Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
8/25/2015
10:50 AM
Michael Sentonas
Michael Sentonas
Partner Perspectives
50%
50%

What Would You Do Differently If You Knew You Were Going To Be Robbed?

Neither prevention nor detection alone is sufficient in today's cybercrime environment.

Losing irreplaceable photos, laptops without current backups, and heirloom jewelry are among the biggest fears if your house is robbed. We use deadbolts, alarm systems, and other protection features to deter robbers, but what would you do if you knew for sure that someday in the near future you would be robbed? Back up the photos and laptop offsite? Put the jewelry in a safe? What if your alarm company told you that all of its customers had been robbed, some just don’t know it yet?

Some security experts say that there are only two types of companies: those that have been hacked, and those that don’t know they have been hacked. Since the beginning of cybercrime, security has focused on prevention. Firewalls got thicker, scanners more detailed, blacklists longer, and whitelists more specific. Unfortunately, as the threat volume continues to grow, attack surfaces grow wider, and new devices become harder to protect, we need to acknowledge that sometimes attacks will get through.

Clearly, we should not be giving up and accepting the notion that the only possible states are hacked, being hacked, and about to be hacked; there is still a lot we can do to improve protective and preventive measures. If we acknowledge the increased risk, then we should plan to be better prepared for the possibility of a breach, detecting it sooner, and correcting it faster. Many recent attacks on companies have gone on for months -- sometimes even years -- without being detected. We need to start shifting priorities so that we are balancing the amount of time and money being spent on prevention and allocating more time and budget to detection.

Protect And Prevent

If you lived in a neighborhood with a high probability of a break-in, you would have more protection. But you would probably also add some documentation and surveillance techniques: a detailed home inventory with photos so that you can identify missing items; external cameras or motion sensors to let you know that unauthorized people have been snooping around;  maybe even some spy tricks such as pieces of tape or hair across the door frame, light coating of powder near the jewelry box, or desktop items arranged to highlight tampering.

Your security incident-response strategy needs similar tools. Computer-protection systems generate alerts, events, and other messages in an attempt to help you determine if you have been hacked. Unfortunately, with so many of them working in isolation, it can result in more noise than help. The other major issue is time and scale.  When dealing with a major incident, trying to work through a massive data set takes time, and trying to do it en masse compounds the problem.

A detection strategy helps to remove noise from the security messages. One place to start is the endpoints. Assuming that you can set and forget your endpoint security tools is no longer valid. These devices, usually the first stage of an attack, can provide vital assistance that helps the security team react faster and contain sooner. This includes predefined and customizable indicators of compromise, real-time and forensic event analysis, rapid response to isolate suspected infections from the network, and roll-back of recent changes. A detection strategy should also include capability to alert on future critical events or state changes for specific indicators of compromise, or more important, to look for and alert on indicators of attack before you are compromised.

Neither prevention nor detection alone is sufficient in today’s cybercrime environment. You need to be able to prevent what can be prevented, but also quickly determine if you have been compromised, how it happened, and what was stolen so that you can move to contain and recover from the theft. 

Michael Sentonas is the Chief Technology and Strategy Officer, APAC for Intel Security. Michael has been with the company for fifteen years, previously holding leadership roles such as VP and Chief Technology Officer of Security Connected, VP and CTO for Asia Pacific and, ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Can Your Patching Strategy Keep Up with the Demands of Open Source?
Tim Mackey, Principal Security Strategist, CyRC, at Synopsys,  6/18/2019
Florida Town Pays $600K to Ransomware Operators
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12346
PUBLISHED: 2019-06-24
In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XML post.
CVE-2014-9699
PUBLISHED: 2019-06-24
The MakerBot Replicator 5G printer runs an Apache HTTP Server with directory indexing enabled. Apache logs, system logs, design files (i.e., a history of print files), and more are exposed to unauthenticated attackers through this HTTP server.
CVE-2019-7231
PUBLISHED: 2019-06-24
The ABB IDAL FTP server is vulnerable to a buffer overflow when a long string is sent by an authenticated attacker. This overflow is handled, but terminates the process. An authenticated attacker can send a FTP command string of 472 bytes or more to overflow a buffer, causing an exception that termi...
CVE-2017-17945
PUBLISHED: 2019-06-24
The ASUS HiVivo aspplication before 5.6.27 for ASUS Watch has Missing SSL Certificate Validation.
CVE-2019-10271
PUBLISHED: 2019-06-24
An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once one is connected. One can also modify the profiles and cover pictures of privileged users. ...