Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

2/28/2019
02:30 PM
Joshua Goldfarb
Joshua Goldfarb
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
100%
0%

Solving Security: Repetition or Redundancy?

To effectively defend against today's risks and threats, organizations must examine their failings as well as their successes.

In life in general — and, of course, in security specifically — it is helpful to understand when I am the problem or when my organization is the problem. By that, I mean that it is important to discern when an approach to a problem is simply ineffective. When I understand that an approach doesn't work, I can try different things until I find the right solution. This is the definition of repetition.

Redundancy, on the other hand, is when I (or my organization) keeps trying the same approach and nothing changes. It makes no sense to expect different results without a different approach. This, of course, is the definition of redundancy. What can the difference between repetition and redundancy teach us about security? An awful lot.

Intelligence: When run properly, a mature intelligence capability can help an organization understand the risks and threats it faces, bolster its detection abilities, and improve its response capabilities. On the other hand, a poorly run intelligence capability confuses decision-makers, deluges alert queues with false positives, and slows incident response.

I've seen organizations try to shove poor intelligence sources and an underdeveloped capability into security operations in an effort to leverage them. The results aren't pretty. More surprising than the results is the tendency of these organization to try this same approach again and again with the expectation that something valuable will somehow emerge from it. That's not repetition. It's redundancy.

Vendor risk management: Most medium-to-large businesses have a vendor risk management (VRM) program. The maturity of VRM programs varies widely across the security industry. Nearly all VRM programs have one thing in common: They involve a painfully manual, labor-intensive process. What's amazing to me is not that organizations struggle with a process that needs improvement. That is to be expected and will improve with time as new approaches and solutions become commonplace. What amazes me is that organizations expect different or improved results from the same broken process. That's redundancy.

Vulnerability management: Staying on top of vulnerabilities is of the utmost importance to a security organization. Whether it be endpoints, servers, web applications, or otherwise, it's important for an organization to understand where its potential points of exposure are. But to stop there is foolish. What good is a weekly report of vulnerabilities without correlating it with overall risk, sensitive and/or confidential data, system criticality, and other dimensions? Those additional dimensions give an organization the ability to leverage vulnerability information to mitigate and reduce risk. That's an approach that can be repeated. Continuing to run weekly reports merely to put them on the shelf? That's redundant.

Alerting content: Alert fatigue is a known problem that organizations struggle with. Blindly implementing default signature sets recommended by vendors and others without considering how they attempt to detect, address, and reduce risks the organization is concerned about isn't a recipe for success. It's most often a recipe for unmanageable alert volumes and an avalanche of team-drowning false positives. The fact that many organizations struggle with alert fatigue is not in the least surprising. The fact that those same organizations continue to complain about alert fatigue and expect better results without ever adjusting their approach is quite surprising. That's just plain redundant.

Incident response: Anyone who has worked in the security field for some amount of time understands the necessity and value of a mature incident response capability. What's less widely understood is the long and winding road that leads to just such a capability. I've never met a well-oiled incident response team that came together magically overnight. It's to be expected that certain processes, procedures, and functions may not work perfectly, or even fairly well, at the get-go. More important than things working perfectly is learning from when things don't work perfectly. This is easier said than done, of course.

For an organization to truly improve its incident response capability, it needs to examine its strengths and weaknesses as well as its successes and failings. This requires that the organization view itself as the problem, in the sense that there are certain functions within incident response that the security team does not perform well. Only then can repetition work its magic to improve the organization's incident response capability. Otherwise, we're in the realm of redundancy.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Josh (Twitter: @ananalytical) is currently Director of Product Management at F5.  Previously, Josh served as VP, CTO - Emerging Technologies at FireEye and as Chief Security Officer for nPulse Technologies until its acquisition by FireEye.  Prior to joining nPulse, ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
3/1/2019 | 8:42:57 AM
Alert fatigue
The dread but good term FALSE POSITIVE - shows you are catching stuff but useless stuff and unless properly defined this is a waste of time and effort that takes from THE BAD STUFF.  It has been compared to looking for a needle in a pile of needles, not a haystack.  Too many legit needles out there but software unless configured correctly does not differentiate between good and bad.  It ony reports.  Unless it has active threat management built in and can run on it's own but it then better damn well be false positive aware too. 
News
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
News
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
News
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31547
PUBLISHED: 2021-04-22
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. Its AbuseFilterCheckMatch API reveals suppressed edits and usernames to unprivileged users through the iteration of crafted AbuseFilter rules.
CVE-2021-31548
PUBLISHED: 2021-04-22
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. A MediaWiki user who is partially blocked or was unsuccessfully blocked could bypass AbuseFilter and have their edits completed.
CVE-2021-31549
PUBLISHED: 2021-04-22
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. The Special:AbuseFilter/examine form allowed for the disclosure of suppressed MediaWiki usernames to unprivileged users.
CVE-2021-31550
PUBLISHED: 2021-04-22
An issue was discovered in the CommentBox extension for MediaWiki through 1.35.2. Via crafted configuration variables, a malicious actor could introduce XSS payloads into various layers.
CVE-2021-31551
PUBLISHED: 2021-04-22
An issue was discovered in the PageForms extension for MediaWiki through 1.35.2. Crafted payloads for Token-related query parameters allowed for XSS on certain PageForms-managed MediaWiki pages.