Unfortunately cybersecurity has gotten to a point where it’s not a matter of IF you will be attacked but WHEN you will be attacked. This paradigm shift must provoke us to not only concentrate on prevention capabilities but also detection capabilities. 

Prevention must still be the priority for any cybersecurity program. Proper access control to systems, good cyber hygiene, security tooling, policies etc, are still very important.  However, looking at the threat landscape, these are not enough. It’s unrealistically courageous to claim one’s systems are attack proof. Attackers are getting sophisticated, more complex and utterly creative by the day. This means defense teams will stay trying to play catch up, unless some revolutionary technology is able to detect zero day attacks (a fundamentally near-impossible scenario at least for the time being).

So if attacks are inevitable in our environments, then what can we do about it? Well, good security teams will aim for four things in this scenario: 

1. The ability to detect an attack: Note that we are talking detect and not prevent. Detection means the capability to be alerted when there is an indication of attacker presence or attacker probing in your environment. This can only be possible through continuous monitoring of the environment. 

This continuous monitoring includes monitoring user activity, endpoint activity (workstations + servers), network activity monitoring and application monitoring for unusual or suspicious activity. 

Technologies such as SIEM (Security Information and Event Management) and XDR (extended Detection and Response), among others, help achieve this objective. They can allow you to collect audit logs and events from different parts of your environment and run logic and correlations on your data 📈 to surface interesting patterns such as  alerts of attacker patterns in your environment. 

2. The ability to ask questions and have answers to the questions in the presence of a cybersecurity attack: The usual who, when, why, where, how questions come up during cybersecurity investigations. These questions can only be answered if you have relevant data as outlined in step 1 above. In addition to the continuous monitoring mentioned above, other metadata such as threat intelligence can be utilized to confirm if what you are seeing in your environment has been seen elsewhere by other organizations. To accomplish this, you need to have tools that allow for this analytic capability. More to come on points 1 and 2 in another blog!

3. ⁠The ability to continuously baseline our environments: What is the usual behavior of users, networks, hosts and applications in our environments? Can we automatically track their evolution over time? And if their behavior tilts from normal operation, can we get alerting about it? This is where anomaly detection comes into the play. Anomaly detection is today made simple using Machine Learning (ML). Modern SIEM and XDR technology will have ML capability to help with anomaly detection. This is further extended into what is called User and Entity Behavior Analytics (UEBA), where threat detection is centered around behavior analysis of entities in our organizations e.g. users, hosts, etc.

4. ⁠A well defined Incident Response (IR) plan. While the topic of incident response is broad, here the point is to emphasize that confirmed incidents (true positives) must be investigated, contained, remediated and taken care of in as short a time as possible. The time between detection and response is called the mean-time-to-response (MTTR). The shorter the MTTR, the faster an organization recovers from cybersecurity attacks.

Now, IR is one of my favorite topics in cybersecurity simply because its success is also largely dependent on how well an organization balances between its use of technology, its people and the processes that knit the first two together. Remember, the goal is to shorten the MTTR. This technology, process and people triad must be well defined and aligned for a successful IR process. 

The four points presented above are broad and can be expanded. The reader is urged to research more on the points presented above.

This blog has highlighted that cybersecurity attacks are not only on the rise, but they are also inevitable. Organizations must continue to protect themselves through prevention best practices. In addition, they must also prepare for eventual breach of their preventions (preventative controls). This can be achieved through continuous monitoring of the environment and having detection capabilities, including baselining for anomaly detection. This requires collecting all relevant data.

Lastly, organizations must have a well defined incident response plan in order to handle cyber attacks in time and avoid even further repercussions as a result of attacks. 

Prevent. Detect. Respond.

Written by Marvin Ngoma.

If you have any questions about the concepts in this blog, about ZCAN or would like to have training, awareness enablement or cybersecurity support, please reach out to info@zcan.org