Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives //

Carbon Black

8/31/2016
08:02 AM
Ben Johnson
Ben Johnson
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

Cybersecurity Self-Esteem: 4 Things Confident Teams Are Doing

By increasing our cybersecurity self-esteem, we can truly make a difference in raising our collective cybersecurity resiliency.

Security teams need to hear a public service announcement. "Believe in yourself. Have confidence. You can do it!"

It may sound corny, but it's true. I've spoken to more than 600 organizations -- from mature businesses to entry-level startups. What I’m noticing is that many of these cybersecurity teams -- from Singapore to Silicon Valley - do not have good self-esteem right now.

Believing

Progressive security teams are advancing largely because they “believe.” They believe they can improve their postures; believe they can achieve some form of resiliency; and look at their battlefield with an engineering mindset. Other security teams aren't faring so well. Too many practitioners give others too much credit and not enough to themselves.

I see and hear low self-esteem all the time:

"Oh, but our team isn't advanced."
 "Yes, but we're not software engineers."
"Our budget isn't as big as theirs."
 "We're already overwhelmed with AV alerts."
 

While I understand why these teams think they cannot change their own status-quo, they are wrong. They simply don't realize what they're capable of. They give up at being transformative or at moving to a higher maturity level -- often without much of a fight.

Wasting Time

A lack of cybersecurity self-esteem leads to wasted "security time." We've already said we don't have enough people, so why do we fail to optimize how our teams spend their time?

We should be looking at getting the greatest return-on-investment from security time. Does your team do any of these things:

  • Repeatedly respond to false alerts? 
  • Manually conduct lookups to see when a domain was registered? 
  • Fight with committees to get ports opened for your security tools? 
  • Sit in meetings that really don't require them to be there?

I see all of these way too often. Security teams are often not able to use their time most effectively. And so we fail. The adversary goes undetected. Tools aren't configured properly. Valid alerts get lost in the noise, or the hunt to find that evasive intrusion never happens. Then the annual security reports come out reflecting detection and response times in months rather than minutes. This has to change.

Building Up Our Confidence

The silver lining here is that we can build up our confidence. There are success stories. There are teams with 100,000 computers and only two FTEs that are finding and eradicating evil, and doing it in more and more automated ways.

There are companies that send their employees with little more than a laptop into countries where cyber hygiene hasn't yet become a trend, and these teams are able to find threat signals. There are teams of one or two people at banks that are continuously improving their posture so much that the red-teams are frustrated.

None of these teams are perfect, but they are progressing and raising the bar for their adversaries. Here are four things I’ve seen confident teams do successfully to help build their cybersecurity self-esteem:

  1. Extend an olive branch to IT: While you might not be enemies with IT, you probably don't have the best relationship. IT is the ultimate provider of security, so the more you can leverage IT to have gold images, setup proxies, use whitelisting of domains, URLs, and applications, and restrict user accounts, the easier your life will become.
  2. Make security a team sport: Can you get employees excited? Can you leverage that excitement so that each user is more vigilant, more cautious when doing things, and more willing to give up some freedoms such as installing random software or visiting certain websites? This vigilance goes a long way in reducing the number of threats and noisy events that clog your analysis systems.
  3. Pick a tool or technology and leverage the hell out of it: Teams have too many tools, too much information, and are overloaded with defensive "weapons" and information. Pick one type of log or technology and become experts in it. Use every feature. Leverage every alert or log and tune it to make sure the ones you don't need to see are no longer sent. Push it to its limits. Then move on to the next. You'll find that you really only need a handful of tools or logs for most of your security.
  4. Empower your team: Make hunting a perk. Empower your team to go find stuff and reward them for their time spent “outside the box” of responding to alerts. Get the team to take pride in their security posture. Be sure to keep meetings and other non-essential items to a minimum so your team feels like the Special Forces they are. Unless a meeting or task is vital, keep them in the game while they're on the clock. Then let them disconnect and rejuvenate. This will pay dividends for your organization and will also help with retaining employees.

There's a huge "can't do" attitude that’s plaguing security teams. This attitude arises because security leaders and practitioners have hit too many walls, often made of human flesh. It's time to stand up and say: “No. This is our environment. We are going to protect it.”

We may never be perfect, but we can do better. By increasing our cybersecurity self-esteem, we can truly make a difference in raising our collective cybersecurity resiliency.

Ben Johnson is CTO and co-founder of Obsidian Security. Prior to founding Obsidian, he co-founded Carbon Black and most recently served as the company's chief security strategist. As the company's original CTO, he led efforts to create the powerful capabilities that helped ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
How to Identify Cobalt Strike on Your Network
Zohar Buber, Security Analyst,  11/18/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: A GONG is as good as a cyber attack.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25660
PUBLISHED: 2020-11-23
A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the Ceph...
CVE-2020-25688
PUBLISHED: 2020-11-23
A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were incorrectly provisioned using a test certificate from the source repository. This would result in all installations using the same certificates. If an attacker could observe network traffic internal to a...
CVE-2020-25696
PUBLISHED: 2020-11-23
A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating sy...
CVE-2020-26229
PUBLISHED: 2020-11-23
TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability...
CVE-2020-28984
PUBLISHED: 2020-11-23
prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran parameters.