Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

3/4/2020
10:00 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

3 Ways to Strengthen Your Cyber Defenses

By taking proactive action, organizations can face down threats with greater agility and earned confidence.

Security professionals are under much pressure. It's understandable: Within the past 12 months, 61% of US and European businesses suffered a cyberattack, up from 45% in 2018, and the figures are higher in every category of breach, according to cyber insurer Hiscox. The frequency of attacks is also up, with the number of firms reporting four or more incidents increasing from 20% to 30% over the same time period.

As cyberattacks increase in volume and get more sophisticated – and hackers become more agile – CISOs must do more to build a comprehensive security strategy that can protect critical assets, monitor impact, and recover from any unexpected attacks or disruption. Building defenses will also require a fundamental shift in thinking. Security and IT leaders should take a hard look at how they've been working and ask themselves: Is my security posture really rock-solid? Have I taken care of the IT hygiene basics that are so often the cause of successful breaches? And what are those core fundamentals I should implement to ensure the risk of cyberattacks is minimized as much as possible going forward?

Here are three fundamentals.

1. Patch Vulnerabilities Within Minutes, Not Days
Many organizations fail to patch their hardware and software in a timely manner. Our own recent research, conducted with Forrester Consulting, revealed it can take between 28 and 37 business days to patch IT vulnerabilities. When left open, these security gaps can make it easier for malicious actors to strike, paving the way for a host of damaging assaults. From disrupted systems to data breaches, enterprises cannot operate securely or protect their data (or their customers' data) if they fail to patch vulnerabilities as soon as they are discovered.

Hackers can and will use any opening available to breach networks, disrupt operations, steal data, or hold it ransom. And new exploits are discovered every day.  For example, in January the National Security Agency informed Microsoft about a vulnerability that would allow an attacker to, most significantly, enable remote code execution. (Microsoft quickly patched the vulnerability, which affected Windows 10 and Windows Server 2016/2019.)

And, despite some perceptions that Mac and iOS are more secure, Apple has been dealing with ongoing jailbreak issues for iOS devices, which create security vulnerabilities and are not always easy to patch.  

But it's not just operating systems and mainstream programs that are at risk. Qualcomm's February 2020 Security Bulletin detailed multiple vulnerabilities, each with a "High" security rating. Among them, Adobe FrameMaker suffered a memory corruption vulnerability, which could lead to arbitrary code execution, and remote attackers could also make life difficult for those who use a Belkin N300 router.

With these and so many other vulnerabilities discovered every single day, security teams must have a real-time view of their IT enterprise. Their view needs to extend across all computing devices and endpoints, and they must have the ability to quickly patch their hardware and software and monitor their environments. To that end, a unified endpoint management platform is one effective way to monitor and patch systems more quickly, thus reducing the likelihood of breaches and disruptions. [Editor's note: The author's company is one of many that offer a unified endpoint management platform.]  

2. Improve the Relationship Between IT and Security Ops
Last year prove challenging for other foundational concepts as well. Our research found a misplaced sense of confidence among IT decision-makers: Eighty percent said they were certain they could act on the results of vulnerability scans, yet fewer than half (49%) were confident they had full visibility into all the hardware/software assets in their environments, including servers, laptops, desktops, and containers.

What we found is that overall visibility dramatically improves when IT and security and operations work closer together, and they are better able to defend the entire enterprise using shared sets of actionable data. Among IT decision-makers, those with strained relationships with security (40%) struggled more with maintaining both visibility and IT hygiene compared to those with good partnerships. When these two teams build walls, things fall through the cracks, mistakes are made, breaches are inevitable, and the entire organization is at risk. All it takes is them getting on the same page about goals, areas of focus, and tools at their disposal.

3. Consolidate Point Tools
Tools proliferation is one of the biggest mistakes we see organizations make. Typically, as a problem emerges, businesses acquire a tool to remedy it. This approach often leads to a mountain of tools that are hard to manage and monitor at scale. Our research shows that in the past two years alone, IT teams obtained an average of five new tools just for security.

IT leaders need to step back and aggressively take stock of all their tools. They should identify the capabilities and deliverables their organizations need to implement, which will help them gain a clearer view into their networks and determine which tools they can consolidate across both teams. The end result will be a leaner, more judiciously managed environment that will help positive business outcomes.

Always Remain Vigilant
IT teams continue to face a tremendous challenge as they move forward into a new decade. Malicious actors are more sophisticated than ever before, while many enterprises are still struggling with strained internal relationships, unpatched vulnerabilities, and a lack of comprehensive endpoint visibility. By taking proactive action on these three steps, organizations can face down threats with greater agility and earned confidence.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "With New SOL4Ce Lab, Purdue U. and DoE Set Sights on National Security."

Chris Hallenbeck is a security professional with years of experience as a technical lead and cybersecurity expert. In his current role as CISO for the Americas at Tanium, he focuses largely on helping Tanium's customers ensure that the technology powering their business can ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-29379
PUBLISHED: 2021-04-12
** UNSUPPORTED WHEN ASSIGNED ** An issue was discovered on D-Link DIR-802 A1 devices through 1.00b05. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target (ST) field of the SSDP M-SEARCH discover pa...
CVE-2015-20001
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic elements inside sift_up or sift_down_range panics. This bug leads to a drop of zeroed memory as an arbitrary type, which can result in a memory ...
CVE-2020-36317
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the sam...
CVE-2020-36318
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.
CVE-2021-28875
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow.