Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

2/28/2019
02:30 PM
Joshua Goldfarb
Joshua Goldfarb
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
100%
0%

Solving Security: Repetition or Redundancy?

To effectively defend against today's risks and threats, organizations must examine their failings as well as their successes.

In life in general — and, of course, in security specifically — it is helpful to understand when I am the problem or when my organization is the problem. By that, I mean that it is important to discern when an approach to a problem is simply ineffective. When I understand that an approach doesn't work, I can try different things until I find the right solution. This is the definition of repetition.

Redundancy, on the other hand, is when I (or my organization) keeps trying the same approach and nothing changes. It makes no sense to expect different results without a different approach. This, of course, is the definition of redundancy. What can the difference between repetition and redundancy teach us about security? An awful lot.

Intelligence: When run properly, a mature intelligence capability can help an organization understand the risks and threats it faces, bolster its detection abilities, and improve its response capabilities. On the other hand, a poorly run intelligence capability confuses decision-makers, deluges alert queues with false positives, and slows incident response.

I've seen organizations try to shove poor intelligence sources and an underdeveloped capability into security operations in an effort to leverage them. The results aren't pretty. More surprising than the results is the tendency of these organization to try this same approach again and again with the expectation that something valuable will somehow emerge from it. That's not repetition. It's redundancy.

Vendor risk management: Most medium-to-large businesses have a vendor risk management (VRM) program. The maturity of VRM programs varies widely across the security industry. Nearly all VRM programs have one thing in common: They involve a painfully manual, labor-intensive process. What's amazing to me is not that organizations struggle with a process that needs improvement. That is to be expected and will improve with time as new approaches and solutions become commonplace. What amazes me is that organizations expect different or improved results from the same broken process. That's redundancy.

Vulnerability management: Staying on top of vulnerabilities is of the utmost importance to a security organization. Whether it be endpoints, servers, web applications, or otherwise, it's important for an organization to understand where its potential points of exposure are. But to stop there is foolish. What good is a weekly report of vulnerabilities without correlating it with overall risk, sensitive and/or confidential data, system criticality, and other dimensions? Those additional dimensions give an organization the ability to leverage vulnerability information to mitigate and reduce risk. That's an approach that can be repeated. Continuing to run weekly reports merely to put them on the shelf? That's redundant.

Alerting content: Alert fatigue is a known problem that organizations struggle with. Blindly implementing default signature sets recommended by vendors and others without considering how they attempt to detect, address, and reduce risks the organization is concerned about isn't a recipe for success. It's most often a recipe for unmanageable alert volumes and an avalanche of team-drowning false positives. The fact that many organizations struggle with alert fatigue is not in the least surprising. The fact that those same organizations continue to complain about alert fatigue and expect better results without ever adjusting their approach is quite surprising. That's just plain redundant.

Incident response: Anyone who has worked in the security field for some amount of time understands the necessity and value of a mature incident response capability. What's less widely understood is the long and winding road that leads to just such a capability. I've never met a well-oiled incident response team that came together magically overnight. It's to be expected that certain processes, procedures, and functions may not work perfectly, or even fairly well, at the get-go. More important than things working perfectly is learning from when things don't work perfectly. This is easier said than done, of course.

For an organization to truly improve its incident response capability, it needs to examine its strengths and weaknesses as well as its successes and failings. This requires that the organization view itself as the problem, in the sense that there are certain functions within incident response that the security team does not perform well. Only then can repetition work its magic to improve the organization's incident response capability. Otherwise, we're in the realm of redundancy.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Josh (Twitter: @ananalytical) is an experienced information security leader who works with enterprises to mature and improve their enterprise security programs.  Previously, Josh served as VP, CTO - Emerging Technologies at FireEye and as Chief Security Officer for ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
3/1/2019 | 8:42:57 AM
Alert fatigue
The dread but good term FALSE POSITIVE - shows you are catching stuff but useless stuff and unless properly defined this is a waste of time and effort that takes from THE BAD STUFF.  It has been compared to looking for a needle in a pile of needles, not a haystack.  Too many legit needles out there but software unless configured correctly does not differentiate between good and bad.  It ony reports.  Unless it has active threat management built in and can run on it's own but it then better damn well be false positive aware too. 
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/5/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Cybersecurity Spending Hits 'Temporary Pause' Amid Pandemic
Kelly Jackson Higgins, Executive Editor at Dark Reading,  6/2/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13871
PUBLISHED: 2020-06-06
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.
CVE-2020-13864
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom links.
CVE-2020-13865
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes.
CVE-2020-11696
PUBLISHED: 2020-06-05
In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (community, essential, professional) in version 2.7.0 and iTop essential and iTop professional in version 2.6.4.
CVE-2020-11697
PUBLISHED: 2020-06-05
In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community, essential, professional) for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4.