Securing Your Network, or Networking for Security?
Every day we hear about another breach, and most of the time the information we get is fairly consistent – the breach started and finished long before it was discovered. It’s not always clear exactly how or where the attackers were able to get access because they’ve had ample time to cover their tracks. Whatever log or history data we have is massive, and sifting through it to figure out anything about the attack is very difficult and time consuming. We don’t quite know what we’re looking for and much of the evidence has come and gone.
As I survey the cybersecurity market and media coverage, I notice that:
- We’ve thrown in the towel, it’s “not if, but when” you’ll be breached.
- Many security vendors are now talking about analytics, dashboards, and big data instead of prevention.
Notably absent is the acknowledgement that the attack did not happen at a single point or computer, and that the actual theft of data was allowed because the data looked like legitimate network traffic using allowed routes through and out of the network.
We hear a lot about not having enough “security expertise”. Is that really the problem? Or is the problem that the security experts don’t really understand the full complexity of their networks? The network experts understand. These attacks are happening via network traffic – not on a device, nor with a known signature. And what do networking professionals care about? Traffic, and how it’s flowing. I maintain that there’s a lot more expertise that could help in this breach analysis and prevention than we think – we’re just not asking the right people.
In subsequent posts I’ll talk about why the networking team is becoming vital to security efforts, and why understanding how a network is constructed and performs is the best chance we have of improving our defenses.
Here is my top 10 list:
Of course I can’t speak for every board of directors, but a couple of companies on whose boards I serve have a line item on the agenda – usually during the audit committee report – to discuss cyber. Regrettably, the discussion usually lasts less than five minutes even though the headlines in the newspaper are full of corporate issues around being breached. I can’t tell if it is a lack of appreciation of how serious the problem is, or if there is even a real problem. I can’t tell if it is one of those “if I don’t ask, then I don’t have to know” problems. Solving any problem first requires acknowledgement of the problem. And the cyber attack problem is getting top billing in the news, just not in the board room.
“It’s a reflection of the age we living in. People are always trying to steal information” The main problem that encourages this kind of illegal activity is that it’s really relatively easy. Nobody thinks the hacker who stole the information from the Astros was heavily funded by a foreign government, or anything like that. Indeed, it’s quite possible the person or people involved had no more motivation than curiosity, and found it easy to get in. The challenge, of course, is that every business has secrets – how it approaches negotiation, or the pricelist for its upcoming products, or its next quarter of advertising plans. All that information is useful to others if it’s exposed. Many businesses like the Astros have treated IT security as a “high end” problem – something for banks, the military, or energy companies to worry about. But it’s just not possible to operate that way anymore – the risk of corporate embarrassment, or worse, is escalating. Attackers are finding our complex defenses are badly deployed, badly coordinated, and easy to walk through. All the attacker needs is persistence, and the search for a forgotten, unlocked “side door” onto the business can be largely automated. Defenders need to understand all the gaps, and how all the security defenses work together, even if their only target is “good enough” security. As the Astros have found, the standards of “good enough” are rising rapidly.
This was brought home in a powerful way when I recently attended a cyber security meeting in London. In addition to briefings with a number of industry analysts, this meeting also included a panel discussion with about 15 CISOs from various industries like finance, not-for-profit, publishing, media, banking, and manufacturing. To a person these CISOs said two things. First, their greatest need was skilled personal to run their networks. Second, their senior management was asking questions about not “if” they were breached but what they would do “when” they were breached. This shift in attitude, driven by all the news in recent years about breaches at large, household-name companies, was an “ah ha” moment for me.
(routing, access control, load balancing, and more). The only way to know what’s really going on is to perform an in-context analysis of the network. This is very difficult to do well, and impossible to do without automation. Furthermore, if you don’t do it, you are relegated to playing 