Anyone who tells you that your IT network is “100% secure” is either a fool, or greatly mis­taken. Secur­ity is a moving target, and unfor­tu­nately, this target is being manip­u­lated by the bad guys.

• Forget the rear­view mirror: The bad guys are ahead of you
• Leave the lights on — always
• Don’t forget the boiling oil! Your mom was right: change your under­wear, often
• Don’t let vendors put you in their box

Forget the Rear View Mirror

You may not know the intent of those attack­ing your systems; however what you should know is that they prob­ably know more than you. The secur­ity industry does not innov­ate; we simply chase behind the true innov­at­ors and try to keep up.

Zero-day attacks and unknown vul­ner­ab­il­it­ies. Malware and botnets. There is no magic crystal ball to tell you what’s coming next, but you need to be looking to secure your future.

Looking in the rear­view mirror you will see invest­ment in network con­trols that stop simple mass attacks. But the attack­ers have evolved and “moved up the stack” going after applic­a­tions and host systems with tar­geted attacks. Com­mer­cial and custom soft­ware that run on these hosts contain thou­sands of vul­ner­ab­il­it­ies. Using simple, widely-known tech­niques, hackers can exploit these vul­ner­ab­il­it­ies and easily gain com­plete access to the hosts.

It always will be import­ant to keep current with the latest patches to remedi­ate vul­ner­ab­il­it­ies. However, the lag time between dis­cov­ery of a vul­ner­ab­il­ity and an exploit is rapidly dwindling.

Zero-day (and zero-hour!) attacks are a reality: you are hit before you even know there is a problem. This renders tra­di­tional signature-based, react­ive pro­tec­tion inad­equate. A pro­act­ive pro­tec­tion stance is now neces­sary. What I mean by this: you need to find ways to apply com­pens­at­ing meas­ures to shield vul­ner­ab­il­it­ies imme­di­ately. This will buy your organ­iz­a­tion the time needed to wait to receive, test and soak the patch appro­pri­ately before deploying.

As the threats con­tinue to evolve, we need to evolve our con­trols, and the mind­sets behind them.

Leave the lights on — always

TJX has become a house­hold brand, for all the wrong reasons. The UK Foreign and Com­mon­wealth Office was just slapped for endan­ger­ing the privacy and iden­tit­ies of people apply­ing for visas to enter the UK.

Secur­ity is about vigil­ance. You need to leave the lights on, or in other words, do everything you can to dis­suade attack­ers by making it dif­fi­cult for them to attain their goal. You don’t have to be perfect; you just have to be a little bit more secure than the neigh­bour, as attack­ers will go after easier targets first.

You need to recog­nize that the new age of inform­a­tion tech­no­logy tools means that the average secur­ity levels in soft­ware is going down. It was hard enough to find applic­a­tion developers who under­stood secur­ity, but now we see web applic­a­tions built by ama­teurs using script­ing lan­guages, and you can appre­ci­ate the problem. In the web 2.0 world, these applic­a­tions execute across fire­wall bound­ar­ies, opening more seams for clever attack­ers to exploit.

A mistake made by one, has con­sequences for all.

Don’t forget the boiling oil!

Defence-in-depth works. Castles his­tor­ic­ally had strong peri­meter defences, but the buckets of boiling oil were on standby to dis­cour­age attack­ers that got past the moat and drawbridge.

Tra­di­tional peri­meter defences for our net­works are neces­sary, but now not suf­fi­cient. There are so many ways to get though the peri­meter. An attack might ori­gin­ate from an end user lured to a mali­cious site com­prom­ised by malware. The res­ult­ing down­loaded malware tunnels in through the HTTP session, ready to launch exploits from within your network peri­meter. More fre­quent use of encryp­tion is prob­lem­atic, as it can blind network scan­ning tools, and be a nice tunnel for malware to enter the enterprise.

Secur­ity pro­fes­sion­als, and indeed most busi­ness exec­ut­ives, fun­da­ment­ally accept the basic premise that it takes mul­tiple layers of defence to protect against the wide variety of attacks and threats. A single product or secur­ity layer is not suf­fi­cient. A layered, defence-in-depth approach gives mul­tiple lines of defence that will allow one product to catch things that may have slipped past the outer defences.

Learn from the past to secure the future.

Your mom was right: change your under­wear, often

Let’s talk about what “vigil­ance” in secur­ity really means. Reg­u­la­tions are popping up in every industry and country or region around the world. When it comes to secur­ity, much of these reg­u­la­tions, in par­tic­u­lar pre­script­ive reg­u­la­tions such as PCI, are advan­cing secur­ity in leaps and bounds.

The problem with these reg­u­la­tions is how we (organ­iz­a­tions col­lect­ively) are dealing with them. Offi­cial audits cause mad panic as we rush to apply all secur­ity patches and con­trols to comply with reg­u­la­tions. Shortly there­after, com­pla­cency and for­get­ful­ness allow con­trols to lapse and patches to be avoided.

Com­pli­ance is more than just for the aud­it­ors; it will help protect your busi­ness. But, com­pli­ance does not equal secur­ity. Only you can be respons­ible to keep your house in check.

Don’t let vendors put you in their box

This is not about think­ing “outside the box” unless of course you use these as code words for saying “works with more than just Microsoft.” One of the most common com­plaints that we have heard from CIOs and CISOs around the world is the pre­val­ence of Microsoft-fanatical vendors — even worse, those that support sin­gu­lar ver­sions of Microsoft products.

Look for secur­ity vendors and products that work (well) across the broad­est range of plat­forms. There are extremely varied opin­ions on the secur­ity of open source oper­at­ing systems and applic­a­tions, but regard­less, you should not let a vendor tell you how to run your busi­ness when you are asking them how to secure your business.

You need to be wary of vendors that claim to provide a “one-stop shop” for all things secur­ity. There is sig­ni­fic­ant value in a diversity of secur­ity approaches to match the diversity of approaches to malware and other forms of attacks.

Secur­ity needs to be able to be deployed where and when you need it. As embar­rass­ing as it sounds, this fun­da­mental fact seems to have been for­got­ten by the major­ity of secur­ity vendors around the world. The fork­lift approach to secur­ity install­a­tion does not work when you are pro­tect­ing mission crit­ical systems. Secur­ity mech­an­isms need to com­ple­ment exist­ing systems and should not disrupt your business.

Great secur­ity + poor deploy­ment = bad security

Good secur­ity + good deploy­ment = great security

Looking to the future

From London, to Frank­furt, or even Beijing, the secur­ity game being played has new players and new purpose. Today’s cyber­crim­in­als are organ­ized, ruth­less, and fin­an­cially or polit­ic­ally motiv­ated. Your best line of defence is a defence-in-depth approach to security.

Make sure you choose vendors (not vendor) that are willing to chase your attack­ers as much as they chased you for your business.

Brian O’Higgins, CTO for leading intru­sion defence firm, Third Brigade, is best known for his role intro­du­cing PKI products to the secur­ity land­scape. http://www.thirdbrigade.com/