Applying the 80/20 Rule to Cyber Security Practices

The 80/20 rule, or the “Pareto Principle,” states that approximately 80% of effects come from 20% of causes, reinforcing a very powerful point that distributions are rarely equal. In sales, for example, 20% of clients often represent 80% of a firm’s revenues while in the field of software development, a relatively small number of the most-reported bug fixes are likely to create solutions for the overwhelming majority of problems.

For corporate information security officers and others on the front lines in the fight against cybercrime, the key takeaway is that not all threats create the same level of risk and that resources need to be prioritized to fighting those attacks that could do the most damage to your firm or industry.  

Unfortunately, we continue to see too many instances where firms take a one-size-fits-all approach to their cyber defenses, focusing too many resources on lower-level risks, such as wide-scale malware campaigns, and not enough on the most destructive attacks or targeted probing by capable adversaries. In today’s rapidly changing cyber landscape, with threat actors growing in sophistication each and every day, this must change.

As a first step, firms need to assess their end-to-end incident response processes, with an investigation of the discovery, analysis, mitigation and closure phases, and how resources are spent in each area. Typically, firms find significant financial resource drains in many of these areas, which oftentimes can be automated and improved though technology and procedural changes. It is only when firms identify where they spend the most time that they can bring the incident response cycle down and free up resources to target on the most critical issues.

Looking at discovery, this is the phase where firms become aware of an issue. When speaking of a lower risk incident such as non-targeted phishing, many firms manually monitor inbound emails one by one, yet there are solutions to automate the entire inbound email process. Ideally, firms can shorten this discovery phase by building automation that can systematically digest inbound traffic, extract all links and identify issues company wide – promptly alerting security teams to specific threats and machine issues, enabling faster incident detection.

Next is the analysis phase. Security orchestration tools can automatically create help desk tickets, categorizing security event inflows and organizing the entire incident. This is also an area where firms are starting to leverage collaborative industry utilities that share threat information and remediation tactics across institutions and industries in order to speed up incident analysis and resolve issues. 

The call for cyber threat data sharing has been echoed by market participants, regulators and infrastructure providers alike, as firms are increasingly looking to collaborate to prevent and respond to attacks more quickly. Most recently, the US House and Senate took proactive steps to confront the cyber security challenge and are working towards enactment of legislation to improve information sharing to protect critical infrastructure. Collaborative cyber security threat information tools will not only enable firms to identify incidents more quickly, but at their best, should also empower them to either proactively prevent issues or mitigate them quickly.

When it comes to closure, sharing and learning are essential.  Following a plane crash, for example, there is a deep forensic analysis of what happened and discussion around how the aviation industry can prevent a similar occurrence. While this sounds straightforward, it currently does not happen with cybersecurity incidents today. Often firms keep incidents close to their vests out of fear of public disclosure, which has the effect of leaving other firms more vulnerable to that same attack.  We must shift away from this protective thinking to encourage firms to anonymously share details on cyber security incidents using new technologies and solutions. As more firms join in this dialogue, the process of detection and mitigation will become more efficient and the balance of power will shift away from the criminals.

Finally, we must continue to keep a close watch over the infrastructure, avoiding overly complex IT implementations and lack of investment in upgrades and system maintenance that increase our vulnerability.

While there is no easy solution to winning the war against cyber criminals, the Pareto Principle provides sound guidance on how to tackle this challenge. Foremost, we must look holistically across technology and processes to become more efficient and to focus resources on the threats that could create the greatest damage. In other words, we must shift the effort/risk paradigm to 80% effort on the 20% of the most critical incidents if we are to bend the cost and risk curves to our favor. We still have to cover 100%, but we need to close out the 80% of the noise with 20% of our energy.