Neither prevention nor detection alone is sufficient in today’s cybercrime environment.

Michael Sentonas, President, CrowdStrike

August 25, 2015

3 Min Read

Losing irreplaceable photos, laptops without current backups, and heirloom jewelry are among the biggest fears if your house is robbed. We use deadbolts, alarm systems, and other protection features to deter robbers, but what would you do if you knew for sure that someday in the near future you would be robbed? Back up the photos and laptop offsite? Put the jewelry in a safe? What if your alarm company told you that all of its customers had been robbed, some just don’t know it yet?

Some security experts say that there are only two types of companies: those that have been hacked, and those that don’t know they have been hacked. Since the beginning of cybercrime, security has focused on prevention. Firewalls got thicker, scanners more detailed, blacklists longer, and whitelists more specific. Unfortunately, as the threat volume continues to grow, attack surfaces grow wider, and new devices become harder to protect, we need to acknowledge that sometimes attacks will get through.

Clearly, we should not be giving up and accepting the notion that the only possible states are hacked, being hacked, and about to be hacked; there is still a lot we can do to improve protective and preventive measures. If we acknowledge the increased risk, then we should plan to be better prepared for the possibility of a breach, detecting it sooner, and correcting it faster. Many recent attacks on companies have gone on for months -- sometimes even years -- without being detected. We need to start shifting priorities so that we are balancing the amount of time and money being spent on prevention and allocating more time and budget to detection.

Protect And Prevent

If you lived in a neighborhood with a high probability of a break-in, you would have more protection. But you would probably also add some documentation and surveillance techniques: a detailed home inventory with photos so that you can identify missing items; external cameras or motion sensors to let you know that unauthorized people have been snooping around;  maybe even some spy tricks such as pieces of tape or hair across the door frame, light coating of powder near the jewelry box, or desktop items arranged to highlight tampering.

Your security incident-response strategy needs similar tools. Computer-protection systems generate alerts, events, and other messages in an attempt to help you determine if you have been hacked. Unfortunately, with so many of them working in isolation, it can result in more noise than help. The other major issue is time and scale.  When dealing with a major incident, trying to work through a massive data set takes time, and trying to do it en masse compounds the problem.

A detection strategy helps to remove noise from the security messages. One place to start is the endpoints. Assuming that you can set and forget your endpoint security tools is no longer valid. These devices, usually the first stage of an attack, can provide vital assistance that helps the security team react faster and contain sooner. This includes predefined and customizable indicators of compromise, real-time and forensic event analysis, rapid response to isolate suspected infections from the network, and roll-back of recent changes. A detection strategy should also include capability to alert on future critical events or state changes for specific indicators of compromise, or more important, to look for and alert on indicators of attack before you are compromised.

Neither prevention nor detection alone is sufficient in today’s cybercrime environment. You need to be able to prevent what can be prevented, but also quickly determine if you have been compromised, how it happened, and what was stolen so that you can move to contain and recover from the theft. 

About the Author(s)

Michael Sentonas

President, CrowdStrike

Michael Sentonas is President of CrowdStrike. Previously, he served as Vice President, Technology Strategy, at CrowdStrike as well as Chief Technology Officer. With over 20 years' experience in cybersecurity, Mike's most recent roles prior to joining CrowdStrike were Chief Technology Officer – Security Connected and Chief Technology and Strategy Officer APAC, both at McAfee (formerly Intel Security). Mike is an active public speaker on security issues and provides advice to government and business communities on global and local cyber security threats.

He is highly sought after to provide insights into security issues and solutions by the media including television, technology trade publications and technology centric websites. Michael has spoken around the world at numerous sales conferences, customer and non-customer conferences and contributes to various government and industry associations’ initiatives on security. Michael holds a bachelor's degree in computer science from Edith Cowan University, Western Australia and has an Australian Government security clearance.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights