Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

10:30 AM
Arif Kareem
Arif Kareem
Connect Directly
E-Mail vvv

The Single Cybersecurity Question Every CISO Should Ask

The answer can lead to a scalable enterprise security solution for years to come.

In early December 2018, several major corporate breaches were made public. As the news was shared and discussed around my company, one of my colleagues jokingly asked, "I wonder if I can gift some of this free credit monitoring to my future grandchildren." It was a telling comment.

Today, every organization – regardless of industry, size, or level of sophistication – faces one common challenge: security. Breaches grab headlines, and their effects extend well beyond the initial disclosure and clean-up. A breach can do lasting reputational harm to a business, and with the enactment of regulations such as GDPR, can have significant financial consequences.

But as many organizations have learned, there is no silver bullet – no firewall that will stop threats. They are pervasive, they can just as easily come from the inside as they can from outside, and unlike your security team, who must cover every nook and cranny of the attack surface, a malicious actor only has to find one vulnerability to exploit.

The security challenge is compounded by the security talent gap, which has reached crisis levels. That is why executives in every industry must ask themselves: How do I scale the resources I have to meet the cybersecurity needs of my organization? The hidden answer: IT operations.

Uniting for a Common Purpose
In a world in which security and IT operations are often at odds, this may seem counterintuitive, but the truth is what SecOps calls "the attack surface" is what IT ops calls "the environment." And no one knows the enterprise environment – from the data center to the cloud to the branch and device edge – better than the team tasked with building and managing it.

Many of our most sophisticated customers already use IT operations to help build a more robust security posture. Drawing from conversations with these organizations, industry analysts, internal experts at ExtraHop, and my own experiences from decades working in business operations, here are some of the most important things CIOs and CISOs can do to create a co-operational framework for security and IT ops.

• Security cannot come at the expense of uptime: For any organization, ensuring the consistent availability and performance of business-critical systems is paramount. If a security measure compromises availability, the business itself is compromised. Security teams need to work with IT ops and line-of-business stakeholders to understand performance requirements and then build a security framework that accounts for an acceptable level of risk.

• It's OK to fail if you can recover: Efficient business operations always require some level of risk, and that means accepting that some failures are going to happen. For security teams, this means accepting that malicious actors will get in. The question becomes how quickly you can detect, investigate, and stop that activity.

IT operations, with its working knowledge of system behaviors and interactions, can play a vital role in helping to detect threats before they result in disaster. They just need the tools and understanding to know what to look for. Just as line-of-business stakeholders work cross-functionally to scale knowledge and improve outcomes, security and IT ops will better serve the business through collaboration.

• Responsibility for secure operations can and should be shared: If you provide IT ops with the right tools, it’s possible for SecOps to use IT ops for some important security activities. These should be lower on the risk scale, and they should be things that don’t require a high degree of specialized knowledge.

• Cooperation benefits compliance as well: While breaches grab headlines (and garner record-setting fines), compliance failures can also have significant business consequences. Regulations such as GDPR and HIPAA require organizations to meet strict standards for protecting data and privacy. While SecOps and IT ops play their own roles in ensuring clean and compliant practices, sharing both knowledge and resources is a smarter way of scaling to meet compliance demands.

Moving Forward
From the interactions between applications to how to create secure configurations, far too often we find that IT ops and SecOps fail to share important knowledge. As too many organizations have learned the hard way, this siloed, sometimes oppositional model can have serious consequences.

There is no perfect fix for cybersecurity, and nothing will ever be 100% secure. Threat actors are highly motivated to find new and innovative ways around every solution that tries to keep them out. But with a combination of strategy, structure, staffing, and systems, it’s possible to gain an advantage that will evolve and scale to keep disaster at bay. 

Finding talented security professionals is becoming increasingly difficult. But when you promote an environment of cooperation and communication, you can build a more scalable enterprise security solution for 2019 and beyond. At the end of the day, the best team wins.

Related Content:



Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Arif Kareem is CEO and president of ExtraHop Networks. He holds over 30 years of experience formulating and executing business and operational strategies to accelerate growth in the enterprise and technology markets. Before joining ExtraHop, Kareem served ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
4/16/2019 | 3:08:15 PM
One Question?
What is the question?  :-)
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-10-19
Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
PUBLISHED: 2019-10-19
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
PUBLISHED: 2019-10-18
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.
PUBLISHED: 2019-10-18
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclo...
PUBLISHED: 2019-10-18
HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. On the Problem Report page of the Traveler servlet pages, there is a field to specify a file attachment to provide additional problem details. An invalid file name returns an error message that includes the entere...