Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

10:30 AM
Arif Kareem
Arif Kareem
Connect Directly
E-Mail vvv

The Single Cybersecurity Question Every CISO Should Ask

The answer can lead to a scalable enterprise security solution for years to come.

In early December 2018, several major corporate breaches were made public. As the news was shared and discussed around my company, one of my colleagues jokingly asked, "I wonder if I can gift some of this free credit monitoring to my future grandchildren." It was a telling comment.

Today, every organization – regardless of industry, size, or level of sophistication – faces one common challenge: security. Breaches grab headlines, and their effects extend well beyond the initial disclosure and clean-up. A breach can do lasting reputational harm to a business, and with the enactment of regulations such as GDPR, can have significant financial consequences.

But as many organizations have learned, there is no silver bullet – no firewall that will stop threats. They are pervasive, they can just as easily come from the inside as they can from outside, and unlike your security team, who must cover every nook and cranny of the attack surface, a malicious actor only has to find one vulnerability to exploit.

The security challenge is compounded by the security talent gap, which has reached crisis levels. That is why executives in every industry must ask themselves: How do I scale the resources I have to meet the cybersecurity needs of my organization? The hidden answer: IT operations.

Uniting for a Common Purpose
In a world in which security and IT operations are often at odds, this may seem counterintuitive, but the truth is what SecOps calls "the attack surface" is what IT ops calls "the environment." And no one knows the enterprise environment – from the data center to the cloud to the branch and device edge – better than the team tasked with building and managing it.

Many of our most sophisticated customers already use IT operations to help build a more robust security posture. Drawing from conversations with these organizations, industry analysts, internal experts at ExtraHop, and my own experiences from decades working in business operations, here are some of the most important things CIOs and CISOs can do to create a co-operational framework for security and IT ops.

• Security cannot come at the expense of uptime: For any organization, ensuring the consistent availability and performance of business-critical systems is paramount. If a security measure compromises availability, the business itself is compromised. Security teams need to work with IT ops and line-of-business stakeholders to understand performance requirements and then build a security framework that accounts for an acceptable level of risk.

• It's OK to fail if you can recover: Efficient business operations always require some level of risk, and that means accepting that some failures are going to happen. For security teams, this means accepting that malicious actors will get in. The question becomes how quickly you can detect, investigate, and stop that activity.

IT operations, with its working knowledge of system behaviors and interactions, can play a vital role in helping to detect threats before they result in disaster. They just need the tools and understanding to know what to look for. Just as line-of-business stakeholders work cross-functionally to scale knowledge and improve outcomes, security and IT ops will better serve the business through collaboration.

• Responsibility for secure operations can and should be shared: If you provide IT ops with the right tools, it’s possible for SecOps to use IT ops for some important security activities. These should be lower on the risk scale, and they should be things that don’t require a high degree of specialized knowledge.

• Cooperation benefits compliance as well: While breaches grab headlines (and garner record-setting fines), compliance failures can also have significant business consequences. Regulations such as GDPR and HIPAA require organizations to meet strict standards for protecting data and privacy. While SecOps and IT ops play their own roles in ensuring clean and compliant practices, sharing both knowledge and resources is a smarter way of scaling to meet compliance demands.

Moving Forward
From the interactions between applications to how to create secure configurations, far too often we find that IT ops and SecOps fail to share important knowledge. As too many organizations have learned the hard way, this siloed, sometimes oppositional model can have serious consequences.

There is no perfect fix for cybersecurity, and nothing will ever be 100% secure. Threat actors are highly motivated to find new and innovative ways around every solution that tries to keep them out. But with a combination of strategy, structure, staffing, and systems, it’s possible to gain an advantage that will evolve and scale to keep disaster at bay. 

Finding talented security professionals is becoming increasingly difficult. But when you promote an environment of cooperation and communication, you can build a more scalable enterprise security solution for 2019 and beyond. At the end of the day, the best team wins.

Related Content:



Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Arif Kareem is CEO and president of ExtraHop Networks. He holds over 30 years of experience formulating and executing business and operational strategies to accelerate growth in the enterprise and technology markets. Before joining ExtraHop, Kareem served ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
User Rank: Apprentice
4/16/2019 | 3:08:15 PM
One Question?
What is the question?  :-)
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Russian Military Officers Unmasked, Indicted for High-Profile Cyberattack Campaigns
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-10-23
A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to visit his website by social engineering or another attack vector. Due to this issue, an unauthenticat...
PUBLISHED: 2020-10-23
FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege escalation, allowing an attacker to gain complete persistent access to the local system.
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to, contains a vulnerability in the ShadowPlay component which may lead to local privilege escalation, code execution, denial of service or information disclosure.
PUBLISHED: 2020-10-23
An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an attacker can gain access to the server.
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to, contains a vulnerability in NVIDIA Web Helper NodeJS Web Server in which an uncontrolled search path is used to load a node module, which may lead to code execution, denial of service, escalation of privileges, and information disclosure.