Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

9/13/2017
02:00 PM
Joshua Douglas
Joshua Douglas
Commentary
50%
50%

5 Problems That Keep CISOs Awake at Night

The last few years have shown a big difference in the way cyber-risks are acknowledged, but progress still needs to be made.

On a recent trip from Washington, DC, to Boston, I overheard a conversation on the train that I never thought I would hear. The discussion began with a passenger asking his colleague, "Did you just get this spearphishing attack? It looks so obvious."

Just two years ago, this conversation would never have happened. When you consider that 91% of targeted cyber attacks begin with a spearphishing email, open dialogue and recognition of cybersecurity threats represent a significant shift in our collective awareness of cyber-risks.

With major attacks such as WannaCry permeating news headlines and social media platforms, cybersecurity has become a mainstream topic. Unfortunately, the rise in sophistication of threats is outpacing the uptick in cybersecurity training and the growth of the talent pipeline. These concerns, among others, are what keep chief information security officers (CISOs) tossing and turning at night.

Most employees remain vastly unprepared for the risks posed by individual hackers, hacktivist groups, and state actors. This was evident earlier this year when a phishing scam spread quickly across the Internet through an email embedded within a fake Google Docs file. This was a more-advanced attack, as the scam required those affected to grant permission through a legitimate Google sign-in screen. Even the cybersecurity savvy were susceptible to this disguise.

To address today's challenges, CISOs need to reassess their common concerns and consider a different approach. Here are five things to keep in mind:

  1. Not everyone can hire a cyber unicorn. Globally, 70% of employers  plan to increase the size of their cybersecurity staff this year. Not only is there a lack of cybersecurity professionals to meet this skyrocketing demand, but there are even fewer of what I call "unicorns" — security experts who understand networks and know how to protect them. Cybersecurity unicorns are curious analysts who have experience with protecting network perimeters, scripting, and identifying endpoints. Organizations can't afford a full security detail to cover these skills, which is why we will likely see more of them opting to outsource security operations in the near future. [Editor's note: Raytheon is one of many companies that offer such services.] Cybersecurity service teams can be located anywhere and dedicate the necessary time and skills to both react to attacks and proactively hunt for them to ensure organizations remain operational and secure.

  2. The Dark Web never sleeps. The Dark Web is a breeding ground for cybercrimes and hosts all types of tools required to execute them, including malware for purchase and cybercrime services, so that criminals don't even need to be technical experts to launch a major attack. As the Internet becomes an open field for predators, organizations must hunt around the clock. The average mean time to detection of threats already on a network is around 200 days. That time — when hackers are able to steal data or damage the network — can be dramatically reduced by proactive threat hunting. This involves monitoring normal and abnormal network traffic patterns to identify threats before they become damaging.

  3. Checking the compliance box doesn't stop the breach. When it comes to managing data and hiring or outsourcing talent, many companies face budget constraints that stem from compliance. Businesses must be compliant, but compliance and security are not interchangeable when it comes to cyber attacks. Compliance is critical but shouldn't be confused with security. The Defense Federal Acquisition Regulation Supplement, for example, requires organizations to have a firewall for segmentation and logging policies. While a firewall limits access and logging provides insight on network incidents, these are only tools. Without trained people to look at the threats and act on them, there isn't enough protection. Organizations must conduct a thorough security assessment, identify existing threats and the riskiest users, prioritize security measures, and implement and test an incident response plan. Compliance often falls into place when it's the final consideration and not just a top budget item.   

  4. Reputation is on the line. Just as most travelers in the past never casually chatted about a phishing scam, board members didn't dabble in cybersecurity concerns. Today, it's a different story. There is a tremendous fear of a cyber attack severely damaging brand image and the bottom line. Organizations have a fiduciary responsibility to protect their customers' data, but cyber attacks threaten this stewardship. In healthcare, an industry with mountains of sensitive personal data, breaches by hackers affected 15.2 million Americans last year. Beyond data loss, the loss of intellectual property could further cripple organizations. To maintain the confidence of shareholders and customers, organizations must align their brand with one of security — and make sure they can back it up.

  5. When everything is connected, security is everything. Our businesses are more exposed to unseen risk than ever before from employee devices, automated manufacturing, the global supply chain, and the Internet of Things. The cyber attacks that are not visible by just looking at your own networks could cause harm to information and operational technology. Now a heating and air conditioning system could be the conduit through which nation-states attack each other. A gas turbine or nuclear facility could be a tool to harm more than just systems and put human safety at risk. So, companies need to provide cybersecurity for more than just their networks. They must embed cybersecurity into their products and services, into their supply chains, and into their partnerships.

The cybersecurity threat is hitting government agencies, commercial businesses, and critical infrastructure harder than ever before. As a result, organizations need better visibility into networks, more cyber unicorns to defend those networks, and an informed workforce capable of recognizing threats. These factors provide stronger defenses and enable CISOs to sleep better at night knowing their organizations are ready for the next attack.  

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Joshua Douglas has nearly two decades of experience in helping global enterprises and government agencies secure their most prized business/mission assets. During his 10+ years at Raytheon, he has served as the CTO for Forcepoint, overseen Raytheon's Cyber Security ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
C_3PJoe
100%
0%
C_3PJoe,
User Rank: Author
10/2/2017 | 10:48:25 PM
Re: Post
If you had a Top 10 list, where would you rate humans (i.e. threats to IP and Social Engineering)?
martin.george
50%
50%
martin.george,
User Rank: Apprentice
9/25/2017 | 11:07:01 AM
Post
Wow, I even couldn't imagine, that it is so difficult( Thanks a lot for such great article
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19317
PUBLISHED: 2019-12-05
lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact.
CVE-2019-19602
PUBLISHED: 2019-12-05
fpregs_state_valid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is used, allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact because of incorrect fpu_fpregs_owner_ctx caching, as demonstr...
CVE-2019-19601
PUBLISHED: 2019-12-05
OpenDetex 2.8.5 has a Buffer Overflow in TexOpen in detex.l because of an incorrect sprintf.
CVE-2019-19589
PUBLISHED: 2019-12-05
The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives.
CVE-2019-19597
PUBLISHED: 2019-12-05
D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters within an HNAP_AUTH HTTP header.