News reports show cyber attacks continue to outpace IT's ability to protect critical data, but teams that have built systems to deliver accurate threat intelligence can often end an attack before damage is done. Threat intelligence comes from commercially available information, ongoing analysis of user behavior and native intelligence from within the organization.
The ideal approach is a security strategy that defeats malicious actors and leverages the extended network to stop attacks and protect critical data. Addressing the attack continuum--before, during and after the attack itself -- is a logical approach. Each step of the continuum can be approached as follows:
* Before an incident takes place, the security team is monitoring the network for any possible vulnerability. Historically, security had focused on defense. Today, teams are developing ways to more intelligently halt intruders by gaining total visibility into network environments by leveraging resources like physical and virtual hosts, operating systems, applications, services, protocols, users, content and network behavior. Security teams can use this information to take action before an attack has even begun.
* During an incident, speed is critical. Security teams should quickly identify and understand threats and how to stop them to minimize their impact. Content inspection, behavior anomaly detection, context awareness of users, devices, location information and applications and other tools are critical to understanding an attack as it is occurring. Security teams also need visibility into where, what and how users are connected to applications and resources.
* After the incident, teams should take steps to understand what took place and if damage was done how to minimize its impact. Advanced forensics and assessment tools help security teams learn from attacks. Where did the attacker come from? Where did they find a way into the network? Could anything have been done to prevent the breach? More importantly, retrospective security enables an infrastructure that can continuously gather and analyze data to create security intelligence. Compromises that would have gone undetected for weeks or months can be identified, scoped, contained and remediated.
As a result, intelligence and understanding are crucial to any defensive strategy. Cybersecurity teams are trying to learn more about malicious actors, including why and how they are attacking. This is where the extended network provides unexpected value, delivering a depth of intelligence that cannot be attained anywhere else in the computing environment. Much like in counterterrorism, intelligence is key to stopping attacks before they happen.
Just as terrorists sometimes inflict damage disproportionate to their resources, such can be the case in cyberspace. Relatively small adversaries with limited means can inflict significant damage on larger foes. In these situations, intelligence is one of the most important assets for addressing threats. But intelligence alone is of little benefit without an approach that optimizes the organizational and operational use of intelligence.
Sign up for CIO Asia eNewsletters.