Four Trends and Realities Confronting Security Today

Realities Confronting Security

Today, the number of attempted data breaches, cyber attacks, and other bad behavior by bad actors continues to go up at an alarming rate. Worse, it’s clear we can only expect the problem to get worse, not better.

It’s sad to say, but we’ve clearly reached a point where the realization that hackers are out there, actively trying to gain illicit access to a company’s network, is not a new – or shocking – concept. Instead, it’s become an accepted way of life for security professionals, an inevitability they must face each and every day as they fight to protect their networks and safeguard sensitive data.

It would be one thing if security teams only had to keep up with the increasing number and types of attacks. Unfortunately, there are four emerging technology trends that present new realities and new security challenges. Through no fault of their own, these trends seem to conspire against today’s security professionals, putting them at a significant advantage and disrupting previously successful methods.

Let’s take a closer look at each of these trends, highlight the security challenges they pose, and describe the new realities security teams must face to overcome them.

Trend #1: The inability for threat signatures to detect all risks

Signature-based threat detection refers to those security tools or technologies, such as antivirus and intrusion detections systems (IDS), that attempt to detect, capture, and quarantine a virus or entire Malware families using their known signatures.

Yet in the past few years, malware-authoring techniques have evolved to the point where security tools that rely on threat signatures simply can’t keep up. Or, in the case of zero-day attacks, hackers can exploit a vulnerability the company didn’t even know existed, which means that no threat signature could have successfully prevented the attack. With signature-based threat detection, security teams are essentially operating in the dark – attempting to defend against an army of threats they can’t “see.” As a result, overall security suffers.

Trend #2: The increasing use of end-to-end encryption in networks

Whenever two devices in a network establish an end-to-end encrypted connection, the traffic flows between them (their “conversations”) is invisible to everything – and everyone – else. This is an effective strategy in preventing man-in-the-middle attacks, where an adversary can access the data communications between the two devices without raising an alert.

When we think about man-in-the-middle scenarios, we tend to think of them in this context – preventing bad guys from disrupting the system. Yet many of the most important enterprise-level security controls, tools such as next-generation firewalls, IDS solutions, payload detonation devices, and many more, all rely on man-in-the-middle techniques.

More specifically, they use deep packet inspection (DPI) to examine the data contents of packets as they move through the network. DPI technology searches for viruses, malware, intrusions or other example that doesn’t comply with protocol as it attempts to make a security determination. Yet end-to-end encryption makes DPI much less effective and prevents security teams from being able to detect if suspicious content exists in the packets. It is interesting to note that the larger global security intelligence has recognized the security flaws associated with end-to-end encryption and DPI, yet for the most part, the corporate world still lags a step behind.

Trend #3: The proliferation of connected devices

To best understand the implications of this trend, consider this thought: Have you recently purchased an electronic device that did not attempt to connect to a network in order to do what it was designed to do? Most likely the answer is no, and examples of non-connecting devices are becoming extremely rare. It’s a trend that will continue: Gartner predicts that there will be 20.8 billion connected devices in the market by 2020.

Consider the effect of the related bring-your-own-device (BYOD) trend where employees a growing number of personal laptops, tablets, phone, and other devices in the Workplace. The problem is that these devices cannot be controlled – or secured – in the same way as other corporate assets. For example, security teams cannot:

  • Install security agents on them,
  • Enforce remote monitoring, records management, and remote wipe capabilities in case the device is lost or stolen,
  • Force each device to participate in multi-factor authorization schemes, or
  • Make them generate event logs, which can be sent to a central repository for long-term storage and further analysis.

Yet clearly, these devices have their upside and can be extremely productive, so the BYOD trend is not going away soon. This creates even more reason for companies and security teams to carefully consider their strategies and approaches.

Trend #4: Information overload

Virtually everyone who has worked in incident response or information security realize that that there is too much information to process efficiently – or effectively. There are simply too many machines, generating too much data, requiring too many man hours for analysts to respond to various alerts, and more frequently, false positives.

These four trends all add up to the reality that enterprise security is being substantially disrupted and common security tools and technologies – even those that may have worked in the past – can’t keep up. It’s time for a new solution.

The endpoint modeling advantage

Endpoint modeling can be the answer to overcome these challenges. Endpoint modeling is a security technology that automatically discovers each device on a network, creates a model of that device’s “normal” behavior, and continuously monitors this behavior over time to look for any deviations. This way, when an exception does occur, the endpoint modeling solutions generates a real-time, actionable alert. Security analysts can quickly drill down to see exactly what is happening and take the most appropriate action to resolve the issue.

For example, endpoint modeling can tell human operators if:

  • A medical imaging server is suddenly visited by an unknown IP address,
  • A domain controller interacts with Google forms for the first time,
  • A multi-function printer attempts to transfer a file outside of the firewall, or
  • Any other new or different device behavior that could be the first sign of compromise – or a potential attack.

Purpose-built to respond to modern security challenges

Endpoint modeling also provides a solution for each of the flaws found in the four trends above.

  • Trend #1: Threat signatures: Endpoint modeling builds its foundation on creating a model of actual device behavior, so there is no need to use signature-based threat signatures to attempt to detect intrusions, viruses, or malware.
  • Trend #2: Increasing encryption: Endpoint modeling only uses passive network metadata and does not rely on deep packet inspection to try to “look inside” the packets themselves. This means encrypted network traffic, which is invisible to conventional network security tools, can still be successfully monitored from a security perspective.
  • Trend #3: Device proliferation: Endpoint modeling thrives in an environment of a growing number of devices because it does not require agents to be installed on any of them. A network sensor monitors their behavior on the network and builds a device-specific model for each one.
  • Trend #4: Information overload: Finally, endpoint modeling is a unique and effective response to the challenge of information overload. Specifically, machines are generating huge volumes of log data that is not suitable for human consumption. Endpoint modeling automates the process to use machine-generated data and other information and produces insightful alerts and incidents more appropriate – and effective – for analysts to use to investigate further.

As IT and security professionals seek new alternatives to detect and prevent and increasing number of cyber attacks, they must first consider four significant technology trends and understand their growing impact on network security. When they do, they can begin to see how endpoint modeling can provide an advantage, both in addressing these concerns and in giving them the right tools they need to improve their security efforts.

By Patrick Crowley, Founder and Chief Technology Officer, Observable Networks

Mark Greenlaw
Free Cloud Migrations are Expensive The cloud is becoming the primary place where work gets done. By 2025, Gartner estimates that enterprise spending on public cloud computing will overtake traditional IT hardware. Why? One reason ...
Get Smarter
Higher Education A big challenge for professionals of all ages is time. Balancing the responsibilities of work and life leave little time for self-improvement in the form of education. But ongoing education is more than ...
Gilad David Maayan
Network Security in the Public Cloud What is Network Security? Network security is a strategic approach to securing an organization’s resources and data across the corporate network. It helps protect organizations of all sizes, industries, ...
Patrick Melampy
Cloud On-Ramp and Protecting Performance The expansion of remote work and the massive growth in usage of cloud-based applications have stressed existing infrastructure and put a keen focus on the performance of everyone’s network environment ...
Drew Firment
Stop Focusing on Cloud Adoption and Start Focusing on Cloud Maturity For the past several years, most organizations have made it their priority to shift much of their applications and data from on-premises to the ...
10 Leading Open Source Business Intelligence Tools
Open Source Business Intelligence Tools It’s impossible to take the right business decisions without having insightful information to back up the decision-making process. Open Source Business Intelligence Tools make it easier to have our raw ...
Gilad David Maayan
What is SASE (Secure Access Service Edge)? SASE (Secure Access Service Edge) is a term coined by Gartner to refer to a new architecture for networking and security that combines both functions into a single, ...
Security Breach 10 Useful Cloud Security Tools
Cloud Security Tools Cloud providing vendors need to embed cloud security tools within their infrastructure. They should not emphasize keeping high uptime at the expense of security. Cloud computing has become a business solution for ...
The Manuscript.png
Disaster Recovery Plan.png
Disaster Recovery Plan.png
Recovery Experts.png

PLURALSITE

Pluralsight provides online courses on popular programming languages and developer tools. Other courses cover fields such as IT security best practices, server infrastructure, and virtualization. 

(ISC)²

(ISC)² provides IT training, certifications, and exams that run online, on your premises, or in classrooms. Self-study resources are available. You can also train groups of 10 or more of your employees.

CYBRARY

CYBRARY Open source Cyber Security learning. The world's largest cyber security community. Cybrary provides free IT training certificates. Courses for beginners, intermediates, and advanced users are available.