For Real Security, Don't Let Failure Be Your Measure of Success

Maintaining security is a critical mission for every business today, so you'd expect there to be a commonly accepted way to measure its success. But while other areas of IT are evaluated by increasingly precise and detailed metrics — availability, mean time to repair, and so on — for security, it typically comes down to a crude binary. If we got breached, we failed. If we haven't been breached, we're succeeding. But note the missing word in that last sentence: yet. In reality, every organization will be breached at some point. The only question is whether they'll know about it. To make a breach less likely to happen and less damaging when it does, we need a better way to know how well we're doing along the way.

When Pass-Fail Security Fails
The most obvious problem with the binary pass-fail approach to measuring cybersecurity success is that there's no way to use it to drive incremental improvement. More fundamentally, it's based on the false idea of perfect prevention as a goal. For years, both vendors and compliance-driven security programs have acted as if the right combination of firewalls and antivirus protection can keep companies entirely safe. As a result, they haven't focused enough on what happens when an attacker makes it through these perimeter-focused defenses. At that point, with all the emphasis having been on prevention and not detection, it's often game over for the company as the attacker moves undetected through the environment.

Assume Penetration — and Act Accordingly
Cybersecurity professionals would do well to consider the lessons learned and innovation in the residential security market. In the old days, people counted on locking their windows and doors to protect their homes, and yet burglaries remained common. It only took one forgotten lock and a burglar would soon be carrying away his loot. Perimeter alarms were similarly vulnerable to human error and brute force — until motion detectors enabled alerts no matter how intruders got in. Now, smart home technologies make it possible for people to get instant visibility of a possible home breach, see what's happening inside and around the house, lock doors and windows remotely, and call the police while there's still time.

For too long, cybersecurity has been all about preventative controls like the lock while completely missing visibility and detection controls like the camera. But even the best lock is a tactic, not a strategy. What happens when the lock fails to stop a burglar, or when an attacker bypasses the installed antivirus? At that point, the focus must shift to quick detection and reaction in order to limit the damage — and the idea of more and more locks is no longer relevant.

Make Hackers Hate You
If no product can completely prevent a breach, we must consider other metrics of success for security. A three-step approach offers a starting point for this assessment:

1. What are the most common successful attack vectors for my type of company and environment?

2. How likely would we be to detect such an attack should it occur?

3. Can we make this type of attack harder and more expensive for the hacker?

For example: For years, we all put antivirus protection on our laptops, but how would we know if it has been bypassed or if an attack were succeeding against it? If off-the-shelf commands are being run in a malicious manner on the laptop, even if there's no "malware" in a classic sense, you can be fairly sure there's an attacker involved — but first, you must be set up to detect this. What other types of attacks pose the greatest risk for your business? What signs could tip you off that they're underway, and are you able to detect them? These sorts of questions led to a fundamental transformation of the antivirus industry, from legacy players to today's thriving modern endpoint protection market.

Assume Nothing
Once you have this visibility, the next step is to create a feedback loop to continuously evaluate and improve your countermeasures. Bug bounties and attack simulations by modern penetration test firms will tell you what's working and what isn't. Returning to our home security analogy, homeowners often concentrate resources such as cameras and motion detectors around the TV, but a simulation could show that a burglar's most likely target is the jewelry in the bedroom. To make the most of finite cybersecurity resources, the most effective strategy is to deploy detection and visibility throughout your environment, run simulations to see where what a successful attack will look like, and then use this knowledge to deploy defenses where they'll do the most good.

Visibility, detection, and the continuous improvement they enable can make it harder to breach your environment. To make it more expensive for attackers as well, you also want to pepper your environment with detection tools that instantly phone home if accessed by an attacker. Historically this was done via hard-to-maintain tools like honeypots, but today it's easily accomplished via modern products (for instance, the Thinkst Canary).

By shifting from a model of "100% focus on preventative controls with a compliance mindset" to "obtaining visibility and using feedback loops to give us data on where to better allocate our security resources," we can define and measure cybersecurity success in a way that's both more realistic and more useful for driving improvement. Are you detecting the attackers that matter most? How quickly and accurately? Strengthen and shift your resources based on what you've learned. Repeat.

Related Content:

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.