Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

2/28/2019
02:30 PM
Joshua Goldfarb
Joshua Goldfarb
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
100%
0%

Solving Security: Repetition or Redundancy?

To effectively defend against today's risks and threats, organizations must examine their failings as well as their successes.

In life in general — and, of course, in security specifically — it is helpful to understand when I am the problem or when my organization is the problem. By that, I mean that it is important to discern when an approach to a problem is simply ineffective. When I understand that an approach doesn't work, I can try different things until I find the right solution. This is the definition of repetition.

Redundancy, on the other hand, is when I (or my organization) keeps trying the same approach and nothing changes. It makes no sense to expect different results without a different approach. This, of course, is the definition of redundancy. What can the difference between repetition and redundancy teach us about security? An awful lot.

Intelligence: When run properly, a mature intelligence capability can help an organization understand the risks and threats it faces, bolster its detection abilities, and improve its response capabilities. On the other hand, a poorly run intelligence capability confuses decision-makers, deluges alert queues with false positives, and slows incident response.

I've seen organizations try to shove poor intelligence sources and an underdeveloped capability into security operations in an effort to leverage them. The results aren't pretty. More surprising than the results is the tendency of these organization to try this same approach again and again with the expectation that something valuable will somehow emerge from it. That's not repetition. It's redundancy.

Vendor risk management: Most medium-to-large businesses have a vendor risk management (VRM) program. The maturity of VRM programs varies widely across the security industry. Nearly all VRM programs have one thing in common: They involve a painfully manual, labor-intensive process. What's amazing to me is not that organizations struggle with a process that needs improvement. That is to be expected and will improve with time as new approaches and solutions become commonplace. What amazes me is that organizations expect different or improved results from the same broken process. That's redundancy.

Vulnerability management: Staying on top of vulnerabilities is of the utmost importance to a security organization. Whether it be endpoints, servers, web applications, or otherwise, it's important for an organization to understand where its potential points of exposure are. But to stop there is foolish. What good is a weekly report of vulnerabilities without correlating it with overall risk, sensitive and/or confidential data, system criticality, and other dimensions? Those additional dimensions give an organization the ability to leverage vulnerability information to mitigate and reduce risk. That's an approach that can be repeated. Continuing to run weekly reports merely to put them on the shelf? That's redundant.

Alerting content: Alert fatigue is a known problem that organizations struggle with. Blindly implementing default signature sets recommended by vendors and others without considering how they attempt to detect, address, and reduce risks the organization is concerned about isn't a recipe for success. It's most often a recipe for unmanageable alert volumes and an avalanche of team-drowning false positives. The fact that many organizations struggle with alert fatigue is not in the least surprising. The fact that those same organizations continue to complain about alert fatigue and expect better results without ever adjusting their approach is quite surprising. That's just plain redundant.

Incident response: Anyone who has worked in the security field for some amount of time understands the necessity and value of a mature incident response capability. What's less widely understood is the long and winding road that leads to just such a capability. I've never met a well-oiled incident response team that came together magically overnight. It's to be expected that certain processes, procedures, and functions may not work perfectly, or even fairly well, at the get-go. More important than things working perfectly is learning from when things don't work perfectly. This is easier said than done, of course.

For an organization to truly improve its incident response capability, it needs to examine its strengths and weaknesses as well as its successes and failings. This requires that the organization view itself as the problem, in the sense that there are certain functions within incident response that the security team does not perform well. Only then can repetition work its magic to improve the organization's incident response capability. Otherwise, we're in the realm of redundancy.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Josh (Twitter: @ananalytical) is an experienced information security leader who works with enterprises to mature and improve their enterprise security programs.  Previously, Josh served as VP, CTO - Emerging Technologies at FireEye and as Chief Security Officer for ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
3/1/2019 | 8:42:57 AM
Alert fatigue
The dread but good term FALSE POSITIVE - shows you are catching stuff but useless stuff and unless properly defined this is a waste of time and effort that takes from THE BAD STUFF.  It has been compared to looking for a needle in a pile of needles, not a haystack.  Too many legit needles out there but software unless configured correctly does not differentiate between good and bad.  It ony reports.  Unless it has active threat management built in and can run on it's own but it then better damn well be false positive aware too. 
I 'Hacked' My Accounts Using My Mobile Number: Here's What I Learned
Nicole Sette, Director in the Cyber Risk practice of Kroll, a division of Duff & Phelps,  11/19/2019
6 Top Nontechnical Degrees for Cybersecurity
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/21/2019
Anatomy of a BEC Scam
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/21/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3654
PUBLISHED: 2019-11-22
Authentication Bypass vulnerability in the Microsoft Windows client in McAfee Client Proxy (MCP) prior to 3.0.0 allows local user to bypass scanning of web traffic and gain access to blocked sites for a short period of time via generating an authorization key on the client which should only be gener...
CVE-2014-2214
PUBLISHED: 2019-11-22
Multiple cross-site scripting (XSS) vulnerabilities in POSH (aka Posh portal or Portaneo) 3.0 through 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) error parameter to /includes/plugins/mobile/scripts/login.php or (2) id parameter to portal/openrssarticle.php
CVE-2014-6310
PUBLISHED: 2019-11-22
Buffer overflow in CHICKEN 4.9.0 and 4.9.0.1 may allow remote attackers to execute arbitrary code via the 'select' function.
CVE-2014-6311
PUBLISHED: 2019-11-22
generate_doygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated privileges.
CVE-2019-16763
PUBLISHED: 2019-11-22
In Pannellum from 2.5.0 through 2.5.4 URLs were not sanitized for data URIs (or vbscript:), allowing for potential XSS attacks. Such an attack would require a user to click on a hot spot to execute and would require an attacker-provided configuration. The most plausible potential attack would be if ...