Partner Perspectives  Connecting marketers to our tech communities.
6/15/2016
10:30 AM
Brett Kelsey
Brett Kelsey
Partner Perspectives
50%
50%

Why Everyone Is Rallying Around Adaptive Security: Part 1

Three intertwined security realities are compelling enterprises to transition from a set-and-forget approach to an adaptive security strategy.

Lately there’s been a lot of buzz about “adaptive security,” a concept advanced by Gartner in the report, Designing an Adaptive Security Architecture for Protection From Advanced Attacks. Here’s what Gartner has to say: “All organizations should now assume that they are in a state of continuous compromise.”

Gartner suggests that we accept this basic assumption: The bad guys can get past our current safeguards. I believe that we can make some fundamental changes in how we approach security to shift that paradigm. How do you go about that? In this three-part blog series, we’ll explore the drivers behind this transformation and what you need to know to enable adaptive security at your organization.

An Eye-Opening Event

Let me share a personal experience I had that resulted in an epiphany. About six years ago, when I was chief security officer at a financial organization, we experienced a significant data breach. A third-party company collecting loans on our behalf was attacked by bad actors who managed to access the third party’s systems to get into our environment. So I did what any self-respecting CSO would do: I gathered together the best possible tools to do some in-depth detective work. Guess what I ended up using? Low-tech Post-it notes and a ballpoint pen. In our siloed security environment, it was really the only way to collect information from one system, compare it to the next, and ultimately diagnose what was going on.

So, drumroll, please… Here’s my big “a-ha” moment. When you have siloed, overly complex systems that don’t allow for automatic sharing of threat data -- like the one we had back at my old stomping ground -- the connectivity point is a person. The problem is, we’re dependent on people, but we don’t have enough of them. And they, in turn, don't have enough time to cull through every shred of data that security products churn out and then try to make sense of all that data.

And this brings us to the topic we’re exploring in this first blog post: the three intertwined security realities that are compelling enterprises to transition from a set-and-forget approach to an adaptive security strategy.

Reality 1: Complex, Siloed Security Infrastructures

To keep up with rapidly evolving attacks, we C-level folks and our teams face the dilemma of prioritizing where we need to invest our time and resources and then sort out the flood of new security technologies, most of which promise to be the next silver bullet. But guess what? I will break this to you gently: There’s no silver bullet. Too often, enterprises end up with technology sprawl -- a jumble of siloed multivendor products. This situation is made even worse as companies look beyond protective controls to add more detection and response capabilities.

What are we left with? Security teams end up spending their time juggling products that don’t talk to one another, along with multiple, integrated management consoles. And to top it all off, these products crank out an enormous quantity of security data that we can’t manage and can’t use.

So, despite all that earnest effort and activity, we have blind spots in the critical areas of detection and response, gaps in security coverage, a lack of visibility across the entire infrastructure, and an inability to share and act on valuable threat intelligence.

Reality 2: Too Much Data, Too Little Time

One of the things you’ll learn when you have a breach is that this patchwork of security products can generate an avalanche of threat data. Your first reaction to this may be positive, as you consider how this rich treasure trove of information can help you gain insights about security events and respond more quickly and effectively to potential attacks. But the problem is, you may not have the right tools (aside from your humble Post-it note and pen) such as real-time security information and event management (SIEM) solutions, or the qualified people to collect the data from your security tools, aggregate it, analyze it, and take the best action when indicators of attack are present.

Reality 3: Shortage Of Trained Cybersecurity Staff

Another reality that we’ve all had to face lately is a shortage of qualified security personnel. Trained and experienced security professionals with a deep understanding of advanced security tools, including SIEM, forensics, event management, and analytics, are in high demand -- and they’re scarce.

The SANS Institute’s 2015 Analytics and Intelligence Survey tells us that while the need for additional security technologies and resources has doubled since 2014, 59% of participants say that lack of a highly skilled and dedicated security staff is one of the main impediments to discovering and acting on security events and breaches.

Extrapolating further, the scarcity of resources boils down to a lack of time. If you don’t have the right people in place and enough of them, you won’t be able to sift through the huge volume of malicious code that passes through your organization, react in a timely and appropriate fashion, and prevent future attacks. Breaches will continue to be met with a surge-response team that is ill equipped to act, resulting in delays and errors that expand the impact crater.

Time To Put Away Paper And Pen And Embrace The New

As you can see, the current state of security in most enterprises is untenable and brittle. In the second blog of this series, we’ll delve more deeply into some of the mindset and cultural changes that need to take place to pave the way for an adaptive security architecture.

In the meantime, learn more about Gartner’s research in this space and approaches for implementing adaptive security by viewing this webinar, featuring Neil Macdonald from Gartner, where he talks about his adaptive security architecture concept.

Brett Kelsey is the VP and Chief Technology Officer for the Americas for Intel Security. In this role, he has leveraged his business and practice development, technical expertise, and innovative thought leadership to evangelize Intel Security's go-to-market strategy across ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
LordC623
50%
50%
LordC623,
User Rank: Strategist
6/15/2016 | 5:36:29 PM
Wow
" But guess what? I will break this to you gently: There's no silver bullet. "

 

No silver bullet?  Wow, so deep.  Much blog.

Editors asleep today?
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Video
Cartoon
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.