Last week I had the pleasure of giving a talk entitled “Cyber Security: time for change” on my vision of corporate cyber security posture during an event organized by Page Personnel Spain (thanks for having me!), and I already advance that a change is much needed to combat the constant threats on the Internet.
The talk began with a description of the different attacker profiles from casual attackers, employees, hacktivists and cybercrime to Nation-State attackers and how security defenses are less effective depending on the attacker.
Every week we can read in the media about companies being compromised. If we look back in recent years companies like Google, Sony, Citi, RSA, Northrup Grumman, and the list continues, have been successfully attacked. These are companies with large resources and possibly a decent level of security (firewalls, IDS, anti-virus, patches policy, etc.) and still have not been able to defend themselves.
Much is being said about APT as sophisticated attackers, but it is not correct: they just know how to use their offensive capabilities more efficiently and only need one security flaw to compromise systems.
There is a security principle which I call “Reverse Continuous Assessment” that I usually speak about to my clients. It means that any computer connected to the Internet is “audited” at least once a week by some actor, what means that every system on the Internet is constantly “audited”; hence companies can no longer use the lame excuse: “we have no enemies; no one wants to attack us”. I always recommend performing periodic security assessment to know the status of our security and where to improve.
It is clear that we need a change to effectively protect ourselves. Today too many companies solely base their security strategy on the purchase of products such as firewall, IDS, antivirus, etc., which are technologies of earlier decades and clearly inadequate. There is a quote from Albert Einstein that shows this need for change: “Insanity: doing the same thing over and over again and expecting different results.”
In my view, organizations must create a true security strategy involving the entire company and changing their mentality. First of all, they must be clear on what information is valuable, what classification it has and where it is located (usually scattered throughout the organization). Only after this exercise they can begin to design their security strategy. How are they going to protect themselves when they do not know what or from who?
The security strategy should target three fronts: technology, processes and people. Just buying security products is not a real security strategy since it only applies to technology, neglecting processes and people who are equally or even more important.
Instead of intelligence I prefer to talk about vision, getting to know our organization and knowing what must be protected and from whom. Some aspects that our security strategy should address are the following:
1) 100% dedicated security team: I understand that it is difficult for many organizations, but security is much more than managing anti-virus and firewalls. It is absolutely necessary to have qualified and dedicated staff to this task. Their training should be defensive in nature and periodic (at least annual), and it is also recommended that they have some basic offensive training to understand where attackers can come from and how to repel them.
2) Training: the entire organization must receive security awareness training tailored to their jobs so they understand and avoid the dangers of the Internet, malicious documents, social networks risks, etc. Today the cost of online training is very affordable so there is no excuse.
3) Active defenses: security defenses tend to be passive, waiting to be attacked, but they should be active. It doesn’t mean to attack the attackers -which may be even illegal because we don’t know if we counterattack the attacker itself or another victim-, but make them lose their time, waste resources or even detect and identify them by using technology such as honeypots. A fantastic project for this concept is Active Defense Harbinger Distribution (ADHD).
4) Evaluate software security posture: companies have many applications installed on their systems and the security is entrusted to the software developer, but IT and/or security staff should be able to assess all these software. Security verification technologies such as VULNEX BinSecSweeper help in this regard.
5) Secure development: I will never get tired of talking about the need of developing secure software, be it a website, a mobile App or other software, since today most attacks are due to insecure applications. Much to improve in this area!
6) Greater use of security Open Source software: organizations have a tendency to buy commercial security products since they have often a better interface; however there are many security fantastic open source solutions (IDS, antivirus, firewall, etc.) that combined with commercial security products can greatly improve corporate security.
No doubt there are many more areas for improvement in the security strategy, but the ones described here are a good start. To achieve this without dying, we must have a capable team (people) and document everything (processes). Do not write hundreds and hundreds of pages that no one is going to read, but simple and well-structured documents describing the security processes and tasks.
Nobody says it is easy, but for sure it is necessary if we want to improve corporate security and protect ourselves from threats on the Internet; meanwhile we will continue watching in the media companies of any kind being compromised…
What is your opinion of the security strategy in organizations: works or not?
— Simon Roses Femerling
