Today, the number of attempted data breaches, cyber attacks, and other bad behavior by bad actors continues to go up at an alarming rate. Worse, it’s clear we can only expect the problem to get worse, not better.
It’s sad to say, but we’ve clearly reached a point where the realization that hackers are out there, actively trying to gain illicit access to a company’s network, is not a new – or shocking – concept. Instead, it’s become an accepted way of life for security professionals, an inevitability they must face each and every day as they fight to protect their networks and safeguard sensitive data.
It would be one thing if security teams only had to keep up with the increasing number and types of attacks. Unfortunately, there are four emerging technology trends that present new realities and new security challenges. Through no fault of their own, these trends seem to conspire against today’s security professionals, putting them at a significant advantage and disrupting previously successful methods.
Let’s take a closer look at each of these trends, highlight the security challenges they pose, and describe the new realities security teams must face to overcome them.
Signature-based threat detection refers to those security tools or technologies, such as antivirus and intrusion detections systems (IDS), that attempt to detect, capture, and quarantine a virus or entire Malware families using their known signatures.
Yet in the past few years, malware-authoring techniques have evolved to the point where security tools that rely on threat signatures simply can’t keep up. Or, in the case of zero-day attacks, hackers can exploit a vulnerability the company didn’t even know existed, which means that no threat signature could have successfully prevented the attack. With signature-based threat detection, security teams are essentially operating in the dark – attempting to defend against an army of threats they can’t “see.” As a result, overall security suffers.
Whenever two devices in a network establish an end-to-end encrypted connection, the traffic flows between them (their “conversations”) is invisible to everything – and everyone – else. This is an effective strategy in preventing man-in-the-middle attacks, where an adversary can access the data communications between the two devices without raising an alert.
When we think about man-in-the-middle scenarios, we tend to think of them in this context – preventing bad guys from disrupting the system. Yet many of the most important enterprise-level security controls, tools such as next-generation firewalls, IDS solutions, payload detonation devices, and many more, all rely on man-in-the-middle techniques.
More specifically, they use deep packet inspection (DPI) to examine the data contents of packets as they move through the network. DPI technology searches for viruses, malware, intrusions or other example that doesn’t comply with protocol as it attempts to make a security determination. Yet end-to-end encryption makes DPI much less effective and prevents security teams from being able to detect if suspicious content exists in the packets. It is interesting to note that the larger global security intelligence has recognized the security flaws associated with end-to-end encryption and DPI, yet for the most part, the corporate world still lags a step behind.
To best understand the implications of this trend, consider this thought: Have you recently purchased an electronic device that did not attempt to connect to a network in order to do what it was designed to do? Most likely the answer is no, and examples of non-connecting devices are becoming extremely rare. It’s a trend that will continue: Gartner predicts that there will be 20.8 billion connected devices in the market by 2020.
Consider the effect of the related bring-your-own-device (BYOD) trend where employees a growing number of personal laptops, tablets, phone, and other devices in the Workplace. The problem is that these devices cannot be controlled – or secured – in the same way as other corporate assets. For example, security teams cannot:
Yet clearly, these devices have their upside and can be extremely productive, so the BYOD trend is not going away soon. This creates even more reason for companies and security teams to carefully consider their strategies and approaches.
Virtually everyone who has worked in incident response or information security realize that that there is too much information to process efficiently – or effectively. There are simply too many machines, generating too much data, requiring too many man hours for analysts to respond to various alerts, and more frequently, false positives.
These four trends all add up to the reality that enterprise security is being substantially disrupted and common security tools and technologies – even those that may have worked in the past – can’t keep up. It’s time for a new solution.
Endpoint modeling can be the answer to overcome these challenges. Endpoint modeling is a security technology that automatically discovers each device on a network, creates a model of that device’s “normal” behavior, and continuously monitors this behavior over time to look for any deviations. This way, when an exception does occur, the endpoint modeling solutions generates a real-time, actionable alert. Security analysts can quickly drill down to see exactly what is happening and take the most appropriate action to resolve the issue.
For example, endpoint modeling can tell human operators if:
Endpoint modeling also provides a solution for each of the flaws found in the four trends above.
As IT and security professionals seek new alternatives to detect and prevent and increasing number of cyber attacks, they must first consider four significant technology trends and understand their growing impact on network security. When they do, they can begin to see how endpoint modeling can provide an advantage, both in addressing these concerns and in giving them the right tools they need to improve their security efforts.
By Patrick Crowley, Founder and Chief Technology Officer, Observable Networks
