Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
10/23/2014
10:00 AM
Partner Perspectives
Partner Perspectives
Partner Perspectives
50%
50%

Enterprise Security: Why You Need a Digital Immune System

Treating enterprise security like the human body's response to illness or injury is more effective than just a barrier approach

I’ve often talked about “trial and error” hacking tactics and how organizations frequently build “rat maze” defenses in response to them. Each time they learn about a new attacker, they add or update a wall. However, a persistent rat can get through a maze, exploring different paths and gradually learning which ones are successful. Similarly, digital attackers are free to try again and again, with few consequences from a failed attempt. And unlike the human body, your enterprise is under constant attack from digital threats designed, shared, and constantly modified to damage or profit from your digital assets. 

Humans are exposed to a wide variety of risks to health and personal security. We can erect barriers against some of these risks, with hand washing, surgical masks, protective clothing, or vaccines. Other risks, such as cuts, burns, or infections, are handled with education, teaching children what is hot or sharp, and with rapid response when necessary. Building barriers that protect us from all risks may be used temporarily or for the very vulnerable, but they are impractical as a permanent solution. 

The first step in developing a digital immune system for a line of business is to get blunt, even amoral, answers to three key questions: How would attackers get rich off us? How would they ruin us? What regulations affect us? Armed with this information, you can design the appropriate security system, defend your plans, and put resources in the right place. 

If we just use digital barriers for protection, our systems are not learning how to respond to attacks more effectively. Sure, after an attack we analyze log files and quarantined files or packets for clues, but the delay between an attack and adding a new defense leaves the system vulnerable. Meanwhile, the attacker has learned about our defenses and is adapting and probing again. According to a recent Verizon report on data breaches, the time between an attack, its discovery, and containment is growing, not shrinking. 

Luckily for most of us, our personal health and safety is not subject to anywhere near the range and frequency of attacks that target our digital assets. But the body’s security system is constantly watching for internal and external threats, using our nerves, organs, and bloodstream. Conscious and subconscious processes choose the appropriate action, whether it is avoidance, prevention, or cure. New situations are added to the rule set, continuously improving our health and safety. 

Today, the security central nervous system is a piecemeal integration of security components using proprietary APIs. This organism is very slow and constrains innovation. We need to open ourselves up, so that we can quickly learn from every attack and every time we defend ourselves. We need a data exchange layer that enables our sensors and processes to publish and use information, not just with each other, but with the information that provides context for real-time protection decisions.

For example, from the sea of computers, who is communicating and has found a new service, a new process, or a new download? At this point, we don’t know if this is good or bad. But our digital immune system can move at the speed of the attacker. What is the context of the internal connection point? Have other devices followed a similar pattern? Has the status of the employee recently changed? Then, in context, a decision can be made to kill it, approve it, or investigate further. Our attackers operate in real time; we cannot operate with only a historical view. 

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
TalKlein
50%
50%
TalKlein,
User Rank: Author
10/28/2014 | 7:52:53 PM
Re: immune systems
I've seen some terrible immune system/infosecurity metaphors and analogs in my life, but this takes the cake. Congrats!
prospecttoreza
50%
50%
prospecttoreza,
User Rank: Strategist
10/27/2014 | 11:28:08 AM
immune systems
were not designed to ensure the survival of an individual organizm. it was designed so that the species survive. If you just look into all the way how actual - biological - viruses, bacteria, and parasides hack the body defenses, you'd understand that striving to build an 'immune system' will not help much. The results of 2 billion years of the arms race between body defences and the hackers, show that the only sure way of winning is isolation.
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
10/23/2014 | 11:58:45 AM
Digital Immune System
"We need a data exchange layer that enables our sensors and processes to publish and use information, not just with each other, but with the information that provides context for real-time protection decisions." This would serve as the foundation for total defense systems, and if it becomes some sort of "industry standard", then every security vendor out there would tailor their products to interface with the system efficiently. One can even argue that the OS and Applications could potentially communicate with this layer, to provide data regarding anomalous behavior. Add artifical intelligence based on threat and attack data, and you have your immune system.
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-20001
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic elements inside sift_up or sift_down_range panics. This bug leads to a drop of zeroed memory as an arbitrary type, which can result in a memory ...
CVE-2020-36317
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the sam...
CVE-2020-36318
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.
CVE-2021-28875
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow.
CVE-2021-28876
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get_unchecked() more than once for the same index when the underlying iterator panics (in certain conditions). This bug could lead to a memory safety violation due to an unmet safety r...