Advanced Cyber defence is essential

[Audrey McNeil <audrey () riskbasedsecurity com>]

http://www.itnewsafrica.com/2015/12/advanced-cyber-defence-is-essential/

Online connectivity is nothing new, and threats delivered via this medium
are almost as old as the Internet itself. However, cyber security has come
into sharper focus recently as a result of how pervasive new technologies
have become, and how they are fundamentally transforming the way that we do
business.

With ubiquitous connectivity online business services are now the new
global standard, but as a result online criminal activity has also become
ever present and globally connected. Data is the common theme or currency
traded in every digital business interaction, so the value of this data has
increased hugely, and with it so has the amount of unwanted attention from
organised crime. Data is the target of a wide range of attacks. Both
businesses and individual users need to protect their data and digital
identities from these attacks, and the old methods of security are simply
no longer good enough. To counter increasingly agile, globally connected
and co-ordinated attacks, we must also adopt a multi-faceted, agile,
globally connected, and co-ordinated approach to data security.

The era of digital interaction
Technology has fundamentally altered human interaction. Take for example
smartphones and tablets, which are becoming increasingly affordable and
thus are filtering down to all walks of life. These mobile devices are in
fact full-blown computers, with enough processing power to empower users to
perform an astonishing array of tasks on the move. We have now entered the
era of digital interaction, driven by ubiquitous connectivity, with access
to business and services in an instant. This has narrowed the gap between
the business and the customer, and has also shrunk the window in which to
target, conduct and conclude business. There are huge opportunities for
businesses embracing online business models, especially as many companies
are seeing traditional revenue streams being overtaken by new digital
revenue channels, but with those opportunities businesses must responsibly
face the challenges of protecting themselves and their customers – cyber
defence.

New challenges in a digital world
Doing business in a digital world is beset with challenges, most
significantly in terms of how to safely and securely transact, and how to
protect sensitive corporate assets and customer information. In addition,
the data value chain has changed. In order to capitalise on digital
business it is essential for businesses to get closer to their data. In
many ways one could argue that their differentiation is in the data. This
data is vast, diverse and can be collected from almost anywhere, providing
significant insight, knowledge and competitive advantage, even for
organised crime. It’s that value that has caused data to in effect become a
currency in its own right, and organisations need to protect this data from
access by unauthorised persons.

The reality is that in our everyday interaction with the online world, we
leave a growing footprint of data and information that can be easily
gathered and pieced together to build a detailed profile of our private
behaviours and interactions; complete with locations, education, health,
business, family, friends, preferences and much more besides, and this
information can be exploited for criminal gain. Criminal’s first use a
practiced termed “Doxing”; researching and collecting publicly available
information about a targeted individual in order to enable the next phase
of the attack founded on Social Engineering. The information gathered about
you is used for example to send a very deliberate, tailored and believable
Phishing email. The construct of the email mimics an email from a
colleague, friend or business but often contains a bad URL link or document
containing a malware “payload”, one that could enable parallel processing
i.e. access to your system files, email inbox, keystrokes. An unsuspecting
user can let criminals into the business through a simple click. Data theft
has become big business, a vast criminal empire that is even bigger than
drug trafficking, it is actually a digital business in its own right with
attacks available for purchased off the shelf online. As businesses and as
individual users, we need to take cognisance of our digital identities and
take every possible effort to safeguard our data. We have a responsibility
to educate our children and our staff as to the dangers of “digital
interaction” – technology only protects us to a point, we must become human
firewalls.

Digital business is a global business, online and accessible every hour of
everyday for customers and criminals a like. While many people and
businesses hold onto the thought that “it won’t happen to me”, the truth is
that there are two types of business “those that know they are being
attacked, and those that don’t”. Data breaches are now a daily occurrence
globally, from both outside threats and inside threats. The latter being
the cause of multiple instances of high profile attacks over the past few
years, where millions of records were stolen. Many of these breaches
resulting in top executives having to step down from their posts and in
addition the company takes a hefty drop in share price. An impact that can
take years to recover from. The danger of data theft is real, but there are
many things that can be done to protect both corporate data and personal
information.

Multi-faceted data protection
Effective data protection today needs to cover four key areas. Firstly, it
is still essential to protect ICT infrastructure from outside threats,
using tried and trusted technologies such as intrusion prevention,
anti-virus, anti-malware. While this alone is no longer enough, it is still
an essential foundation for security and if it is not in place leaves a
significant vulnerability that will be exploited. Secondly, organisations
need to take steps to safeguard corporate IP and personal data. New digital
business models often necessitate opening up traditional value chains to
partners, service providers, and third parties which in turn can expose
sensitive assets required to conduct business. These sensitive assets
require protecting; who is accessing what data when, from where, why and
importantly should they have the rights to do so. Identity and Access
Management is essential in a world where physical boundaries shift to
virtual boundaries. Identity and access management solutions that provide
the visibility and management controls over digital identities are
essential. Furthermore such solutions should provide a richness of data
analytics to allow business to tighten the noose on data classification
over time.

The third factor to be addressed is the human element. Although having
tools and technology in place is vital, people remain the weakest link in
any security chain. For many companies out there, ICT Security is not their
core business, and as such they do not want to build an internal competency
to combat the growing cyber security threat. Many would prefer to leave it
to the experts, but still retain the parental controls. To that end,
Organisations should consider enlisting the services of specialist
enterprise security experts while retaining ownership of the Governance
Risk and Compliance (GRC) for their business, as this responsibility cannot
and should not be abdicated. These consultancy services can be extremely
valuable in helping a company to define a targeted investment cyber defence
roadmap that drives the maximum risk out of their business. Helping to
define policy to procedures, strategy to architecture, vulnerability
assessments to robust protection, penetration testing to hardened systems
and much more. One must also recognise that it is essential to embed
security into the very culture of the organisation, which requires
continual user awareness training at every level from top to bottom.
Regular education and training on new digital social etiquettes, the unseen
dangers from device capability, and of course the basic principles of
protection in a digital context can help to create the ‘human firewall’
that protects both individuals and the organisation as a whole.

The final aspect to a comprehensive and robust security solution is
advanced cyber defence, which represents an entirely new approach to
protection against globally connected, co-ordinated attacks. Advanced cyber
defence is not a tool, but a process that must go beyond traditional
security and leverage the larger global community. Typically Security
Information & Event Management systems gather data from point solutions
such as web access gateways, email gateways, firewalls, endpoints, access
controls and more, which can be analysed to maintain greater visibility
into your entire ICT Security landscape, providing persistent monitoring
and actionable intelligence. This internal view is then further augmented
with global and industry-specific threat intelligence and analysed by
security specialists, typically within a Security Operations Centres (SOC).
Other methods and technologies such as honeypots (decoy systems) are used
to gain insight into attacker and intruder behaviours. Understanding the
anatomy of a threat and methods of attack, per industry, is incredibly
useful in enabling the development of better more targeted defences. All of
this can be used to develop a security roadmap that is both prioritised in
terms of driving risk out of the business and secondly enables targeted
investment.

Changing the face of cyber security
In this shifting security landscape, the role of the reseller needs to
change. Securing people and organisations from co-ordinated, global and
sophisticated attack requires a move away from individual point solutions
toward a more connected security ecosystem. It is essential to move toward
common communication mechanisms between the various point solutions and
between vendors in order to be able to gather sufficient intelligence to
counter the growing number of advanced, persistent threats. Without common
communication, solutions are less effective because they are all working in
silos and in isolation, each trying individually to counter attacks that
exploit what may well be known weaknesses. A connected security ecosystem,
seamlessly integrated and working in harmony is the foundation to enable
advanced cyber defence. More than that however, a chain of global
partnerships must exist between customers, managed security service
providers and security hardware and software vendors so as to combine our
global threat intelligence and maintain visibility of the ever constant and
shifting threat landscape.

That said it only represents one face of the coin – being able to gain a
holistic view of the entire ICT security or threat landscape is one thing.
Being able to take corrective action quickly is the other. A connected
security ecosystem must go beyond visibility and information or
intelligence gathering. It must be able to remediate, to take corrective
action in near real time at any one of the point solutions distributed
across your business, be it changing the configuration of the Web or Email
Access Gateways or locking down infected systems, corrective measures must
be put in place as quick as possible in order to limit exposure and damage,
while preventing it from happening again.

_______________________________________________
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://lists.osvdb.org/mailman/listinfo/dataloss
For inquiries regarding use or licensing of data, e-mail
        sales () riskbasedsecurity com 

Supporters:

Risk Based Security (http://www.riskbasedsecurity.com/)
YourCISO is an affordable SaaS solution that provides a comprehensive information security program that ensures focus 
on the right security.  If you need security help or want to provide real risk reduction for your clients contact us!