Threat Intelligence

2/28/2019
02:30 PM
Joshua Goldfarb
Joshua Goldfarb
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
100%
0%

Solving Security: Repetition or Redundancy?

To effectively defend against today's risks and threats, organizations must examine their failings as well as their successes.

In life in general — and, of course, in security specifically — it is helpful to understand when I am the problem or when my organization is the problem. By that, I mean that it is important to discern when an approach to a problem is simply ineffective. When I understand that an approach doesn't work, I can try different things until I find the right solution. This is the definition of repetition.

Redundancy, on the other hand, is when I (or my organization) keeps trying the same approach and nothing changes. It makes no sense to expect different results without a different approach. This, of course, is the definition of redundancy. What can the difference between repetition and redundancy teach us about security? An awful lot.

Intelligence: When run properly, a mature intelligence capability can help an organization understand the risks and threats it faces, bolster its detection abilities, and improve its response capabilities. On the other hand, a poorly run intelligence capability confuses decision-makers, deluges alert queues with false positives, and slows incident response.

I've seen organizations try to shove poor intelligence sources and an underdeveloped capability into security operations in an effort to leverage them. The results aren't pretty. More surprising than the results is the tendency of these organization to try this same approach again and again with the expectation that something valuable will somehow emerge from it. That's not repetition. It's redundancy.

Vendor risk management: Most medium-to-large businesses have a vendor risk management (VRM) program. The maturity of VRM programs varies widely across the security industry. Nearly all VRM programs have one thing in common: They involve a painfully manual, labor-intensive process. What's amazing to me is not that organizations struggle with a process that needs improvement. That is to be expected and will improve with time as new approaches and solutions become commonplace. What amazes me is that organizations expect different or improved results from the same broken process. That's redundancy.

Vulnerability management: Staying on top of vulnerabilities is of the utmost importance to a security organization. Whether it be endpoints, servers, web applications, or otherwise, it's important for an organization to understand where its potential points of exposure are. But to stop there is foolish. What good is a weekly report of vulnerabilities without correlating it with overall risk, sensitive and/or confidential data, system criticality, and other dimensions? Those additional dimensions give an organization the ability to leverage vulnerability information to mitigate and reduce risk. That's an approach that can be repeated. Continuing to run weekly reports merely to put them on the shelf? That's redundant.

Alerting content: Alert fatigue is a known problem that organizations struggle with. Blindly implementing default signature sets recommended by vendors and others without considering how they attempt to detect, address, and reduce risks the organization is concerned about isn't a recipe for success. It's most often a recipe for unmanageable alert volumes and an avalanche of team-drowning false positives. The fact that many organizations struggle with alert fatigue is not in the least surprising. The fact that those same organizations continue to complain about alert fatigue and expect better results without ever adjusting their approach is quite surprising. That's just plain redundant.

Incident response: Anyone who has worked in the security field for some amount of time understands the necessity and value of a mature incident response capability. What's less widely understood is the long and winding road that leads to just such a capability. I've never met a well-oiled incident response team that came together magically overnight. It's to be expected that certain processes, procedures, and functions may not work perfectly, or even fairly well, at the get-go. More important than things working perfectly is learning from when things don't work perfectly. This is easier said than done, of course.

For an organization to truly improve its incident response capability, it needs to examine its strengths and weaknesses as well as its successes and failings. This requires that the organization view itself as the problem, in the sense that there are certain functions within incident response that the security team does not perform well. Only then can repetition work its magic to improve the organization's incident response capability. Otherwise, we're in the realm of redundancy.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Josh (Twitter: @ananalytical) is an experienced information security leader with broad experience building and running Security Operations Centers (SOCs). Josh is currently co-founder and chief product officer at IDRRA and also serves as security advisor to ExtraHop. Prior to ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
3/1/2019 | 8:42:57 AM
Alert fatigue
The dread but good term FALSE POSITIVE - shows you are catching stuff but useless stuff and unless properly defined this is a waste of time and effort that takes from THE BAD STUFF.  It has been compared to looking for a needle in a pile of needles, not a haystack.  Too many legit needles out there but software unless configured correctly does not differentiate between good and bad.  It ony reports.  Unless it has active threat management built in and can run on it's own but it then better damn well be false positive aware too. 
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6149
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVE-2018-15509
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
CVE-2018-20806
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
CVE-2019-5616
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
CVE-2018-17882
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.