Perimeter
8/19/2015
11:45 AM
Mark Clancy
Mark Clancy
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

Applying the 80/20 Rule to Cyber Security Practices

How to look holistically across technology and processes and focus resources on threats that create the greatest damage.

The 80/20 rule, or the “Pareto Principle,” states that approximately 80% of effects come from 20% of causes, reinforcing a very powerful point that distributions are rarely equal. In sales, for example, 20% of clients often represent 80% of a firm’s revenues while in the field of software development, a relatively small number of the most-reported bug fixes are likely to create solutions for the overwhelming majority of problems.

For corporate information security officers and others on the front lines in the fight against cybercrime, the key takeaway is that not all threats create the same level of risk and that resources need to be prioritized to fighting those attacks that could do the most damage to your firm or industry.  

Unfortunately, we continue to see too many instances where firms take a one-size-fits-all approach to their cyber defenses, focusing too many resources on lower-level risks, such as wide-scale malware campaigns, and not enough on the most destructive attacks or targeted probing by capable adversaries. In today’s rapidly changing cyber landscape, with threat actors growing in sophistication each and every day, this must change.

As a first step, firms need to assess their end-to-end incident response processes, with an investigation of the discovery, analysis, mitigation and closure phases, and how resources are spent in each area. Typically, firms find significant financial resource drains in many of these areas, which oftentimes can be automated and improved though technology and procedural changes. It is only when firms identify where they spend the most time that they can bring the incident response cycle down and free up resources to target on the most critical issues.

Looking at discovery, this is the phase where firms become aware of an issue. When speaking of a lower risk incident such as non-targeted phishing, many firms manually monitor inbound emails one by one, yet there are solutions to automate the entire inbound email process. Ideally, firms can shorten this discovery phase by building automation that can systematically digest inbound traffic, extract all links and identify issues company wide – promptly alerting security teams to specific threats and machine issues, enabling faster incident detection.

Next is the analysis phase. Security orchestration tools can automatically create help desk tickets, categorizing security event inflows and organizing the entire incident. This is also an area where firms are starting to leverage collaborative industry utilities that share threat information and remediation tactics across institutions and industries in order to speed up incident analysis and resolve issues. 

The call for cyber threat data sharing has been echoed by market participants, regulators and infrastructure providers alike, as firms are increasingly looking to collaborate to prevent and respond to attacks more quickly. Most recently, the US House and Senate took proactive steps to confront the cyber security challenge and are working towards enactment of legislation to improve information sharing to protect critical infrastructure. Collaborative cyber security threat information tools will not only enable firms to identify incidents more quickly, but at their best, should also empower them to either proactively prevent issues or mitigate them quickly.

When it comes to closure, sharing and learning are essential.  Following a plane crash, for example, there is a deep forensic analysis of what happened and discussion around how the aviation industry can prevent a similar occurrence. While this sounds straightforward, it currently does not happen with cybersecurity incidents today. Often firms keep incidents close to their vests out of fear of public disclosure, which has the effect of leaving other firms more vulnerable to that same attack.  We must shift away from this protective thinking to encourage firms to anonymously share details on cyber security incidents using new technologies and solutions. As more firms join in this dialogue, the process of detection and mitigation will become more efficient and the balance of power will shift away from the criminals.

Finally, we must continue to keep a close watch over the infrastructure, avoiding overly complex IT implementations and lack of investment in upgrades and system maintenance that increase our vulnerability.

While there is no easy solution to winning the war against cyber criminals, the Pareto Principle provides sound guidance on how to tackle this challenge. Foremost, we must look holistically across technology and processes to become more efficient and to focus resources on the threats that could create the greatest damage. In other words, we must shift the effort/risk paradigm to 80% effort on the 20% of the most critical incidents if we are to bend the cost and risk curves to our favor. We still have to cover 100%, but we need to close out the 80% of the noise with 20% of our energy.

Stephen Scharf is chief security officer at The Depository Trust & Clearing Corporation (DTCC). In this role he is responsible for centralizing and aligning the firm's global information security, physical security, employee safety, and crisis/incident management functions, ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MichaelMoshiri
100%
0%
MichaelMoshiri,
User Rank: Apprentice
8/24/2015 | 5:01:51 PM
Great insights...
Thank you, Mark, for the great article. The 80/20 rule is a great reminder that 100% security is not only unachievable but unnecessary. Your suggestion to take on a risk-based approach to identifying the 20% where the marjority of our energy should be concentrated is spot-on.

Since your article is mostly focused on incident response, where would you say is the sweet spot for Soltra and Soltra Edge to help enterprises to apply the 80/20 rule to their incident response activities?
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: just wondering...Thanx
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.