Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

9/28/2017
03:30 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Key Security Innovations Focus on Policy and Tech

The New York Cyber Task Force says strategic innovations, not only technical ones, have made the biggest difference.

Members of the New York Cyber Task Force (NYCTF) argue strategic innovations have been as important, if not more so, than technical advancements for improving cybersecurity. The group today released a report following two years of examining ways to improve security defense.

The foundation of the report, which contains recommendations for shaping the future of security, can be summed up in a single quote:

"Providing satisfactory security controls in a computer system is in itself a system design problem. A combination of hardware, software, communications, physical, personnel, and administrative-procedural safeguards is required for comprehensive security. In particular, software safeguards are not sufficient."

This quote holds true today, yet it was pulled from a report published in 1970, entitled "The Ware Report." Members of NYCTF found it represented their feelings on the shortcomings of cybersecurity innovation. Nearly 40 years later, security challenges are the same.

"It encapsulated our frustration," says NYCTF executive director Jason Healey. "Why do we think another device, another widget on our network is going to change this when the stuff we've been doing for 40 years hasn't fundamentally changed?"

Group members shared their concerns and decided they "wanted to be frustrated in the right direction," he says, so they dug into the history of cybersecurity with four questions in mind:

  • Why hasn't cyberspace been defensible?
  • What innovations in technology, operations, and policy have made the biggest difference on the largest scale and at the least cost?
  • What common factors contributed to the success of these innovations?
  • Based on past successes, what new innovations deserve attention and investment?

The consensus was that history's highest-impact innovations shared two key commonalities. For starters, they put the defense at an advantage and imposed a far greater cost on attackers. They also easily, or automatically, work across businesses or all of cyberspace.

These innovations include strong encryption, securely designed software, and software that updates automatically or with little to no user intervention. The innovations that made the biggest difference "took the user out of the solution," Healey explains.

One standout, he says, was Windows Update and Microsoft's decision to push automatic updates and allow all copies of Windows to be patched with the most secure configuration.

"Microsoft made a single change — and I'm not saying it was cheap to have done that — but think about the defense advantage we're gotten from Windows Update," he notes.

Experts determined that transformative innovations have not only come from technology but organizational improvements — for example, the creation of the first Computer Emergency Response Team (CERT) in the 1980s. Other key innovations have related to governance, such as the creation of C-suite security experts in the 1990s.

"Non-technical innovation tends to have a longer shelf life," says Healey, explaining how people overlook policy when discussing innovation. "It's not a technology; it's a new doctrine that has helped drive so many positive changes in our defenses, just by an idea in how we think about it."

Another example, he continues, is the inclusion of cybersecurity ratings in Consumer Reports rankings of electronic devices. "Think about how much payoff we're going to get in market incentives," he emphasizes.

With respect to the future of innovation, members of the task force identified several innovations with potentially large effects. They see potential in a consensus between policymakers and technology leaders to build a defensible cyberspace with more-secure cloud technologies and better authentication by eliminating passwords.

The cloud was a hot topic of conversation, Healey adds. Members believe it will drive new architecture that will prove more beneficial to defenders than attackers. In the cloud, defenders can use scale to reduce complexity. If everything resides on the cloud, there is only one set to keep updated and secure rather than hundreds.

"The consensus was we haven't yet begun to really see the security payoffs we're going to get from cloud," he explains. "If a company can't have their own dedicated hunting team or incident response, if they can't do those things like the main players, the cloud will give them added security and resilience."

The report has a wealth of recommendations for government, IT and security companies, and highly IT-dependent organizations. Here are some of the key takeaways:

  • Implement the highest-leverage innovation: Push products that remove entire classes of attacks, and ensure systems are patched. Choose solutions with built-in or automatic security so the system is not dependent on users.
  • Start from the board down: Appoint tech-savvy board directors to drive the transition from compliance-based security to risk-driven approaches.
  • Emphasize agility and resilience: Develop and practice response playbooks at all organizational levels. Agility and response can apply to a broad range of security incidents.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Truths About BEC Scams
Ericka Chickowski, Contributing Writer,  6/13/2019
DNS Firewalls Could Prevent Billions in Losses to Cybercrime
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/13/2019
Cognitive Bias Can Hamper Security Decisions
Kelly Sheridan, Staff Editor, Dark Reading,  6/10/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12855
PUBLISHED: 2019-06-16
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
CVE-2013-7472
PUBLISHED: 2019-06-15
The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter.
CVE-2019-12839
PUBLISHED: 2019-06-15
In OrangeHRM 4.3.1 and before, there is an input validation error within admin/listMailConfiguration (txtSendmailPath parameter) that allows authenticated attackers to achieve arbitrary command execution.
CVE-2019-12840
PUBLISHED: 2019-06-15
In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi.
CVE-2019-12835
PUBLISHED: 2019-06-15
formats/xml.cpp in Leanify 0.4.3 allows for a controlled out-of-bounds write in xml_memory_writer::write via characters that require escaping.