. Even within a shared observability and security platform, there will be unique UIs for monitoring uptime of applications services versus monitoring and alerting of threats, such as with a SIEM.

Yet, driven by the convergence of data as well as security and performance issues, the overlap of something like a threat that causes an outage somewhere in the apps or infrastructure clearly illustrates increasing value in some shared dashboards, such as top-level overviews or home pages where there is some percolating up of all of this data.

"For the immediate future, we think that there is a need for dashboarding to support every variant of this work," Yigal says. "This is where customization also plays a key role to support the unique makeup of every team and organization. In the long term, there will be more and more crossover."

"Dashboards have not yet converged, however, when they begin to, they should be more elastic to the needs of the business and not determined by third parties," Jam Leomi, Lead Security Engineer at Honeycomb advises. "Each business should determine what its specific needs are to create custom and flexible dashboards for effective observability. To emphasize, observability is all about the efficiency of the business doing it and should be specific to engineering and business priorities."

Go to: Exploring the Convergence of Observability and Security - Part 5: Teams

Pete Goldin is Editor and Publisher of APMdigest
Share this

The Latest

June 20, 2024

The total cost of downtime for Global 2000 companies is $400 billion annually — or 9% of profits — when digital environments fail unexpectedly, according to The Hidden Costs of Downtime, a new report from Splunk ...

June 18, 2024

With the rise of digital transformation and the increasing reliance on applications for business operations, the need for application performance management (APM) has become more critical ... This blog explains what APM is all about, its significance and key features ...

June 17, 2024

Generative AI (GenAI) has captured significant attention by redefining content creation and automation processes. Despite this surge in GenAI's popularity, it's crucial to highlight the continuous, vital role of machine learning (ML) in underpinning crucial business functions. This era is not about GenAI replacing ML; rather, it's about these technologies collaborating to supercharge intelligent automation across industries ...

June 13, 2024

As organizations continue to navigate their digital transformation journeys, the need for efficient, secure, and scalable data movement strategies has never been more critical ... In an era when enterprise IT landscapes are continually evolving, the strategic movement of data has become a cornerstone of maintaining agility, competitive edge, and operational efficiency ...

June 12, 2024

In May, New Relic published the State of Observability for IT and Telecommunications Report to share insights, statistics, and analysis on the adoption and business value of observability for the IT and telecommunications industries. Here are five key takeaways from the report ...

June 11, 2024
Over the past decade, the pace of technological progress has reached unprecedented levels, where fads both quickly rise and shrink in popularity. From AI and composability to augmented reality and quantum computing, the toolkit of emerging technologies is continuing to expand, creating a complex set of opportunities and challenges for businesses to address. In order to keep pace with competitors, avoiding new models and ideas is not an option. It's critical for organizations to determine whether an idea has transformative properties or is just a flash in the pan — a challenge tackled in Endava's new 2024 Emerging Tech Unpacked Report ...
June 10, 2024

The rapidly evolving nature of the industry, particularly with the recent surge in generative AI, can catch firms off-guard, leaving them scrambling to adapt to new trends without the necessary funds ... This blog will discuss effective strategies for optimizing cloud expenses to free up funds for emerging AI technologies, ensuring companies can adapt and thrive without financial strain ...

June 06, 2024

Software developers are spending more than 57% of their time being dragged into "war rooms" to solve application performance issues, rather than investing their time developing new, cutting-edge software applications as part of their organization's innovation strategy, according to a new report from Cisco ...

June 05, 2024

Generative Artificial Intelligence (GenAI) is continuing to see massive adoption and expanding use cases, despite some ongoing concerns related to bias and performance. This is clear from the results of Applause's 2024 GenAI Survey, which examined how digital quality professionals use and experience GenAI technology ... Here's what we found ...

June 04, 2024

Many times customers want to know why their measured performance doesn't match the speed advertised (by the platform vendor, software vendor, network vendor, etc). Assuming the advertised speeds are (a) within the realm of physical possibility and obeys the laws of physics, and (b) are real achievable speeds and not "click-bait," there are at least ten reasons for being unable to achieve advertised speeds. In situations where customer expectations and measured performance don't align, use the following checklist to help determine the reason(s) why ...