Unfortunately cybersecurity has gotten to a point where it’s not a matter of IF you will be attacked but WHEN you will be attacked. This paradigm shift must provoke us to not only concentrate on prevention capabilities but also detection capabilities.
Prevention must still be the priority for any cybersecurity program. Proper access control to systems, good cyber hygiene, security tooling, policies etc, are still very important. However, looking at the threat landscape, these are not enough. It’s unrealistically courageous to claim one’s systems are attack proof. Attackers are getting sophisticated, more complex and utterly creative by the day. This means defense teams will stay trying to play catch up, unless some revolutionary technology is able to detect zero day attacks (a fundamentally near-impossible scenario at least for the time being).
So if attacks are inevitable in our environments, then what can we do about it? Well, good security teams will aim for four things in this scenario:
This continuous monitoring includes monitoring user activity, endpoint activity (workstations + servers), network activity monitoring and application monitoring for unusual or suspicious activity.
Technologies such as SIEM (Security Information and Event Management) and XDR (extended Detection and Response), among others, help achieve this objective. They can allow you to collect audit logs and events from different parts of your environment and run logic and correlations on your data 📈 to surface interesting patterns such as alerts of attacker patterns in your environment.
Now, IR is one of my favorite topics in cybersecurity simply because its success is also largely dependent on how well an organization balances between its use of technology, its people and the processes that knit the first two together. Remember, the goal is to shorten the MTTR. This technology, process and people triad must be well defined and aligned for a successful IR process.
The four points presented above are broad and can be expanded. The reader is urged to research more on the points presented above.
This blog has highlighted that cybersecurity attacks are not only on the rise, but they are also inevitable. Organizations must continue to protect themselves through prevention best practices. In addition, they must also prepare for eventual breach of their preventions (preventative controls). This can be achieved through continuous monitoring of the environment and having detection capabilities, including baselining for anomaly detection. This requires collecting all relevant data.
Lastly, organizations must have a well defined incident response plan in order to handle cyber attacks in time and avoid even further repercussions as a result of attacks.
Prevent. Detect. Respond.
Written by Marvin Ngoma.
If you have any questions about the concepts in this blog, about ZCAN or would like to have training, awareness enablement or cybersecurity support, please reach out to info@zcan.org