Partner Perspectives  Connecting marketers to our tech communities.
10:50 AM
Michael Sentonas
Michael Sentonas
Partner Perspectives

What Would You Do Differently If You Knew You Were Going To Be Robbed?

Neither prevention nor detection alone is sufficient in today's cybercrime environment.

Losing irreplaceable photos, laptops without current backups, and heirloom jewelry are among the biggest fears if your house is robbed. We use deadbolts, alarm systems, and other protection features to deter robbers, but what would you do if you knew for sure that someday in the near future you would be robbed? Back up the photos and laptop offsite? Put the jewelry in a safe? What if your alarm company told you that all of its customers had been robbed, some just don’t know it yet?

Some security experts say that there are only two types of companies: those that have been hacked, and those that don’t know they have been hacked. Since the beginning of cybercrime, security has focused on prevention. Firewalls got thicker, scanners more detailed, blacklists longer, and whitelists more specific. Unfortunately, as the threat volume continues to grow, attack surfaces grow wider, and new devices become harder to protect, we need to acknowledge that sometimes attacks will get through.

Clearly, we should not be giving up and accepting the notion that the only possible states are hacked, being hacked, and about to be hacked; there is still a lot we can do to improve protective and preventive measures. If we acknowledge the increased risk, then we should plan to be better prepared for the possibility of a breach, detecting it sooner, and correcting it faster. Many recent attacks on companies have gone on for months -- sometimes even years -- without being detected. We need to start shifting priorities so that we are balancing the amount of time and money being spent on prevention and allocating more time and budget to detection.

Protect And Prevent

If you lived in a neighborhood with a high probability of a break-in, you would have more protection. But you would probably also add some documentation and surveillance techniques: a detailed home inventory with photos so that you can identify missing items; external cameras or motion sensors to let you know that unauthorized people have been snooping around;  maybe even some spy tricks such as pieces of tape or hair across the door frame, light coating of powder near the jewelry box, or desktop items arranged to highlight tampering.

Your security incident-response strategy needs similar tools. Computer-protection systems generate alerts, events, and other messages in an attempt to help you determine if you have been hacked. Unfortunately, with so many of them working in isolation, it can result in more noise than help. The other major issue is time and scale.  When dealing with a major incident, trying to work through a massive data set takes time, and trying to do it en masse compounds the problem.

A detection strategy helps to remove noise from the security messages. One place to start is the endpoints. Assuming that you can set and forget your endpoint security tools is no longer valid. These devices, usually the first stage of an attack, can provide vital assistance that helps the security team react faster and contain sooner. This includes predefined and customizable indicators of compromise, real-time and forensic event analysis, rapid response to isolate suspected infections from the network, and roll-back of recent changes. A detection strategy should also include capability to alert on future critical events or state changes for specific indicators of compromise, or more important, to look for and alert on indicators of attack before you are compromised.

Neither prevention nor detection alone is sufficient in today’s cybercrime environment. You need to be able to prevent what can be prevented, but also quickly determine if you have been compromised, how it happened, and what was stolen so that you can move to contain and recover from the theft. 

Michael Sentonas is the Chief Technology and Strategy Officer, APAC for Intel Security. Michael has been with the company for fifteen years, previously holding leadership roles such as VP and Chief Technology Officer of Security Connected, VP and CTO for Asia Pacific and, ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-03-26
An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. The main shell handler function uses the value of the environment variable as the first argument to printf(). Setting this variable using the sysvar command results in a user-c...
PUBLISHED: 2019-03-26
tls1.c in Cameron Hamilton-Rich axTLS before 2.1.5 has a Buffer Overflow via a crafted sequence of TLS packets because the need_bytes value is mismanaged.
PUBLISHED: 2019-03-26
utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands.
PUBLISHED: 2019-03-26
An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. The undocumented shell command "prompt" sets the (user controlled) shell's prompt value, which is used as a format string input to printf, resulting in an information leak of memory addre...
PUBLISHED: 2019-03-26
An issue was discovered in handler_ipcom_shell_pwd in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. When using the pwd command, the current working directory path is used as the first argument to printf() without a proper check. An attacker may thus forge a path contain...