Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

8/19/2015
11:45 AM
Mark Clancy
Mark Clancy
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

Applying the 80/20 Rule to Cyber Security Practices

How to look holistically across technology and processes and focus resources on threats that create the greatest damage.

The 80/20 rule, or the “Pareto Principle,” states that approximately 80% of effects come from 20% of causes, reinforcing a very powerful point that distributions are rarely equal. In sales, for example, 20% of clients often represent 80% of a firm’s revenues while in the field of software development, a relatively small number of the most-reported bug fixes are likely to create solutions for the overwhelming majority of problems.

For corporate information security officers and others on the front lines in the fight against cybercrime, the key takeaway is that not all threats create the same level of risk and that resources need to be prioritized to fighting those attacks that could do the most damage to your firm or industry.  

Unfortunately, we continue to see too many instances where firms take a one-size-fits-all approach to their cyber defenses, focusing too many resources on lower-level risks, such as wide-scale malware campaigns, and not enough on the most destructive attacks or targeted probing by capable adversaries. In today’s rapidly changing cyber landscape, with threat actors growing in sophistication each and every day, this must change.

As a first step, firms need to assess their end-to-end incident response processes, with an investigation of the discovery, analysis, mitigation and closure phases, and how resources are spent in each area. Typically, firms find significant financial resource drains in many of these areas, which oftentimes can be automated and improved though technology and procedural changes. It is only when firms identify where they spend the most time that they can bring the incident response cycle down and free up resources to target on the most critical issues.

Looking at discovery, this is the phase where firms become aware of an issue. When speaking of a lower risk incident such as non-targeted phishing, many firms manually monitor inbound emails one by one, yet there are solutions to automate the entire inbound email process. Ideally, firms can shorten this discovery phase by building automation that can systematically digest inbound traffic, extract all links and identify issues company wide – promptly alerting security teams to specific threats and machine issues, enabling faster incident detection.

Next is the analysis phase. Security orchestration tools can automatically create help desk tickets, categorizing security event inflows and organizing the entire incident. This is also an area where firms are starting to leverage collaborative industry utilities that share threat information and remediation tactics across institutions and industries in order to speed up incident analysis and resolve issues. 

The call for cyber threat data sharing has been echoed by market participants, regulators and infrastructure providers alike, as firms are increasingly looking to collaborate to prevent and respond to attacks more quickly. Most recently, the US House and Senate took proactive steps to confront the cyber security challenge and are working towards enactment of legislation to improve information sharing to protect critical infrastructure. Collaborative cyber security threat information tools will not only enable firms to identify incidents more quickly, but at their best, should also empower them to either proactively prevent issues or mitigate them quickly.

When it comes to closure, sharing and learning are essential.  Following a plane crash, for example, there is a deep forensic analysis of what happened and discussion around how the aviation industry can prevent a similar occurrence. While this sounds straightforward, it currently does not happen with cybersecurity incidents today. Often firms keep incidents close to their vests out of fear of public disclosure, which has the effect of leaving other firms more vulnerable to that same attack.  We must shift away from this protective thinking to encourage firms to anonymously share details on cyber security incidents using new technologies and solutions. As more firms join in this dialogue, the process of detection and mitigation will become more efficient and the balance of power will shift away from the criminals.

Finally, we must continue to keep a close watch over the infrastructure, avoiding overly complex IT implementations and lack of investment in upgrades and system maintenance that increase our vulnerability.

While there is no easy solution to winning the war against cyber criminals, the Pareto Principle provides sound guidance on how to tackle this challenge. Foremost, we must look holistically across technology and processes to become more efficient and to focus resources on the threats that could create the greatest damage. In other words, we must shift the effort/risk paradigm to 80% effort on the 20% of the most critical incidents if we are to bend the cost and risk curves to our favor. We still have to cover 100%, but we need to close out the 80% of the noise with 20% of our energy.

Stephen Scharf is chief security officer at The Depository Trust & Clearing Corporation (DTCC). In this role he is responsible for centralizing and aligning the firm's global information security, physical security, employee safety, and crisis/incident management functions, ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MichaelMoshiri
100%
0%
MichaelMoshiri,
User Rank: Apprentice
8/24/2015 | 5:01:51 PM
Great insights...
Thank you, Mark, for the great article. The 80/20 rule is a great reminder that 100% security is not only unachievable but unnecessary. Your suggestion to take on a risk-based approach to identifying the 20% where the marjority of our energy should be concentrated is spot-on.

Since your article is mostly focused on incident response, where would you say is the sweet spot for Soltra and Soltra Edge to help enterprises to apply the 80/20 rule to their incident response activities?
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-20203
PUBLISHED: 2021-02-25
An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS s...
CVE-2021-3406
PUBLISHED: 2021-02-25
A flaw was found in keylime 5.8.1 and older. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust from the Endorsement Key certificate to agent attestations.
CVE-2021-20327
PUBLISHED: 2021-02-25
A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node....
CVE-2021-20328
PUBLISHED: 2021-02-25
Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in inte...
CVE-2020-27543
PUBLISHED: 2021-02-25
The restify-paginate package 0.0.5 for Node.js allows remote attackers to cause a Denial-of-Service by omitting the HTTP Host header. A Restify-based web service would crash with an uncaught exception.