Advanced Persistent Threat (APT) Solution of the Year for Traps
Security Company of the Year
These awards, organized by Computing Security Magazine, were set up to recognize the solutions and the solution providers helping to keep organizations secure.
Do you like our technology? Do you think Palo Alto Networks should win? Our fate is in your hands, so please vote now.
Chances are your organization is either working feverishly to field a cyber risk management program or improve your current program to make it more efficient. The recognition of the importance of risk-based security appears consistent across organizations. A 2013 Ponemon and Tripwire study reported that 81 percent of security and risk professionals in the US said their organizations had a significant or very significant commitment to risk-based security management. Unfortunately, the same study said that only 29 percent of those respondents felt their organization had a formal security risk management strategy that was applied consistently across the enterprise.
There are many challenges with implementing a cyber risk management program. These challenges may differ if the organization is starting a program from scratch, working to incorporate cyber risk into an already established risk program or perhaps working to transition from a compliance-based security program. No matter where your organization sits in this spectrum, there are some key actions that can be taken to strengthen an organization’s risk posture.
Incorporate cyber risk into the organization’s existing risk program Although many organizations already have an existing risk program, it is not uncommon to find a cyber risk program started and managed external to that structure. Often times this is due to the cyber risk effort evolving from the organization’s cybersecurity program. This does provide the benefit of a great deal of technical expertise but at the detriment of risk and line-of-business expertise. The result is misunderstood or poorly developed risk tolerances that do not align with business objectives and the organization’s inability to properly prioritize risk mitigation actions across the organization.
The key here is to arrive at a structure that has, or at least is based upon, a single, common language, risk tolerance criteria and risk catalog/register. The structure needs to include risk managers, security managers and business unit executives. Organizing the cyber risk program at this higher organizational level and out of IT can also aid in developing a cyber-aware culture in the organization.
Focus on the correct assets The first major component of any risk methodology is identification. An organization’s specific risk methodology may refer to this step as resource profiling, information system categorization, identification of IT services or something else entirely. The goal, however, is the same—identification of those information assets that must be secured to meet business objectives. If you do not know what is important, not only will you not know what to focus your defenses on, but you will have a harder time justifying a risk assigned to an asset. This discussion should not start with routers and servers, but with the information and services upon which the business depends. Once those are defined, prioritized and agreed upon, then IT can begin cataloging the relevant critical hardware and software. Few organizations have sufficient resources to implement all desired security practices. Identifying critical assets first focuses your risk program and your scarce resources. Doing this wrong could mean cyber risk ends up being defined in terms of compliance and will impact criticality of the asset at risk.
Expand the use of non-technical controls On one hand, it only makes sense that technology seems to have become the default answer when protecting information assets. The variety and effectiveness of technical solutions available for consideration have never been greater than they are today. Unfortunately, this focus has come at the cost of neglecting the human layer of our information systems. Focused, recurring awareness training and exercises, behavior management, and incentivizing desired actions can build an organization’s workforce’s ability to prevent, accurately detect, and quickly react to cyber incidents.
I have only just begun to touch on these considerations for more effective cyber risk management. I will be diving deeper and looking forward to the dialog during my presentation at the CSX North America 2015 Conference. Hope to see you there.
Douglas Rausch, CISSP President, Aurora CyberSecurity Consultants, Inc.
Cybersecurity is a hot topic these days. Corporate breaches in the headlines have turned hackers into the new super villains. “Revenge of the Nerds” is alive and well, and hacking is their super power. It’s no wonder that every customer meeting I attend starts with a concerned voice: “what can we do to protect ourselves and our customers” from these new super villains? Secretly, they’re wishing to hear about a shiny new product that will solve all of their security problems, providing new protection for every new attack.
We all want our data and networks to be secure, with no effort or risk, but there are no shortcuts to success in the territory of cybersecurity.
As surprising as it may sound, these villains’ new tactics are not as new as you might think; in fact, many of the so-called new attacks could have been prevented by correctly using existing security technologies as part of an end-to-end cybersecurity plan.
What is the plan? Think like a hacker.
Change the way you approach protection, what would you steal?
Start by thinking about what you need to protect, not about protecting the road to it. In other words, build protection to match your data and your processes, not just the network architecture. Learn about your business’s unique patterns of people-data interaction; what and how it needs to be protected, who needs access to it and when, and what is the expected interaction they will have with the data. Only then can you start building your data-centric security.
Look for the gaps – what is the easiest way to get your data?
All networks are built to provide a service that is dependent on multiple systems both internally and externally. Hackers look for gaps, the path of least resistance. Why break down the front door, if you can easily get in through an open window? Your security solution must prevent as much as possible across multiple phases of the cyberattack lifecycle.
2.1 When you think about gaps, look at the borders of your systems and processes internally and externally, as gaps have more to do with interoperability and less with physical objects (Internet of Things). Work to close those gaps and think outside of the security box. Your inventory list should include computing, storage and network equipment.
2.2 The human factor: social engineering attacks are rising, with high success rates. Training and education is the key to defending on this front. Adding tools and scripts to catch users’ mistakes can help reduce the risk.
Uncover deception – what and whom do you trust?
Your answer should be nothing and no one. Look to uncover and inspect as many compression and encryption protocols as possible, making sure that the data entering your network is what you expect it to be, and from whom you expect it to arrive. You must detect new unknown attack components across all traffic.
Look holistically, what are your blind spots?
As you plan to add new products or processes, strive to reduce complexity and keep it simple: simple to manage, simple to monitor, simple to update, and simple to control. Any blind spot or unattended system can and will be used against you, especially in multi-step attacks. Keeping it simple is probably the most challenging aspect of this process. It is a daunting task. As you look under the hood of many customers’ networks, most have been built over long periods of time with highly heterogeneous platforms, languages and tools. Remember that you have more than one environment to manage, as mobile devices and public/hybrid cloud infrastructure are two of the biggest attack vectors. Your solution should detect new, unknown attacks across all traffic.
Keep getting better – how can you be even more secure tomorrow?
New security protections can become outdated quickly, if they are not attended to and updated regularly. Threats are constantly changing, requiring continuous monitoring, tracking and assessments in order to keep your security up to date. Timing is everything. You must be able to turn detection data into prevention very quickly.
Sun Tzu and his “The Art of War” guidelines are more relevant than ever. In order to beat cybercriminals, you need to understand the battlefield, know the enemy and know yourself. Build a security ecosystem designed to fit your unique data mix and data consumption patterns, predict the enemies’ next move, counter it, and strive to be one step ahead of them.
