Partner Perspectives  Connecting marketers to our tech communities.
11/8/2016
02:47 PM
Ned Miller
Ned Miller
Partner Perspectives
50%
50%

Every Minute Of Security Planning Will Save You 10 Minutes In Execution

Leveraging automation, orchestration, and interoperability in your cybersecurity plans now will save you significant time later.

Time management guru Brian Tracy is often quoted as saying, “Every minute of planning you do now will save you 10 minutes in execution; this gives you a 1,000% return on energy.”

In cybersecurity, where we are faced with a volume of threats and events that exceeds the capacity of available resources, achieving this level of return on time and energy is essential. Whether you need to update existing plans or build new ones, investing in cyber defensive strategies, incident response plans, security personnel, and operational processes has to be part of your organization’s continuous improvement practice.

When building and updating plans, look to industry best practices. In cybersecurity, this means promoting the use of as much interoperability, automation, and orchestration as possible within an organization’s security operations. However, you will not necessarily get optimal results and maximum velocity by simply adding these capabilities on top of existing architectures, policies, and processes.

Architecture Enables Velocity

Increasing velocity requires an architecture that can actually be sped up. Most organizations rely on a multivendor, siloed security infrastructure, where products do not communicate with each other. These types of security architectures lack sufficient interoperability of the inspection, intelligence gathering, analytics, and enforcement components to gain much from automation.

Interoperability enables automation and improves effectiveness. The active sharing of data makes it practical and possible for every security control to leverage each other’s strengths and experiences. Rather than treating each malware interaction as a standalone event, adaptive threat prevention integrates processes and data through an efficient messaging layer. This approach reinforces levels of inspection and analysis and connects end-to-end components to generate and consume as much actionable intelligence as possible from each event.

Processes And Policies Are Lubricants

An adaptive and interoperable security architecture helps overcome the all too common functional fences that impede detection, response, and any chance of improved prevention. However, this is only possible when the organization’s processes and policies complement the architecture. Unintegrated security functions keep organizations in firefighting mode, always reacting and pouring human resources into every breach. Process inefficiency exhausts scarce investigative resources and lengthens the timeline during which data and networks are exposed to determined attackers, which is directly correlated with the extent of damage.

Automation And Orchestration Are Accelerants

Enabled by an interoperable architecture and efficient processes, automation and orchestration become a force multiplier, augmenting human capabilities, increasing processing capacity, reducing workloads, and significantly improving incident response times. Security products, integrated with a real-time, bidirectional messaging layer, can directly share event data, context, and threat intelligence, regardless of location and with little or no human interaction. This means that you can communicate security policies and commands from centralized security controls to remote branches, home offices, mobile devices, cloud services, and IoT devices.

It is simply no longer acceptable for the time-to-detection to reaction to containment to take hours or even minutes. To accelerate this process and keep up with the enormous volume of sophisticated threats, security architectures and processes must evolve and be automated.

Intel Security’s Data Exchange Layer (DXL) is an open and easily integrated messaging fabric that enables security components from a large ecosystem of vendors to share relevant data. By providing near real-time command and control options for otherwise inaccessible systems, it benefits organizations by facilitating automated response, vastly reduced response times, and better containment. The goal of DXL is to promote collaborative security, enable active command and control, forge interoperability (plug-and-play) among distributed elements from disparate vendors, and ensure consistency and speed of outcomes.

In closing, get started planning today so that you can benefit from the savings on execution time tomorrow. Remember to apply your security reference architecture planning across all phases of your protection domains, including your IoT ecosystems. One last quote from Brian Tracy: “Imagine no limitations; decide what's right and desirable before you decide what's possible.”

Ned Miller, a 30+ year technology industry veteran, is the Chief Technology Strategist for the Intel Security Public Sector division. Mr. Miller is responsible for working with industry and government thought leaders and worldwide public sector customers to ensure that ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cybersecurity Must Be an International Effort
Kelly Sheridan, Associate Editor, Dark Reading,  12/6/2017
NIST Releases New Cybersecurity Framework Draft
Jai Vijayan, Freelance writer,  12/6/2017
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2017
A look at the biggest news stories (so far) of 2017 that shaped the cybersecurity landscape -- from Russian hacking, ransomware's coming-out party, and voting machine vulnerabilities to the massive data breach of credit-monitoring firm Equifax.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.