Recently, I wrote about the challenge of trying to predict attacks, and how that approach leads to “anti-X” security strategies that are rapidly made obsolete by each new wave of threats.
The strategy of threat prediction suffers from two major flaws. First, it assumes predictability in a field that is full of surprises. Security is adversarial, and the adversaries already knows what we are doing — they can read this magazine, for example. New attacks are not designed in a vacuum; they are designed explicitly to sidestep our expectations. If we base our defenses on predicted threats, attackers sidestep our defenses when they sidestep our expectations.
Second, threat prediction causes tunnel vision. It pushes us to focus on attacks rather than assets, on the “bad” rather than the “valuable.” This plays right into the hands of attackers, as tunnel vision narrows our defenses thereby making them easier to bypass. Rather than trying to predict threats, we should focus on general security preparedness.
After all, there is no such thing as a “secure” company or system. Everything can be broken with enough effort and money. Secure companies are not those that do not get breached; every company will suffer a security failure (or several) sooner or later. Rather, secure companies are those that minimize both the incidence of successful attacks and then further minimize the impact of those few breaches. Accepting breaches as normal, business-as-usual and unavoidable puts the emphasis on preparedness rather than prediction.
Of course, this does not invalidate the need to establish defenses and controls that are specific. Just like a flu shot in the fall, you may take precautions against specific threats that are known and predictable. But most companies put a lot less emphasis on preparedness that they do on specific threats. We have seen this in our research year after year, where we find very few companies with specific, well designed and well drilled incident-response policies. It’s as if “incidents” represent the failure of security that no one wants to acknowledge. “Incidents” are of course the norm, not the exception. To repeat a biological example, we should be putting a lot more emphasis on frequent hand washing while keeping some chicken soup in stock, rather than trying to find more vaccines to take every fall.
Security preparedness favours the operational over the technological and the generic over the specific. The emphasis on operational security means more skilled people and fewer shiny appliances. The emphasis on the generic means more broad security controls (encryption, authentication, audit and monitoring) rather than specific silver bullets (anti-X). Uncertainty makes us uncomfortable but in fact is an ally. The less we focus on specific threats and the more we accept uncertainty, the better we can prepare for new threats.
