Seriously, don’t click back or close – I promise it’s not another one of those “buy all the newest stuff from X, Y, and Z!” Give me a minute or ten to share my thoughts on minimizing cybersecurity breaches in 2020 – it will be worth it.
‘Cybersecurity Breach’ is probably the most overused scare tactic, massively searched term, and the entire reason that RSA Conference even exists today (OK, not quite, but … yeah. It’s up there).
“You’ve been breached”, “you’re going to be breached”, “it’s not if, it’s when”, etc., etc., etc. I know you’ve all heard it. Heck, we’ve all SAID it.
The goal is simple: Zero breaches/hacks/incidents. And the reality is: It’s not going to happen.
Spoiler alert: There is no single pane of glass. There are no magic bullets. There isn’t one product that will do all your systems management, updates, and alerting for you. Contrary to what some would have you believe, no single vendor has all the products to do it, either.
That said, there are some tried-and-true methodologies, best practices, and tools that can reduce your online exposure and help minimize the likelihood of a cybersecurity breach (aka you having a Really Bad Day™).
The better news? You already very likely have several tools at your disposal to mitigate a large amount of your pain. Let’s get after it.
8 Ways to Minimize Cybersecurity Breaches
- Document All the Things
Do you have a comprehensive picture of your organization’s network and systems? Do you know what systems are exposed to the Internet? Do you have current inventory, current systems management tools, and the results of your last audit or penetration test?Use internal tools, open source tools, Shodan, or whatever tools you have; get the right tools to get the information about your network – internal and external. Map the branch offices. Do you know what cloud services you’re currently using? Do you know all your egress points? Are you aware of all the “Shadow IT” services that are in use? Even some of them? Start there; it’s a good place to get a better picture and begin to prioritize your list of “to-dos”. While my next point is still valid, getting a feel for how important/exposed systems are is a good place. IT staff rotates through, and invariably, something is missed.Selfish plug: If you’re looking for help with visibility into your external exposure, check out our SearchLight solution.
- Patch All the Things
Seriously, why is this even a conversation anymore? We’ve got decades-old, totally ridiculous vulnerabilities that are still being exploited because people aren’t patching their systems. Do it. I know – it’s not sexy, it’s not the cool stuff, and it’s difficult, because you have to plan around change control, talk to software vendors, or potentially (gasp!) upgrade systems. Sure, that sucks. Buuuuut – how bad is it going to be when you tell the Powers That Be that a 10-year-old patch you didn’t apply is why the company is being asked for a ransom payment? Probably more expensive, too.
- Isolate (Some) of the Things
OK, now some of you just fired up your email to tell me why I’m wrong. And I get it – in some cases, you cannot patch due to a valid issue. The software developer is gone, no support from the OEM, and it runs a critical production system that absolutely cannot be replaced or updated anymore. I do understand and know they’re out there. So now is the time to treat them like the pariahs they are. Isolate them. Put them on their own little virtual island. It may necessitate some networking magic, or some enhanced security functions. Microsegmentation is now far easier to implement, as are virtual firewalls that can provide another layer of defense. Best case? Use them both. Isolate network segments to only the comms that unpatchable/legacy systems use. Consider a DMZ-type scenario if possible; isolate those machines to a VLAN/network with limited access, and only to the systems they need.
- Complete All The Projects!
Fun (scary) facts(1,2,3):
- 80% of all L7 firewalls are currently deployed in port/protocol mode. They are not deployed to take advantage of their fancy “Next Gen” features.
- Very little egress filtering is done at the firewall
- DLP installations are using factory rulesets (SSN, Credit Card #), and are not updated frequently.
- DLP fingerprinting is outdated; companies are not updating DLP with latest templates/file hashes
- 50% of enterprise SIEMs are collecting less than 30% of their organization’s logs
- 47% of EDR/MDR endpoints are acting as glorified A/V agents
- Many organizations do not collect network logs (SNMP, Netflow) from devices outside a core switch/location
- Most organizations (>60%) are not collecting log data from their cloud instances, OR log collection is local to the cloud provider, and is not correlated with on-prem SIEM data.
OK, fine. So what? Where do I start, right?
If you’ve Documented All the Things and Patched All the Things, you should have an idea where to start. In some cases, finishing the L7 deployment of your firewall will help immensely with understanding and controlling application traffic. Consider implementing DLP policies that watch at first, without an explicit block/drop rule. Look into transparent proxies or ICAP proxies – if a user can manually bypass a proxy, they will.
Consider “always-on” VPNs for remote users. While less efficient, consider disabling split-tunneling on VPNs, to allow a central control policy/enforcement. SDP is also becoming more user-friendly and feasible to deploy.
Enable log collection from more devices. Servers – of course. Network devices – yes. Workstations? It depends; I would say yes in most cases, but filter & collect the relevant logs, not just “Log All The Events”.
- Train All the People!
We continue to talk about the ‘technical debt’ of our organizations, and the lack of cybersecurity skills in our industry. We also expect our users to be security experts – or at the least, security savvy.What usually happens: companies do a yearly internal phishing campaign, and then send a link to the people who fell for it. We send a reminder out to the entire organization about ‘how to be secure online’, which is promptly opened, quickly scanned, and then deleted, to be forgotten.Our industry is interesting in that we insist on our users being responsible for something that should be inherent in their jobs. Employees were hired to be accountants, paralegals, attorneys, and doctors – not to be IT security practitioners.What needs to change? Training needs to be simpler. Ongoing and easy-to-understand ‘best practices’ and ‘what to do if’ type modules. End-users do NOT care about DFIR, Threat Hunting, or exploits and 0days. They just want to do their job. Don’t assume people are as keen on this as we are.
- Automate All The Things!
Yeah, OK. Super big buzzword bullet point. But hold up – OK, maybe not automate all the things, but automation is definitely also here in a big way. Simple tasks, repetitive tasks (opening a ticket, updating lists to firewalls, IDS, EDR, etc.), or even workflow that requires an input but is mostly click-driven – these should be looked at for both speed of completion as well as consistent response. Removing the human error element can reduce exposure. Automation also has the knock-on effect of freeing up human cycles for meaningful work (like all of the above bullet points…).However… You must learn to let go. Where automation breaks is the insistence on monitoring automated flows and never fully turning them loose. This means lots of testing, and lots of process documentation and potential workflow changes. Document it, record the flow, play it back. Test it with several different use cases. But do look at where you can eliminate the boring and repetitive items that lead to easily preventable errors.
- Watch All The Things!
External threats have become much more prevalent with the near-ubiquitous use of cloud-based services. Multiple cloud vendors, hybrid cloud models, branch offices that are connected via VPN, remote users that never see the inside of a corporate office: all of them bear watching. The simplicity of dropping a file into any number of paste/sharing sites, file sharing services, and the ease of “save everything” on the major email services means a LOT of data is “out there”.Those data sources are not always properly configured or secured, and they can be found, scanned, indexed, and used in ways you may not have intended. This data – because it’s outside your control and your perimeter – should receive the attention and concern it’s due, and should be used to add context and relevance to internal threats and activity – how did that end up on that service? Who has access? How did it bypass our controls?
- Evaluate, Prioritize, Act
Let’s bring it all together. You’ve done an inventory, you found where you have critical gaps, and you’ve identified outstanding systems that need patching and projects that need completion. Maybe you’re down the path on a 5-year program, which is perfect. Our landscape changes on a day to day basis, it seems; new threats and exploits pop up that scream at us to respond and react. Vendors come at us daily with new tools, shiny new UIs, and new widgets.What should we do as the defenders and shepherds of our organizations? In my experience, the basics will always be necessary. No, they’re not flashy. They’re not what grabs attention. But ensuring a solid baseline sets you up for success, and will provide you the ability to filter quickly the sizzle from the steak, as it were. Ensure your foundation is solid, and the organization can move ahead with new projects and new technology, rather than apply every new analytics and security “platform” that comes along.
There are no quick fixes. And while some of the advice here may seem rote or too simplistic, the reality is that as an industry, the core tenets are not being handled properly. Before you entertain any new technology or vendor, do an internal inventory first.
When you’ve done that, you’ll have an excellent idea of what you need moving forward. We’d love to be part of that conversation when the time is right!
(You can learn more about SearchLight, the Leader in Digital Risk Protection, here.)