The testing of enterprise security conducted by red teams, groups of talented professionals skilled in evaluating security, has long been an important verification of security compliance and a way to prioritize what area security teams should focus on. But insights from this community have given rise to a concept that is now transforming the security industry: Red teams have taught us that to thwart threats we must at times think like our adversaries. Offense must inform defense.
This insight is now informing technical approaches to defense, concepts of operation and strategies for collaboration across industries. Consider, for example, these lessons learned from the attack side of the security community:
- When a motivated adversary wants to get in they will keep trying till they find a way. Assume you will be breached. Plan to detect, respond, restore while containing damage.
- When an adversary gets it they will seek to remain undetected, but in a well instrumented enterprise no adversary can remain invisible. All leave traces and well-instrumented systems will find them.
- Adversaries leave tools, including malware and rootkits to make their continued exploitation easier.
- Integration of all defense related information gives insights that leads better actions.
- Adversaries are automating and operating in-line. Defenses must automate and operate in-line.
- Smart defenders can target defense the way smart attackers target attack. With automation there is no need for a sledgehammer approach. Progressive mitigation approaches allow users to still do their work while only the needed countermeasure is deployed and it does not need to interrupt IT functionality or the workforce use of their tools.
If you agree with these insights here are some considerations that can help you put them into practice in your enterprise:
- Establish a goal of continuous monitoring of all available, instrumentable components of enterprise IT.
- Architect for the closely related but different goal of automation of in-line response and containment. When the system detects a problem, it should automatically provides a response to contain and limit the impact without requiring human intervention.
- Remember to extend your monitoring and automated response into RAM. Adversaries are moving to any reachable part of the IT system, including storing code in volatile memory. So RAM must also be searched and monitored, continuously.
- Architect in ways that enhance integration of data. Architecting smartly and choosing systems designed with integration in mind are key.
- Build your solution to scale. Old RDBMS approaches do not work on this class of computer science problems.
Are these thoughts consistent with your modernization plans? We would love to know what you are thinking.
