Cybersecurity is about taking a proactive approach and organisations should stop reacting to cyber threats after they’ve suffered a breach, according to CenturyLink, but putting that into practice can overwhelm some organisations and small teams.
The company says there is no magic security bullet that will protect an organisation from all threats – and as the threat landscape expands rapidly, firms need to take an holistic prevention approach.
The idea that a security team, on its own, can prevent any attack is getting harder to put into action. The threat landscape continues to grow more varied and complex, to the point where adopting areas of holistic focus is the best approach,” comments CenturyLink’s A/NZ regional director Stuart Mills.
Here’s what CenturyLink believes are three practical countermeasures for threat detection and response.
1. Security log monitoring and SIEM technologies
The emerging best practice of prevention-centric, holistic cybersecurity countermeasures involves continuously monitoring the logs of IT assets and business systems in a mode of correlation and deep analysis that can reveal hidden risk exposure. To perform this kind of analysis, many IT departments turn to security log monitoring and security information and event management (SIEM) solutions. SIEM solutions can help detect possible threats based on data correlation.
However, executing SIEM can be complex and costly. The technology is only as effective as its configuration and continuous upkeep. This depends on expertise in data collection, the strength of the correlation rules established, and an understanding of the threat landscape, attack patterns and/or compliance requirements. It’s a budget and resource-intensive process, which requires expert security staff.
2. Proactive threat detection and notification
Proactivity makes detection-centric security work most effective. Being proactive means correlating multiple streams of data and pulling insights from both real-time events and asset risk profiles to detect threats at the earliest stages and reduce false positives. The best way to do this is with a 24/7 security operations centre (SOC) that performs continuous monitoring, which can aid in investigation and provide deep context to threat trends.
For a security team to act on a threat, they must receive an alert and decide on an appropriate response. Often, too many false positives and vague warnings can lead to alerts getting ignored. A proactive threat detection system must be accompanied by a sophisticated, risk-based alert process that combines automation with rigorous human review.
3. Incident management and response
Once a possible attack has been detected, the business must handle it effectively to limit damage, increase external stakeholders’ confidence, and reduce recovery time and costs. An organisation’s ability to swiftly and efficiently respond to incidents makes the difference between weathering them and incurring great damage to the business and its reputation.
While most organisations have incident response (IR) plans in place, many don’t truly operationalise them, leaving the plans ineffective. Incident response can be expensive and distract from other security duties but this is a critical area to focus on and get right.
“Daunting as the security challenges may seem, there is no reason for organisations to be pessimistic. It’s time to shift the focus from protection to detection and response, and let go of the myth that you can protect everything, all the time. Putting the cybersecurity emphasis on detection gets businesses closer to stopping attackers before they carry out malicious acts,” Mills concludes.