Exploring the Convergence of Observability and Security - Part 4: Dashboards
June 08, 2023

Pete Goldin
APMdigest

Share this

With input from industry experts — both analysts and vendors — this 8-part blog series will explore what is driving the convergence of observability and security, the challenges and advantages, and how it may transform the IT landscape.

Start with: Exploring the Convergence of Observability and Security - Part 1

Start with: Exploring the Convergence of Observability and Security - Part 2: Logs, Metrics and Traces

Start with: Exploring the Convergence of Observability and Security - Part 3: Tools

In Part 3 of this blog series, most experts concurred that observability and security tools should be combined, or at least integrated. Interestingly, some experts say that — although convergence is happening, and sharing the data has great value — the security dashboards should not necessarily be combined with observability dashboards for ITOps, NetOps or DevOps.

"I think security and ops will need different dashboards — security staff and operations staff are asking different questions about similar data," Mike Loukides, VP of Emerging Tech Content at O'Reilly Media predicts.

"Are there intruders on the site?" isn't the same as "Is the load too high on server 7 in the Amsterdam colo?" At a minimum, they will remain distinct specialties, with their own tools and dashboards, Loukides says.

Roger Floren, Principal Product Manager at Red Hat suggests that there may be challenges with combining security and observability dashboards. "Using a single platform will ensure the data to be consistent and up-to-date. This will lead to more actionable insights for security and observability. On the other hand the integration challenges to bring this together can be complex and time consuming, leading to compatibility issues and vendor lock-in. You would also risk some feature trade-offs."

Ajit Sancheti, GM, Falcon LogScale at CrowdStrike explains that DevOps, ITOps and SecOps teams will likely want their own dashboards and views of data. Each team will care about different priorities, such as threats, resource utilization or VM health monitoring, and their individual dashboards will reflect their areas of interest.

Dashboards Converging Over Time

Over time, we will see combined dashboards for security, ITOps, NetOps and DevOps, according to other experts.

"As NetOps, SecOps, and DevOps come together, having tools that can integrate both log data and network-derived intelligence into a single interface or dashboard will provide the deep observability they require to enhance business agility, ensure cloud security, and contain hybrid cloud cost and complexity," says Chaim Mazal, Chief Security Officer at Gigamon.

Colin Fallwell, Field CTO of Sumo Logic agrees, "I do see more convergence happening here. DevOps and SRE teams are interested in overlaying security data, intel threat feeds and such, and security teams are seeing the value in operational metrics and top-level application health."

Ideally, merging security and observability should include the dashboards, given they provide a clear visual of application health and availability, and provide flexibility to enable security information from the application to also be integrated to broader reaching SEIM tools as well, Gregg Ostrowski, CTO Adviser at Cisco AppDynamics concludes. "To take full advantage of application monitoring with observability and security insights, customizable dashboards are a great way to extend visibility and support cross-team collaboration, showcasing all the performance data in one place."

Different Organizations Have Different Needs

Prashant Prahlad, VP of Cloud Security Products at Datadog believes the level of dashboard convergence depends on the organization. "Dashboards may converge, but it depends on the size and maturity levels of the teams involved. At startups and smaller organizations where there is no centralized security function, you will likely see the same dashboards used for security and operations. But as organizations mature and security becomes a central function, dashboards may separate."

"In even more advanced organizations, however, the reverse may start happening where centralized security dashboards exist but security starts becoming part of the operations dashboards to provide more context to DevOps or SecOps teams for remediation efforts."

Shamus McGillicuddy, VP of Research, Network Infrastructure and Operations, at Enterprise Management Associates (EMA) says, "Some dashboards will be converged, usually the ones used for tier 1 response and event management. But tier 2 and tier 3 support will involve specialists with siloed dashboards and specialized tools."

McGillicuddy suggests that convergence of tools will depend on the individual organization. "Users/owners of security tools and users/owners of observability tools have very different skillsets, processes, and cultures. These differences will present barriers to converging on shared tools. However, some organizations will welcome this, especially smaller ones that have fewer silos and more IT generalists than specialists. NetOps teams have told me that they want more security insights in their network observability solutions, but not necessarily because they're sharing those tools with the cybersecurity team. They simply want more context."

Use the player or download the MP3 below to listen to EMA-APMdigest Podcast Episode 2 — Shamus McGillicuddy talks about Network Observability, the convergence of observability and security, and more.

Click here for a direct MP3 download of Episode 2 - Part 1

Similarly, Asaf Yigal, CTO of Logz.io feels that different teams, or even unique use cases, will probably always demand unique dashboards for specific workflows that drive a related response, such as monitoring app performance, threat detection, and prioritization of alerts. Even within a shared observability and security platform, there will be unique UIs for monitoring uptime of applications services versus monitoring and alerting of threats, such as with a SIEM.

Yet, driven by the convergence of data as well as security and performance issues, the overlap of something like a threat that causes an outage somewhere in the apps or infrastructure clearly illustrates increasing value in some shared dashboards, such as top-level overviews or home pages where there is some percolating up of all of this data.

"For the immediate future, we think that there is a need for dashboarding to support every variant of this work," Yigal says. "This is where customization also plays a key role to support the unique makeup of every team and organization. In the long term, there will be more and more crossover."

"Dashboards have not yet converged, however, when they begin to, they should be more elastic to the needs of the business and not determined by third parties," Jam Leomi, Lead Security Engineer at Honeycomb advises. "Each business should determine what its specific needs are to create custom and flexible dashboards for effective observability. To emphasize, observability is all about the efficiency of the business doing it and should be specific to engineering and business priorities."

Go to: Exploring the Convergence of Observability and Security - Part 5: Teams

Pete Goldin is Editor and Publisher of APMdigest
Share this

The Latest

September 21, 2023

Companies implementing observability benefit from increased operational efficiency, faster innovation, and better business outcomes overall, according to 2023 IT Trends Report: Lessons From Observability Leaders, a report from SolarWinds ...

September 20, 2023

IT leaders are driving an increasing number of automation initiatives as a way to stay competitive, reduce costs and scale as they navigate an unpredictable social and economic environment, according to the 2023 State of Automation in IT survey conducted by Jitterbit ...

September 19, 2023

Customer loyalty is changing as retailers get increasingly competitive. More than 75% of consumers say they would end business with a company after a single bad customer experience. This means that just one price discrepancy, inventory mishap or checkout issue in a physical or digital store, could have customers running out to the next store that can provide them with better service. Retailers must be able to predict business outages in advance, and act proactively before an incident occurs, impacting customer experience ...

September 18, 2023
Digital transformation is key to ensuring companies keep up with the competitive market landscape. Putting digital at the core of a business can significantly reduce operating expenses and inefficiencies. However, this process often means changing the way internal teams work with one another. To help with the transition, this blog offers chief experience officers (CXOs) advice on how to lead a successful digital transformation project ...
September 14, 2023

Earlier this year, New Relic conducted a study on observability ... The 2023 Observability Forecast reveals observability's impact on the lives of technical professionals and businesses' bottom lines. Here are 10 key takeaways from the forecast ...

September 13, 2023
On September 10, MGM Resorts experienced what it called a "cybersecurity issue" that had a major impact on the company's systems, showing how cyberattacks can bring down applications, ultimately causing problems for a company in many ways ...
September 12, 2023

Only 33% of executives are "very confident" in their ability to operate in a public cloud environment, according to the 2023 State of CloudOps report from NetApp. This represents an increase from 2022 when only 21% reported feeling very confident ...

September 11, 2023

The majority of organizations across Australia and New Zealand (A/NZ) breached over the last year had personally identifiable information (PII) compromised, but most have not yet modified their data management policies, according to the Cybersecurity and PII Report from ManageEngine ...

September 07, 2023

A large majority of organizations employ more than one cloud automation solution, and this practice creates significant challenges that are resulting in delays and added costs for businesses, according to Why companies lose efficiency and compliance with cloud automation solutions from Broadcom ...

September 06, 2023

Companies have historically relied on tools that warn IT teams when their digital systems are experiencing glitches or attacks. But in an age where consumer loyalty is fickle and hybrid workers' Digital Employee Experience (DEX) is paramount for productivity, companies cannot afford to retroactively deal with IT failures that slow down employee productivity ...