The short version: You only truly have security if you can see everything happening on your network. Firewalls alone stopped being enough years ago — every part of the network has to be watched for anomalies.
You only TRULY have cybersecurity if you have visibility into everything that is going on with your network. Firewalls no longer suffice, every aspect of the network must be monitored for anomalous behavior, so you can catch the bad guys before it’s too late.
Many business owners today, started their careers around the same time I did in my very early 20’s back in the mid 90’s. We tend to stick with ideas and concepts we learn early on, especially if those concepts are not our specialty. Security started off with anti-virus with a few simple attack vectors. Floppy disks, files email to you, and then eventually USB drives and downloading files from the internet. You try to open the file, the anti-virus finds that something within the file matches a known virus, and it blocks it.
That was about all we had to worry about. When I worked at one of the Big Three, we updated anti-virus definitions manually once a week. Now it is done in real time sometimes multiple times per hour. We added firewalls into the mix to block threats similarly to the way anti-virus worked, it was all based on looking for what has been seen before to block the attack.
Over the past decade, things have changed, dramatically and very quickly. We are no longer in a 1:1 security situation. Meaning, 1 product to stop 1 attack.
As the world becomes more connected, the user no longer controls all the access to the device or the internet. Software automatically updates, or can reach out on its own to talk to other systems and devices. Devices are connected to the internet so we can access them from anywhere. This vast connectivity complicates things much more and puts everything at a much higher risk. Way back when we protected desktops, laptops, and servers and our jobs were much simpler.
“an electronic device for storing and processing data, typically in binary form, according to instructions given to it in a variable program.”
We no longer can protect every computer on the network, because everything is a computer. Your security cameras, door access control systems, wireless access points, printers, conference room web cam systems, even smart plugs and smart lights are all now computers. They all have processors, storage, and run an operating system. This includes your phones and tablets.
Can you see your cameras from your phone? Can you control your lights, or heating/cooling remotely? That device is now a link that can be exploited from outside your network.
All of these are attack vectors to get into your network. Every device has vulnerability, every single one. You probably only think of protecting your computers, servers, or the network itself but so many attacks these days are carried out by attacking the weakest link which are all of those other devices that you probably don’t consider.
You can search the internet for pages dedicated (albeit unethically) to people who buy security camera systems and never change the default passwords. There’s tens of thousands of them that you can watch online and the owners have no idea. That is just one example of a device that can be exploited. You update your computers and servers all the time to protect against threats, when was the last time you updated the firmware in a camera, DVR, printer, etc.?
You may be thinking “so what?” Someone can see my cameras if they get into one. In reality, it is much more than that. Now they have access to a computer, on your network, not simply a camera. They have inside access and they can use that device for other means. It runs the software to run the camera, it can also be used to run other tools to scan your network and find other vulnerabilities. It is a foothold on your network.
In Cybersecurity there is a term, CVSS, Common Vulnerability Scoring System. Anytime a vulnerability is found, it is recorded and assigned a score. You can find them here:
Anything over a 9.0 is considered really bad, and usually that comes down to two things a bad actor can do. One is elevation of privilege, meaning they can either create themselves a new administrator user, or elevate someone else to an administrator. The other is remote code execution. Through some means they can cause a computer/server to run code as an administrator. Once that happens, they have access to everything.
Most of those high score attacks require direct access. You either need to be in front of the computer, or you need to have direct network access. You cannot exploit it over the internet.
Remember the camera example?
Now the attacker has local access. Now that 9.0 which sounded bad but in reality could not be exploited is now a 10.
That is just one example of literally thousands of attack vectors that can be used. Most are not even that technical. Social Engineering techniques to get an employee to grant access through some means of trust, or fooling them into taking specific steps to allow them to gain access.
We are no longer in a 1:1 security scenario.
That is where visibility comes in. These attacks are complex, usually multi-stage, and are carried out over a period of time.
We’re no longer in a 1:1 security situation — one product to stop one attack.
In real life, being a successful thief is hard. You decide to take up a life of crime and break into the big mansion that you always drive by. It’s your first night on the job and you make your way in…now what? There’s only so much time you can be in there before you’re caught or someone notices, meaning you have a very limited amount of time to find the best thing to steal. If you don’t, you won’t be a very successful thief. Your taking high risk for little reward unless you know where all the valuables are stored. So you need to do your homework first, case the place out to know where to go to get the best goods.
Cyber theft is similar. They break in, look around, find out where the goods are, evaluate how much your worth, and where its stored.
That takes time, and that is where visibility comes in and where our opportunity to stop them is. If a thief breaks into your house while your on vacation, neighbors see flashlights in the dark and know something is up, but if you have all your curtains closed, the thief operates at their will.
Bad actors take control of a device on your network, and starts looking for other devices, if nobody is looking for that flashlight or if they can’t see it, they also can operate at their will.
Visibility into your network is what defines security now. You will hear a lot of terms, EDR, MDR, XDR, SIEM, etc. Without diving into each one the idea is to see what is going on all the time, every second, on every device that is connected to your organization, and this includes user behavior which is by far the greatest risk.
Not all theft is from the outside. Why is this employee suddenly emailing out confidential documents to their personal email? Unless you have visibility into your network you would never know until its too late.
With proper security coverage, all this information is all fed into a system that looks for patterns. A simple example; a bad actor takes control of a very basic device on your network. It can’t do much but one thing it can do is scan for other devices on the network. That scan is a flashlight in a dark house, but if nobody is watching for it, it goes undetected.
Now they find another device, which is more powerful than the simple one they used to gain access, and with direct access they have a lot more control over what they can do.
Without you knowing, the thief can safely turn on all the lights in the house and you never know they are there.
But if we have visibility into the network, we can see all these things happening and we can take action. We can identify how they got in and stop them before they get to a certain point. Time is generally on our side, if we take advantage of it. Remember the thieves need to find the valuables. We can look for anomalous behavior. Network scans, users trying to run commands they should not because their PC’s have been taken over, odd traffic leaving the network, and connecting to external command control systems that cyber criminals use.
With this kind of security coverage, we consume literally millions of data points, and that can be just in a single 24 hour period in a 50 person company and we look for those patterns. Ransomware attacks are not simple, 10-30 things happen in the background before the actual attack happens, those are patterns we can recognize if we have visibility.
We operate under the assumption they are going to get in; we are far beyond the idea of prevention, it is all about mitigation. We put a fence up to stop someone getting in, we have an alarm in case they breach that fence, the same idea applies to cybersecurity.
If you do not have visibility you do not have security. The great thing about visibility is it is very hard to turn off. Firewalls can be defeated and circumvented, same with antivirus agents, even EDR agents can be defeated, but the lack of communication from those devices is just as telling as if they were doing something bad. If we’re not getting the data we’re expecting, we know something is needing investigation. We can detect issues multiple ways and its almost impossible to turn them all off. From there we can discover what is going and mitigate the situation.
You would be amazed at the number of attacks a device receives in a day.
A customer’s web server that is internet facing to serve their 50 employees sees upwards of 20,000 attacks a day
Malicious behavior can also be masked as valid behavior, so we track down every instance to make sure it is legitimate. Here is a snap shot from one of our customers, 22 employees and this is over one week. There were 140 incidents that required investigation. Every one of them was vetted, and either marked as valid operations which could have malicious intent, or just part of normal every day business.
In a week there were so many instances that were suspicious, and unless we validate each one, any of them could have turned out to be the thing that shuts them down and damages their business.
If you do not have that level of security, then you have no security. You don’t just lock one door to your home, you lock every door… and have an alarm… and cameras… and a dog… Security needs to be multi-layered. Implementing this is less expensive than you think, and for sure less expensive than being a victim of a cyber attack. It is the bare minimum needed to protect your business.
“But I’m not a target”…yes you are. Automation and AI have done wonders for cyber criminals. Remember that website with all the vulnerabilities in all those products? They are constantly scouring the internet for devices which are vulnerable.
They don’t know if you’re a $100,000 company or a $10,000,000 company. Automated bots look for devices which match vulnerabilities. Ironically the tools that are out there to protect you, they use against you. If that CVSS database didn’t exist it would make their lives much more difficult, but that list keeps a nice tidy up to date list of vulnerabilities for them to look for.
Once they get in, only then do they know the scope. Even if your business has nothing they want directly from you, everyone has something of value. Information and the familiarity they create with it is one of their most valuable targets. You maybe a smaller business but lets say you do work for a larger one. You now become and entry point into that larger business. Phishing emails are always more successful if they come from a trusted source, and now you’ve become that trusted source. Without visibility they can take their time scouring your emails and other communications, unbeknownst to you, to craft perfect phishing emails.
Social engineering works, because of familiarity and trust. An email from you, or one of your employees to a customer with real facts goes a long way. “I updated this document for the project we’re working on for you and I need you to double check so we can get it done by next Friday as we discussed”
If you’re on the other side of that email it sounds perfectly legit. I’m working with that company, they are doing a project for us, and yes we asked it to be done by next Friday as we asked, I’m going to respond so things don’t get off track.
That document can even be real, but it leads to a credential phishing website that looks legit but is not, and now you’ve given them access to one of your customers.
Thieves get caught when they draw attention, and cyber criminals are no different. Once they take overt action they are caught, but then its too late. Visibility lets us shine the spotlight on their activity when we can catch them, before they take action and harm your business.
Sources