Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

10:30 AM
Arif Kareem
Arif Kareem
Connect Directly
E-Mail vvv

The Single Cybersecurity Question Every CISO Should Ask

The answer can lead to a scalable enterprise security solution for years to come.

In early December 2018, several major corporate breaches were made public. As the news was shared and discussed around my company, one of my colleagues jokingly asked, "I wonder if I can gift some of this free credit monitoring to my future grandchildren." It was a telling comment.

Today, every organization – regardless of industry, size, or level of sophistication – faces one common challenge: security. Breaches grab headlines, and their effects extend well beyond the initial disclosure and clean-up. A breach can do lasting reputational harm to a business, and with the enactment of regulations such as GDPR, can have significant financial consequences.

But as many organizations have learned, there is no silver bullet – no firewall that will stop threats. They are pervasive, they can just as easily come from the inside as they can from outside, and unlike your security team, who must cover every nook and cranny of the attack surface, a malicious actor only has to find one vulnerability to exploit.

The security challenge is compounded by the security talent gap, which has reached crisis levels. That is why executives in every industry must ask themselves: How do I scale the resources I have to meet the cybersecurity needs of my organization? The hidden answer: IT operations.

Uniting for a Common Purpose
In a world in which security and IT operations are often at odds, this may seem counterintuitive, but the truth is what SecOps calls "the attack surface" is what IT ops calls "the environment." And no one knows the enterprise environment – from the data center to the cloud to the branch and device edge – better than the team tasked with building and managing it.

Many of our most sophisticated customers already use IT operations to help build a more robust security posture. Drawing from conversations with these organizations, industry analysts, internal experts at ExtraHop, and my own experiences from decades working in business operations, here are some of the most important things CIOs and CISOs can do to create a co-operational framework for security and IT ops.

• Security cannot come at the expense of uptime: For any organization, ensuring the consistent availability and performance of business-critical systems is paramount. If a security measure compromises availability, the business itself is compromised. Security teams need to work with IT ops and line-of-business stakeholders to understand performance requirements and then build a security framework that accounts for an acceptable level of risk.

• It's OK to fail if you can recover: Efficient business operations always require some level of risk, and that means accepting that some failures are going to happen. For security teams, this means accepting that malicious actors will get in. The question becomes how quickly you can detect, investigate, and stop that activity.

IT operations, with its working knowledge of system behaviors and interactions, can play a vital role in helping to detect threats before they result in disaster. They just need the tools and understanding to know what to look for. Just as line-of-business stakeholders work cross-functionally to scale knowledge and improve outcomes, security and IT ops will better serve the business through collaboration.

• Responsibility for secure operations can and should be shared: If you provide IT ops with the right tools, it’s possible for SecOps to use IT ops for some important security activities. These should be lower on the risk scale, and they should be things that don’t require a high degree of specialized knowledge.

• Cooperation benefits compliance as well: While breaches grab headlines (and garner record-setting fines), compliance failures can also have significant business consequences. Regulations such as GDPR and HIPAA require organizations to meet strict standards for protecting data and privacy. While SecOps and IT ops play their own roles in ensuring clean and compliant practices, sharing both knowledge and resources is a smarter way of scaling to meet compliance demands.

Moving Forward
From the interactions between applications to how to create secure configurations, far too often we find that IT ops and SecOps fail to share important knowledge. As too many organizations have learned the hard way, this siloed, sometimes oppositional model can have serious consequences.

There is no perfect fix for cybersecurity, and nothing will ever be 100% secure. Threat actors are highly motivated to find new and innovative ways around every solution that tries to keep them out. But with a combination of strategy, structure, staffing, and systems, it’s possible to gain an advantage that will evolve and scale to keep disaster at bay. 

Finding talented security professionals is becoming increasingly difficult. But when you promote an environment of cooperation and communication, you can build a more scalable enterprise security solution for 2019 and beyond. At the end of the day, the best team wins.

Related Content:



Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Arif Kareem is CEO and president of ExtraHop Networks. He holds over 30 years of experience formulating and executing business and operational strategies to accelerate growth in the enterprise and technology markets. Before joining ExtraHop, Kareem served ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
4/16/2019 | 3:08:15 PM
One Question?
What is the question?  :-)
Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
5 Common Errors That Allow Attackers to Go Undetected
Matt Middleton-Leal, General Manager and Chief Security Strategist, Netwrix,  2/12/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-02-19
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
PUBLISHED: 2020-02-19
In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.
PUBLISHED: 2020-02-19
A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication type is LDAP and the password is left blank, providing the primary credentials are correct. The vulnerabilities is due to improper in...
PUBLISHED: 2020-02-19
A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on the affected software. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker ...
PUBLISHED: 2020-02-19
An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is rel...