Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

3/4/2020
10:00 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

3 Ways to Strengthen Your Cyber Defenses

By taking proactive action, organizations can face down threats with greater agility and earned confidence.

Security professionals are under much pressure. It's understandable: Within the past 12 months, 61% of US and European businesses suffered a cyberattack, up from 45% in 2018, and the figures are higher in every category of breach, according to cyber insurer Hiscox. The frequency of attacks is also up, with the number of firms reporting four or more incidents increasing from 20% to 30% over the same time period.

As cyberattacks increase in volume and get more sophisticated – and hackers become more agile – CISOs must do more to build a comprehensive security strategy that can protect critical assets, monitor impact, and recover from any unexpected attacks or disruption. Building defenses will also require a fundamental shift in thinking. Security and IT leaders should take a hard look at how they've been working and ask themselves: Is my security posture really rock-solid? Have I taken care of the IT hygiene basics that are so often the cause of successful breaches? And what are those core fundamentals I should implement to ensure the risk of cyberattacks is minimized as much as possible going forward?

Here are three fundamentals.

1. Patch Vulnerabilities Within Minutes, Not Days
Many organizations fail to patch their hardware and software in a timely manner. Our own recent research, conducted with Forrester Consulting, revealed it can take between 28 and 37 business days to patch IT vulnerabilities. When left open, these security gaps can make it easier for malicious actors to strike, paving the way for a host of damaging assaults. From disrupted systems to data breaches, enterprises cannot operate securely or protect their data (or their customers' data) if they fail to patch vulnerabilities as soon as they are discovered.

Hackers can and will use any opening available to breach networks, disrupt operations, steal data, or hold it ransom. And new exploits are discovered every day.  For example, in January the National Security Agency informed Microsoft about a vulnerability that would allow an attacker to, most significantly, enable remote code execution. (Microsoft quickly patched the vulnerability, which affected Windows 10 and Windows Server 2016/2019.)

And, despite some perceptions that Mac and iOS are more secure, Apple has been dealing with ongoing jailbreak issues for iOS devices, which create security vulnerabilities and are not always easy to patch.  

But it's not just operating systems and mainstream programs that are at risk. Qualcomm's February 2020 Security Bulletin detailed multiple vulnerabilities, each with a "High" security rating. Among them, Adobe FrameMaker suffered a memory corruption vulnerability, which could lead to arbitrary code execution, and remote attackers could also make life difficult for those who use a Belkin N300 router.

With these and so many other vulnerabilities discovered every single day, security teams must have a real-time view of their IT enterprise. Their view needs to extend across all computing devices and endpoints, and they must have the ability to quickly patch their hardware and software and monitor their environments. To that end, a unified endpoint management platform is one effective way to monitor and patch systems more quickly, thus reducing the likelihood of breaches and disruptions. [Editor's note: The author's company is one of many that offer a unified endpoint management platform.]  

2. Improve the Relationship Between IT and Security Ops
Last year prove challenging for other foundational concepts as well. Our research found a misplaced sense of confidence among IT decision-makers: Eighty percent said they were certain they could act on the results of vulnerability scans, yet fewer than half (49%) were confident they had full visibility into all the hardware/software assets in their environments, including servers, laptops, desktops, and containers.

What we found is that overall visibility dramatically improves when IT and security and operations work closer together, and they are better able to defend the entire enterprise using shared sets of actionable data. Among IT decision-makers, those with strained relationships with security (40%) struggled more with maintaining both visibility and IT hygiene compared to those with good partnerships. When these two teams build walls, things fall through the cracks, mistakes are made, breaches are inevitable, and the entire organization is at risk. All it takes is them getting on the same page about goals, areas of focus, and tools at their disposal.

3. Consolidate Point Tools
Tools proliferation is one of the biggest mistakes we see organizations make. Typically, as a problem emerges, businesses acquire a tool to remedy it. This approach often leads to a mountain of tools that are hard to manage and monitor at scale. Our research shows that in the past two years alone, IT teams obtained an average of five new tools just for security.

IT leaders need to step back and aggressively take stock of all their tools. They should identify the capabilities and deliverables their organizations need to implement, which will help them gain a clearer view into their networks and determine which tools they can consolidate across both teams. The end result will be a leaner, more judiciously managed environment that will help positive business outcomes.

Always Remain Vigilant
IT teams continue to face a tremendous challenge as they move forward into a new decade. Malicious actors are more sophisticated than ever before, while many enterprises are still struggling with strained internal relationships, unpatched vulnerabilities, and a lack of comprehensive endpoint visibility. By taking proactive action on these three steps, organizations can face down threats with greater agility and earned confidence.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "With New SOL4Ce Lab, Purdue U. and DoE Set Sights on National Security."

Chris Hallenbeck is a security professional with years of experience as a technical lead and cybersecurity expert. In his current role as CISO for the Americas at Tanium, he focuses largely on helping Tanium's customers ensure that the technology powering their business can ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Inside North Korea's Rapid Evolution to Cyber Superpower
Kelly Sheridan, Staff Editor, Dark Reading,  12/1/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Assessing Cybersecurity Risk in Todays Enterprises
Assessing Cybersecurity Risk in Todays Enterprises
COVID-19 has created a new IT paradigm in the enterprise and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25465
PUBLISHED: 2020-12-04
Null Pointer Dereference. in xObjectBindingFromExpression at moddable/xs/sources/xsSyntaxical.c:3419 in Moddable SDK before OS200908 causes a denial of service (SEGV).
CVE-2020-25461
PUBLISHED: 2020-12-04
Invalid Memory Access in the fxProxyGetter function in moddable/xs/sources/xsProxy.c in Moddable SDK before OS200908 causes a denial of service (SEGV).
CVE-2020-25462
PUBLISHED: 2020-12-04
Heap buffer overflow in the fxCheckArrowFunction function at moddable/xs/sources/xsSyntaxical.c:3562 in Moddable SDK before OS200903.
CVE-2020-25463
PUBLISHED: 2020-12-04
Invalid Memory Access in fxUTF8Decode at moddable/xs/sources/xsCommon.c:916 in Moddable SDK before OS200908 causes a denial of service (SEGV).
CVE-2020-25464
PUBLISHED: 2020-12-04
Heap buffer overflow at moddable/xs/sources/xsDebug.c in Moddable SDK before before 20200903. The top stack frame is only partially initialized because the stack overflowed while creating the frame. This leads to a crash in the code sending the stack frame to the debugger.