Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
10:50 AM
Michael Sentonas
Michael Sentonas
Partner Perspectives

What Would You Do Differently If You Knew You Were Going To Be Robbed?

Neither prevention nor detection alone is sufficient in today's cybercrime environment.

Losing irreplaceable photos, laptops without current backups, and heirloom jewelry are among the biggest fears if your house is robbed. We use deadbolts, alarm systems, and other protection features to deter robbers, but what would you do if you knew for sure that someday in the near future you would be robbed? Back up the photos and laptop offsite? Put the jewelry in a safe? What if your alarm company told you that all of its customers had been robbed, some just don’t know it yet?

Some security experts say that there are only two types of companies: those that have been hacked, and those that don’t know they have been hacked. Since the beginning of cybercrime, security has focused on prevention. Firewalls got thicker, scanners more detailed, blacklists longer, and whitelists more specific. Unfortunately, as the threat volume continues to grow, attack surfaces grow wider, and new devices become harder to protect, we need to acknowledge that sometimes attacks will get through.

Clearly, we should not be giving up and accepting the notion that the only possible states are hacked, being hacked, and about to be hacked; there is still a lot we can do to improve protective and preventive measures. If we acknowledge the increased risk, then we should plan to be better prepared for the possibility of a breach, detecting it sooner, and correcting it faster. Many recent attacks on companies have gone on for months -- sometimes even years -- without being detected. We need to start shifting priorities so that we are balancing the amount of time and money being spent on prevention and allocating more time and budget to detection.

Protect And Prevent

If you lived in a neighborhood with a high probability of a break-in, you would have more protection. But you would probably also add some documentation and surveillance techniques: a detailed home inventory with photos so that you can identify missing items; external cameras or motion sensors to let you know that unauthorized people have been snooping around;  maybe even some spy tricks such as pieces of tape or hair across the door frame, light coating of powder near the jewelry box, or desktop items arranged to highlight tampering.

Your security incident-response strategy needs similar tools. Computer-protection systems generate alerts, events, and other messages in an attempt to help you determine if you have been hacked. Unfortunately, with so many of them working in isolation, it can result in more noise than help. The other major issue is time and scale.  When dealing with a major incident, trying to work through a massive data set takes time, and trying to do it en masse compounds the problem.

A detection strategy helps to remove noise from the security messages. One place to start is the endpoints. Assuming that you can set and forget your endpoint security tools is no longer valid. These devices, usually the first stage of an attack, can provide vital assistance that helps the security team react faster and contain sooner. This includes predefined and customizable indicators of compromise, real-time and forensic event analysis, rapid response to isolate suspected infections from the network, and roll-back of recent changes. A detection strategy should also include capability to alert on future critical events or state changes for specific indicators of compromise, or more important, to look for and alert on indicators of attack before you are compromised.

Neither prevention nor detection alone is sufficient in today’s cybercrime environment. You need to be able to prevent what can be prevented, but also quickly determine if you have been compromised, how it happened, and what was stolen so that you can move to contain and recover from the theft. 

Michael Sentonas is the Chief Technology and Strategy Officer, APAC for Intel Security. Michael has been with the company for fifteen years, previously holding leadership roles such as VP and Chief Technology Officer of Security Connected, VP and CTO for Asia Pacific and, ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-02-27
SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.
PUBLISHED: 2021-02-27
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
PUBLISHED: 2021-02-27
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
PUBLISHED: 2021-02-27
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.
PUBLISHED: 2021-02-27
i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated attackers to inject arbitrary web script or HTML via C__MONITORING__CONFIG__TITLE, SM2__C__MONITORING__CONFIG__TITLE, C__MONITORING__CONFIG__PATH, SM2__C__MONITORING__CONFIG__PATH, C__M...