Endpoint
2/4/2016
02:00 PM
50%
50%

Cybersecurity Smackdown: What Side Are You On?

Analytics vs. Encryption. Prevention vs. Detection. Machine Learning: Promise or Hype? The Firewall: Dead or Still Breathing? The sharpest minds in the security industry debate some of the industry's most contentious issues.

It’s debate season – at least in the political realm. So to get into the spirit of the US primary election, Dark Reading has put together in one place excerpts from our ongoing series of great cybersecurity debates about four hot new information security technologies versus their legacy counterparts. Industry leaders make impassioned arguments for the new versus the tried and true, or a combination of the two.

 

ANALYTICS VS. ENCRYPTION

Encryption Has Its Place But It Isn’t Foolproof

By Doug Clare, Vice President of Product Management, FICO

Encryption technology is improving, as are best practices in deploying it; and everyone should embrace these improvements. But encryption alone is not enough, and may induce a false sense of security among those who depend on it. Read more.

As Good As They're Getting, Analytics Don't Inherently Protect Data

By Scott Petry, Co-Founder & CEO of Authentic8

The suggestion to “use analytics to secure your system” is flawed, and the argument to shift away from data security systems like encryption and move to analytics is fallacious. In fact, analytics is not an either-or-choice with encryption. Suggesting that firms choose between the two is like a doctor telling a patient to choose either vitamins or exercise. Both have their place in a healthy lifestyle. Read more.

 

MACHINE LEARNING: HYPE VS. PROMISE   

Machine Learning Is Cybersecurity's Latest Pipe Dream

By Simon Crosby, co-founder and CTO at Bromium

There is a huge difference between being pleased when Netflix recommends a movie you like, and expecting Netflix to never recommend a movie that you don’t like. So while applying machine learning to your security feeds might deliver some helpful insights, you cannot rely on such a system to reliably deliver only valid results. Read more.

Machine Learning: Perception Problem? Maybe. Pipe Dream? No Way!

By Mike Paquette, VP Products, Prelert

In the most common misperception, machine learning is thought to be a magic box of algorithms that you let loose on your data and they start producing nuggets of brilliant insight for you. If you apply this misperception to the use of machine learning for cybersecurity, you might think that after deploying it, your security experts will be out of a job since algorithms will be doing all their important threat detection and prevention work. The reality is that ML is a practical way to use newer technology to automate the analysis of log data to better detect cyberthreat activity, under the direction and guidance of an organization's security experts. Read more

 

PREVENTION VS. DETECTION

Time’s Running Out for the $76 Billion Detection Industry

By Simon Crosby, co-founder and CTO at Bromium

Enterprises spend a mind-boggling $76 billion each year to “protect” themselves from cyber-attacks, but the bad guys keep winning because most protection solutions are based on detection instead of prevention. What’s wrong? The answer is the same today as it was in ancient Troy when the Greek army suddenly disappeared, leaving behind an innocent-looking horse that the Trojans willingly brought inside the gates. Read more.

Detection: A Balanced Approach For Mitigating Risk

By Josh Goldfarb, VP and CTO - Emerging Technologies, FireEye

Prevention is necessary, but not sufficient, for a robust and mature security program. Only detection and response can complete the security picture that begins with prevention. Read more

 

THE FIREWALL IS DEAD. LONG LIVE THE FIREWALL.

Why the Firewall is Increasingly Irrelevant

By Asaf Cidon, Co-Founder & CEO, Sookasa

Firewalls only protect what work used to be, not what it is today, a distributed collection of employees connected by mobile devices, in turn connected to the cloud. The only way to secure all company data, then, is to extend enterprise-grade security to these employees’ devices and cloud applications. Read more.

Firewalls Sustain Foundation of Sound Security

By Jody Brazil, Co-Founder & CEO, FireMon

Effective security management will always retain a multi-layered approach necessitating mechanisms that control and limit access. While this may not someday require dependence on network security devices, in today’s environment the firewall remains one of the critical building blocks of network security. Read more

 Interop 2016 Las VegasFind out more about cutting edge security at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

 

 

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
lorraine89
50%
50%
lorraine89,
User Rank: Ninja
9/26/2016 | 10:06:26 AM
Cyber security
Nice informative article. Though no matter if it is Analytics vs. Encryption. or Prevention vs. Detection at the end of the day, the side which incorporates taking preventive measures before hand is the winning one. Encryption for instance is by far the best method to secure your online connections as well as your personal files or folders on systems. Online encryption in the form of vpn is essential like I use Purevpn to deploy encrypted connection to my server for privacy and security. 
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/9/2016 | 12:55:23 PM
Re: Adopt key less encryption
Quantum computing and the security solutions that it can provide particularly excite me.  It's hard to defeat quantum physics when you have the observer effect and dark matter and all of these mysteries at play.

Of course, as the field -- and our understanding of it -- becomes more advanced, perhaps so too will hacking methods.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/9/2016 | 12:52:59 PM
Re: The problem is people.
@Stephen: Indeed!  As many security colleagues of mine agree, you can have the best security tools in the world -- but they will do you no good if your employees leave the doors wide open!

It's analytics.  It's encryption.  It's firewalls.  It's anti-malware.  It's training.  It's EVERYTHING.
oneilldon
50%
50%
oneilldon,
User Rank: Guru
2/7/2016 | 3:49:02 PM
Adopt key less encryption
Even the ordered mathematical encryption approach is losing ground to advancements in computational capability. In addition to being far too computationally intensive, the operational advantage of pairing of math-based encryption systems and advanced computing, on the verge of Quantum Computing, may be tilting in favor of the determined STEM-endowed nation state adversary.

Now a national security and competitiveness challenge, the state of encryption calls for new thinking, innovation, and disruptive action. It is a false promise that ordered mathematical encryption will yield privacy and security.

One alternative to extricate ourselves from this trap is to invent and adopt key less encryption without dependence on ever increasing advancements in computational technology and without encryption keys to be confiscated by the government only to be hacked by bad actors.
StephenR232
50%
50%
StephenR232,
User Rank: Apprentice
2/6/2016 | 7:01:01 PM
The problem is people.
The root cause for most events is people doing dumb things they've already been told not to do. The only meaningful solution is to take people out of the equation. When the internet is for the most part machines interacting with other machines is when this arms race can be fought to a stalemate. Until then, the side with the most people will lose.
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.