Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/2/2018
02:00 PM
Carol Clark
Carol Clark
Commentary
Connect Directly
Facebook
Twitter
RSS
E-Mail vvv
50%
50%

The Cybersecurity 'Upside Down'

There is no stranger thing than being breached. Here are a few ways to avoid the horror.

Like many in cybersecurity, I'm more than a bit of a sci-fi fan and was easily reeled in by Netflix's Stranger Things. Stranger Things' Upside Down is an alternative reality where none of us wants to be. Landing in the Upside Down diverts circumstances in different, unintended directions and, in some cases, permanently changes lives.  

As breach headlines and the resulting fallout of these compromises continue to stream in, it's easy to imagine that the affected companies are now experiencing their own alternative, unintended reality. This wasn't the business plan they started the year with, but it is what will be managed for months, and likely a few years, to come. It's more than a bit… upside down. 

The Cybersecurity Upside Down is the alternate reality organizations enter once they have been materially compromised. It stops business, costs millions, and can have an incalculable impact on current and future customers. It's the inevitable, not-so-alternative reality for organizations if they don't take a strategic approach to security, especially as they transform their businesses. Small changes and more investments in new, disparate tools without a seismic shift in strategy will take you to the Cybersecurity Upside Down. 

What Does the Cybersecurity Upside Down Look Like?
In two words, "reactive chaos." You have no control of your environment and most of your efforts are diverted into understanding what happened, containing the damage, and remediating the issue. New projects, including cloud development and mergers and acquisitions, are significantly stalled. An organization new to the Cybersecurity Upside Down will quickly realize it is blind to what is happening on the network, unaware of where the weaknesses are and without the ability to quickly assess risk.

How Can You Stay Out of the Upside Down?
Do whatever you can to get visibility of your entire security posture and be able to measure it easily and, preferably, continuously so you can take proactive action. Many security organizations have started instrumenting for visibility at endpoints and networks. This is important and useful in monitoring, responding to, and, in some cases, being able to block potential exploits. But this is only a start.

Understanding and establishing true visibility for code and application security is a must for today's enterprises. Most companies are developing technology and using many different infrastructure providers and third-party components, and they're accelerating development practices due to competition and new methodologies such as DevOps. If organizations are not integrating security into the entire development lifecycle, they are exposed. Practices of manual pen testing twice per year, and/or siloed testing within development provide no visibility and painful remediation in an Upside Down event. 

Make sure to ask questions. Knowing how organizations in your supply chain are developing and protecting your products gives you a line of sight into issues and areas of potential risk. How easily can they update you on the security of their solutions? How will they handle remediation for the solutions? Do they continuously test? 

Systemically Avoid the Cybersecurity Upside Down
Weaknesses and vulnerabilities can be insidious. So, how can organizations root out the unintended consequences of how their company is operating?  Automate wherever possible to provide better visibility. Automating code and application security, for example, takes the burden off of siloed teams and developers. More-secure software is delivered faster, and automation enables a continuous view of your security posture.  

Embed the Culture of Security
Just one trip to the Upside Down will highlight quickly how well or how ineffectively DevOps, security, and development teams are working together. Embedding security champions within development teams and automating and orchestrating security are good examples of how to advance the culture of security in an organization. Threat modeling and red teaming are also good exercises to go through, as long as the results are embedded in the security posture going forward and improve overall operations. By integrating security early and often into the application development process, you can have the visibility and assurance that you need for the best defense against the Cybersecurity Upside Down. 

Related Content:

Carol Clark has over 17 years of experience in the software security industry. She is currently Vice President of Marketing at CYBRIC, where she is responsible for customer success programs. She has also held numerous leadership roles at RSA Security, including vice president ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.