Businesses face 'cyber black holes' without complete visibility

Cyber attacks may seem unpredictable but high-profile breaches tend to have a similar storyline: old, unpatched vulnerabilities, advanced persistent threats, and a lack of visibility.

That's according to the team at ForeScout, who believes that cyber attacks new and old aren't so different.

"Three of the biggest cyber incidents in the last 12 months have come from the invisible network or IoT breaches," comments ForeScout's chief marketing officer Steve Redman.

Although he doesn't explicitly name those breaches, he believes that organisations are getting swallowed up in a 'black hole' caused by a lack of visibility.

"Companies spend millions on security but can't see the last mile. There's a black hole that's big enough for cybercriminals to take advantage of and traditional cybersecurity methods simply cannot keep pace," Redman says.

The company cites Gartner's long-advocated 'adaptive security architecture', which provides continuous security and visibility into different layers.

"Security leaders must shift their mindset from incident response to continuous response, spend less time on prevention and invest in detection and response," Gartner explains in a Smarter with Gartner blog post.

"Context-aware networks are able to provide multiple sources of information that security professionals can use to determine if an attack is taking place. Enterprises should architect for comprehensive, continuous security to provide visibility across different layers for future security.

Because organisations can't protect what they can't see, ForeScout says network visibility has never been more important.

Siloed security approaches lack complete visibility into risks including orphan virtual machines, rogue software installations, and connected devices.

ForeScout believes that the days of a simple and standardised IT infrastructure are long over. The new era is about cloud, software-defined networking and the Internet of Things.

The company says that regardless of where devices and data are located, organisations must understand who has access to that data, where that data resides, and what is running on the network.

"Defence in depth has been a prescribed cyber best practice for years, however multi-vendor environments quickly increase complexity and management overhead. Something as simple as a missing or broken agent can mean gaps in visibility and control of endpoint and devices. This creates cyber blind spots, which are prime targets for hackers," Redman says. "Visibility can shine a light on these devices and close cybersecurity hygiene gaps. Poor network visibility and slow response to cyber threats can be corrected by implementing a unified cybersecurity framework for accurate network intelligence," he concludes.