Story image

How to drop complexity and move to a more efficient security strategy

18 Aug 17

Cybersecurity is about taking a proactive approach and organisations should stop reacting to cyber threats after they’ve suffered a breach, according to CenturyLink, but putting that into practice can overwhelm some organisations and small teams.

The company says there is no magic security bullet that will protect an organisation from all threats – and as the threat landscape expands rapidly, firms need to take an holistic prevention approach.

The idea that a security team, on its own, can prevent any attack is getting harder to put into action. The threat landscape continues to grow more varied and complex, to the point where adopting areas of holistic focus is the best approach,” comments CenturyLink’s A/NZ regional director Stuart Mills.

Here’s what CenturyLink believes are three practical countermeasures for threat detection and response.

1. Security log monitoring and SIEM technologies
The emerging best practice of prevention-centric, holistic cybersecurity countermeasures involves continuously monitoring the logs of IT assets and business systems in a mode of correlation and deep analysis that can reveal hidden risk exposure. To perform this kind of analysis, many IT departments turn to security log monitoring and security information and event management (SIEM) solutions. SIEM solutions can help detect possible threats based on data correlation.

However, executing SIEM can be complex and costly. The technology is only as effective as its configuration and continuous upkeep. This depends on expertise in data collection, the strength of the correlation rules established, and an understanding of the threat landscape, attack patterns and/or compliance requirements. It’s a budget and resource-intensive process, which requires expert security staff. 

2. Proactive threat detection and notification
Proactivity makes detection-centric security work most effective. Being proactive means correlating multiple streams of data and pulling insights from both real-time events and asset risk profiles to detect threats at the earliest stages and reduce false positives. The best way to do this is with a 24/7 security operations centre (SOC) that performs continuous monitoring, which can aid in investigation and provide deep context to threat trends. 

For a security team to act on a threat, they must receive an alert and decide on an appropriate response. Often, too many false positives and vague warnings can lead to alerts getting ignored. A proactive threat detection system must be accompanied by a sophisticated, risk-based alert process that combines automation with rigorous human review.

3. Incident management and response
Once a possible attack has been detected, the business must handle it effectively to limit damage, increase external stakeholders’ confidence, and reduce recovery time and costs. An organisation’s ability to swiftly and efficiently respond to incidents makes the difference between weathering them and incurring great damage to the business and its reputation. 

While most organisations have incident response (IR) plans in place, many don’t truly operationalise them, leaving the plans ineffective. Incident response can be expensive and distract from other security duties but this is a critical area to focus on and get right.

“Daunting as the security challenges may seem, there is no reason for organisations to be pessimistic. It’s time to shift the focus from protection to detection and response, and let go of the myth that you can protect everything, all the time. Putting the cybersecurity emphasis on detection gets businesses closer to stopping attackers before they carry out malicious acts,” Mills concludes.

Cylance makes APIs available in endpoint detection offering
Extensive APIs enable security teams to more efficiently view, enrich, and contextualise real-time intelligence collected at the endpoint to keep systems secure.
SolarWinds adds SDN monitoring support to network management portfolio
SolarWinds announced a broad refresh to its network management portfolio, as well as key enhancements to the Orion Platform. 
JASK prepares for global rollout of their AI-powered ASOC platform
The JASK ASOC platform automates alert investigations, supposedly freeing the SOC analyst to do what machines can’t. 
Pitfalls to avoid when configuring cloud firewalls
Flexibility and granularity of security controls is good but can still represent a risk for new cloud adopters that don’t recognise some of the configuration pitfalls.
Securing hotel technology to protect customer information
Network security risks increase exponentially as hotels look to incorporate newer technologies to support a range of IoT devices, including smart door locks.
Why total visibility is the key to zero trust
Over time, the basic zero trust model has evolved and matured into what Forrester calls the Zero Trust eXtended (ZTX) Ecosystem.
Gartner names Proofpoint Leader in enterprise information archiving
The report provides a detailed overview of the enterprise information archiving market and evaluates vendors based on completeness of vision and ability to execute.
Tensions on the rise after Huawei CFO arrest
“Recently our corporate CFO, Meng Wanzhou, was provisionally detained by the Canadian authorities on behalf of the United States of America."