Why Everyone Is Rallying Around ‘Adaptive Security’: Part 1

Three intertwined security realities are compelling enterprises to transition from a set-and-forget approach to an adaptive security strategy.

Brett Kelsey, VP & Chief Technology Officer, Americas, Intel Security

June 15, 2016

5 Min Read

Lately there’s been a lot of buzz about “adaptive security,” a concept advanced by Gartner in the report, Designing an Adaptive Security Architecture for Protection From Advanced Attacks. Here’s what Gartner has to say: “All organizations should now assume that they are in a state of continuous compromise.”

Gartner suggests that we accept this basic assumption: The bad guys can get past our current safeguards. I believe that we can make some fundamental changes in how we approach security to shift that paradigm. How do you go about that? In this three-part blog series, we’ll explore the drivers behind this transformation and what you need to know to enable adaptive security at your organization.

An Eye-Opening Event

Let me share a personal experience I had that resulted in an epiphany. About six years ago, when I was chief security officer at a financial organization, we experienced a significant data breach. A third-party company collecting loans on our behalf was attacked by bad actors who managed to access the third party’s systems to get into our environment. So I did what any self-respecting CSO would do: I gathered together the best possible tools to do some in-depth detective work. Guess what I ended up using? Low-tech Post-it notes and a ballpoint pen. In our siloed security environment, it was really the only way to collect information from one system, compare it to the next, and ultimately diagnose what was going on.

So, drumroll, please… Here’s my big “a-ha” moment. When you have siloed, overly complex systems that don’t allow for automatic sharing of threat data -- like the one we had back at my old stomping ground -- the connectivity point is a person. The problem is, we’re dependent on people, but we don’t have enough of them. And they, in turn, don't have enough time to cull through every shred of data that security products churn out and then try to make sense of all that data.

And this brings us to the topic we’re exploring in this first blog post: the three intertwined security realities that are compelling enterprises to transition from a set-and-forget approach to an adaptive security strategy.

Reality 1: Complex, Siloed Security Infrastructures

To keep up with rapidly evolving attacks, we C-level folks and our teams face the dilemma of prioritizing where we need to invest our time and resources and then sort out the flood of new security technologies, most of which promise to be the next silver bullet. But guess what? I will break this to you gently: There’s no silver bullet. Too often, enterprises end up with technology sprawl -- a jumble of siloed multivendor products. This situation is made even worse as companies look beyond protective controls to add more detection and response capabilities.

What are we left with? Security teams end up spending their time juggling products that don’t talk to one another, along with multiple, integrated management consoles. And to top it all off, these products crank out an enormous quantity of security data that we can’t manage and can’t use.

So, despite all that earnest effort and activity, we have blind spots in the critical areas of detection and response, gaps in security coverage, a lack of visibility across the entire infrastructure, and an inability to share and act on valuable threat intelligence.

Reality 2: Too Much Data, Too Little Time

One of the things you’ll learn when you have a breach is that this patchwork of security products can generate an avalanche of threat data. Your first reaction to this may be positive, as you consider how this rich treasure trove of information can help you gain insights about security events and respond more quickly and effectively to potential attacks. But the problem is, you may not have the right tools (aside from your humble Post-it note and pen) such as real-time security information and event management (SIEM) solutions, or the qualified people to collect the data from your security tools, aggregate it, analyze it, and take the best action when indicators of attack are present.

Reality 3: Shortage Of Trained Cybersecurity Staff

Another reality that we’ve all had to face lately is a shortage of qualified security personnel. Trained and experienced security professionals with a deep understanding of advanced security tools, including SIEM, forensics, event management, and analytics, are in high demand -- and they’re scarce.

The SANS Institute’s 2015 Analytics and Intelligence Survey tells us that while the need for additional security technologies and resources has doubled since 2014, 59% of participants say that lack of a highly skilled and dedicated security staff is one of the main impediments to discovering and acting on security events and breaches.

Extrapolating further, the scarcity of resources boils down to a lack of time. If you don’t have the right people in place and enough of them, you won’t be able to sift through the huge volume of malicious code that passes through your organization, react in a timely and appropriate fashion, and prevent future attacks. Breaches will continue to be met with a surge-response team that is ill equipped to act, resulting in delays and errors that expand the impact crater.

Time To Put Away Paper And Pen And Embrace The New

As you can see, the current state of security in most enterprises is untenable and brittle. In the second blog of this series, we’ll delve more deeply into some of the mindset and cultural changes that need to take place to pave the way for an adaptive security architecture.

In the meantime, learn more about Gartner’s research in this space and approaches for implementing adaptive security by viewing this webinar, featuring Neil Macdonald from Gartner, where he talks about his adaptive security architecture concept.

About the Author(s)

Brett Kelsey

VP & Chief Technology Officer, Americas, Intel Security

Brett Kelsey is the VP and Chief Technology Officer for the Americas for Intel Security. In this role, he has leveraged his business and practice development, technical expertise, and innovative thought leadership to evangelize Intel Security's go-to-market strategy across key customer segments in the Americas; drive strategic customer engagements; and provide customer feedback to product engineering to help shape the direction of our technology.

Mr. Kelsey is a well-respected executive in the information technology field with a successful career spanning more than 25 years. An internationally recognized expert, he is renowned for his exceptional ability to conceptualize, develop, and implement technology strategies for government and private-sector clients across the healthcare, financial, education, telecommunications, and power industries. He offers in-depth knowledge of information security practices, including complying with state, federal, and industry regulations, standards, and laws such as HIPAA, ISO, NIST, ITIL, CoBIT, Sarbanes Oxley, and GLBA. Additionally, he has served as Chief Security Officer in several government departments and financial organizations.

While serving as CSO, he led the corporate security program, which is focused on ensuring the integrity, confidentiality, and availability of critical information and computing assets, as well as managing risk to enable positive growth for the company's business. Brett also oversaw security in development practices, research in critical infrastructure assurance, electronic discovery, physical security, and internet security research.

Prior to joining McAfee Inc., Mr. Kelsey was the VP of dervice felivery for NWN Corp. by way of the acquisition of Western Blue Corp. At NWN, he led a team of over 75 technical consultants focused on delivering complex IT solutions in information security, cloud & data center computing, virtualization, end-point management, network infrastructure, and IT application modernization.

In addition, Brett was a founding partner and principal security consultant with S3 Group and managing principal at Lucent Professional Services (formerly International Network Services) where he led numerous Fortune 500 client engagements providing comprehensive security solutions encompassing risk and vulnerability identification, risk assessment and mitigation, and security program development incorporating infrastructure recommendations, policies, procedures, and processes to protect critical information, systems, and assets.

Mr. Kelsey has been called upon as an expert high-tech crime witness and certified computer forensics investigator examiner in numerous high-profile computer hacker arrests and convictions. He has served as a member of the Cisco Systems Technical Leadership Council, the McAfee Partner Advisory Council, the Microsoft Security Advisory Council, the Computer Security Institute (CSI), the Information Systems Security Association, InfraGard, the Information Systems Audit & Control Association, and the Project Management Institute.

In addition to extensive professional development and technical training, Mr. Kelsey holds certifications as both a certified Information Security Systems Professional and Certified Information Security Auditor.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights