Four Trends and Realities Confronting Security Today

Realities Confronting Security

Today, the number of attempted data breaches, cyber attacks, and other bad behavior by bad actors continues to go up at an alarming rate. Worse, it’s clear we can only expect the problem to get worse, not better.

It’s sad to say, but we’ve clearly reached a point where the realization that hackers are out there, actively trying to gain illicit access to a company’s network, is not a new – or shocking – concept. Instead, it’s become an accepted way of life for security professionals, an inevitability they must face each and every day as they fight to protect their networks and safeguard sensitive data.

It would be one thing if security teams only had to keep up with the increasing number and types of attacks. Unfortunately, there are four emerging technology trends that present new realities and new security challenges. Through no fault of their own, these trends seem to conspire against today’s security professionals, putting them at a significant advantage and disrupting previously successful methods.

Let’s take a closer look at each of these trends, highlight the security challenges they pose, and describe the new realities security teams must face to overcome them.

Trend #1: The inability for threat signatures to detect all risks

Signature-based threat detection refers to those security tools or technologies, such as antivirus and intrusion detections systems (IDS), that attempt to detect, capture, and quarantine a virus or entire Malware families using their known signatures.

Yet in the past few years, malware-authoring techniques have evolved to the point where security tools that rely on threat signatures simply can’t keep up. Or, in the case of zero-day attacks, hackers can exploit a vulnerability the company didn’t even know existed, which means that no threat signature could have successfully prevented the attack. With signature-based threat detection, security teams are essentially operating in the dark – attempting to defend against an army of threats they can’t “see.” As a result, overall security suffers.

Trend #2: The increasing use of end-to-end encryption in networks

Whenever two devices in a network establish an end-to-end encrypted connection, the traffic flows between them (their “conversations”) is invisible to everything – and everyone – else. This is an effective strategy in preventing man-in-the-middle attacks, where an adversary can access the data communications between the two devices without raising an alert.

When we think about man-in-the-middle scenarios, we tend to think of them in this context – preventing bad guys from disrupting the system. Yet many of the most important enterprise-level security controls, tools such as next-generation firewalls, IDS solutions, payload detonation devices, and many more, all rely on man-in-the-middle techniques.

More specifically, they use deep packet inspection (DPI) to examine the data contents of packets as they move through the network. DPI technology searches for viruses, malware, intrusions or other example that doesn’t comply with protocol as it attempts to make a security determination. Yet end-to-end encryption makes DPI much less effective and prevents security teams from being able to detect if suspicious content exists in the packets. It is interesting to note that the larger global security intelligence has recognized the security flaws associated with end-to-end encryption and DPI, yet for the most part, the corporate world still lags a step behind.

Trend #3: The proliferation of connected devices

To best understand the implications of this trend, consider this thought: Have you recently purchased an electronic device that did not attempt to connect to a network in order to do what it was designed to do? Most likely the answer is no, and examples of non-connecting devices are becoming extremely rare. It’s a trend that will continue: Gartner predicts that there will be 20.8 billion connected devices in the market by 2020.

Consider the effect of the related bring-your-own-device (BYOD) trend where employees a growing number of personal laptops, tablets, phone, and other devices in the Workplace. The problem is that these devices cannot be controlled – or secured – in the same way as other corporate assets. For example, security teams cannot:

  • Install security agents on them,
  • Enforce remote monitoring, records management, and remote wipe capabilities in case the device is lost or stolen,
  • Force each device to participate in multi-factor authorization schemes, or
  • Make them generate event logs, which can be sent to a central repository for long-term storage and further analysis.

Yet clearly, these devices have their upside and can be extremely productive, so the BYOD trend is not going away soon. This creates even more reason for companies and security teams to carefully consider their strategies and approaches.

Trend #4: Information overload

Virtually everyone who has worked in incident response or information security realize that that there is too much information to process efficiently – or effectively. There are simply too many machines, generating too much data, requiring too many man hours for analysts to respond to various alerts, and more frequently, false positives.

These four trends all add up to the reality that enterprise security is being substantially disrupted and common security tools and technologies – even those that may have worked in the past – can’t keep up. It’s time for a new solution.

The endpoint modeling advantage

Endpoint modeling can be the answer to overcome these challenges. Endpoint modeling is a security technology that automatically discovers each device on a network, creates a model of that device’s “normal” behavior, and continuously monitors this behavior over time to look for any deviations. This way, when an exception does occur, the endpoint modeling solutions generates a real-time, actionable alert. Security analysts can quickly drill down to see exactly what is happening and take the most appropriate action to resolve the issue.

For example, endpoint modeling can tell human operators if:

  • A medical imaging server is suddenly visited by an unknown IP address,
  • A domain controller interacts with Google forms for the first time,
  • A multi-function printer attempts to transfer a file outside of the firewall, or
  • Any other new or different device behavior that could be the first sign of compromise – or a potential attack.

Purpose-built to respond to modern security challenges

Endpoint modeling also provides a solution for each of the flaws found in the four trends above.

  • Trend #1: Threat signatures: Endpoint modeling builds its foundation on creating a model of actual device behavior, so there is no need to use signature-based threat signatures to attempt to detect intrusions, viruses, or malware.
  • Trend #2: Increasing encryption: Endpoint modeling only uses passive network metadata and does not rely on deep packet inspection to try to “look inside” the packets themselves. This means encrypted network traffic, which is invisible to conventional network security tools, can still be successfully monitored from a security perspective.
  • Trend #3: Device proliferation: Endpoint modeling thrives in an environment of a growing number of devices because it does not require agents to be installed on any of them. A network sensor monitors their behavior on the network and builds a device-specific model for each one.
  • Trend #4: Information overload: Finally, endpoint modeling is a unique and effective response to the challenge of information overload. Specifically, machines are generating huge volumes of log data that is not suitable for human consumption. Endpoint modeling automates the process to use machine-generated data and other information and produces insightful alerts and incidents more appropriate – and effective – for analysts to use to investigate further.

As IT and security professionals seek new alternatives to detect and prevent and increasing number of cyber attacks, they must first consider four significant technology trends and understand their growing impact on network security. When they do, they can begin to see how endpoint modeling can provide an advantage, both in addressing these concerns and in giving them the right tools they need to improve their security efforts.

By Patrick Crowley, Founder and Chief Technology Officer, Observable Networks

Alex Tkatch

Dare to Innovate: 3 Best Practices for Designing and Executing a New Product Launch

Best Practices for Designing and Executing a Product Launch Nothing in entrepreneurial life is more exciting, frustrating, time-consuming and uncertain than launching a new product. Creating something new and different can be exhilarating, assuming everything ...
David Balaban

Ransomware – Cybercriminal Groups Know The Weak Points

Cybercriminal Groups Grow Data breaches and leaks represent a quickly growing security problem these days. When plenty of people work from home, the risk of data leaks is much higher. Cybercriminal groups know the weak ...
Non-Fungible Tokens

Non-Fungible Tokens (NFTs) As Digital Artwork

NFTs As Digital Artwork NFT stands for Non-Fungible Token. Anything fungible is replaceable with something that is of an equal value. A basic example would be money. A $10 note is fungible as it can ...
Space

The Space Race Is Heating Up

The Space Race Is Heating Up For years the Space Race was the domain of countries and the national space programs. Namely Russia and America with China and India joining the game more recently. The ...
David Loo

The Long-term Costs of Data Debt: How Inaccurate, Incomplete, and Outdated Information Can Harm Your Business

The Long-term Costs of Data Debt It’s no secret that many of today’s enterprises are experiencing an extreme state of data overload. With the rapid adoption of new technologies to accommodate pandemic-induced shifts like remote ...

PROXY SERVICES

The CloudTweaks technology lists will include updated resources to leading services from around the globe. Examples include leading IT Monitoring Services, Bootcamps, VPNs, CDNs, Reseller Programs and much more...

  • Smartproxy

    Smartproxy

    Smartproxy is a rising star in the constantly growing proxy market. Smartproxy offers awarded customer service, impressive performance, and is serious about your anonymity (yes, cybersecurity matters). The latest features developed by Smartproxy are 30 minute long sticky sessions and Google Proxies. Rumor has it, the latter guarantee 100% success rate

  • Bright Data

    Bright Data

    Bright Data’s network is one of the most robust of its kind globally. Here are its stark advantages: Extremely stable connection for long sessions (99.99% uptime guaranteed). Free to integrate with our Proxy Manager which allows you to define custom rules for optimized results. Send unlimited concurrent requests increasing speed, cost-effectiveness, and overall efficiency.

  • Rsocks

    Rsocks

    RSocks team offers a huge amount of residential plans which were developed for plenty of tasks and, most importantly, has been proved to be quite efficient. Such variety has been created on purpose to let everyone choose a plan for a reasonable price, online, rotation and other parameters.

  • Storm Proxies

    Storm Proxies

    Storm Proxies' network is optimized for high performance and fast multi-threaded tools. You get unlimited bandwidth. No hidden costs, no limits on bandwidth. Try Storm Proxies 100% Risk Free. If you are not happy with the service email us within 24 hours of purchase and we will refund you.