Deeply rooted cybersecurity misconceptions are poisoning our ability to understand and defend against attacks.
"Every lie is a poison; there are no harmless lies." Leo Tolstoy said this over 100 years ago, and who am I to argue with the great author? His observation holds as true today as ever — in many aspects in life, including cybersecurity.
I attend many cybersecurity presentations in my work, and one thing that has bothered me the past several years is the (over)use of clichés, myths, and misconceptions. There are many cybersecurity myths out there, but the three that are the most deeply rooted in the cybersecurity world (and therefore are the most "poisonous," as Tolstoy would say,) relate to People, Process, and Technology.
Myth #1: Sophisticated Threat Actors Use Sophisticated Tools
One misconception I run into a lot is the notion that sophisticated nation-state actors always use sophisticated cyberweapons when they breach organizations. While threat actors may indeed use zero-day exploits and advanced techniques to breach systems and access networks, in almost all cases, the initial vector is a (relatively) simple attack against humans. Why? Several reasons: a) it works, b) it's very cost-effective, and c) it's much harder to attribute. When attackers use an advanced capability like a zero-day exploit, they have a higher risk of being attributed to the attack. After all, there are only so many organizations that can develop or purchase zero days.
On the other hand, a relatively simple attack against a person, using a combination of social engineering techniques and open source intelligence (OSINT) can yield devastating results. Some of the most notorious breaches started just like that: the RSA hack, the Sony hack, the Associated Press hack, the Target hack, the DNC hack … and the list goes on.
In 2018, Verizon estimated that 33% of all breaches start with a social engineering attack. This is a very conservative estimate. Some researchers estimate the number to be closer to 90%. While security vendors push for more products, we must remember that not all cybersecurity gaps are technological. Most are related to people.
Myth #2: Attackers Need to Be Right Only Once; Defenders Must Be Right All the Time
I probably hear this process-related misconception the most. Claiming that an attacker needs to be right only once oversimplifies an attack life cycle from the point-solution vendor's point of view. In actuality, the attacker has to be right many times, and the defender has many opportunities to detect, mitigate, or prevent the attack.
To illustrate this, I suggest looking at the MITRE ATT&CK framework. For virtually any threat actor or attack type, the ATT&CK Navigator shows multiple techniques that can be used as part of the 14 tactics. Pick, for example, REvil ransomware. Notice how many different actions the attacker takes from Initial Access to Impact. The attackers don't have to be right once; they have to be right many times. The defenders will remain unaware of the attack if they miss all these opportunities to detect it.
True, the attackers likely will not give up if one technique fails or is stopped, and sophisticated threat actors are nearly impossible to stop. However, there is a lot to be said about early detection, attack mitigation, and incident response time. Saying that the attacker needs to be right only once is an easy out. We can do better than that if we break the siloed view.
Myth #3: You Need More Security Products to Stop All the New Threats
In terms of technology, we are learning the hard way that less is more. (Why not use a cliché to refute a cliché?) The average organization has 50 to 80 security products, yet most of them don't communicate with each other, some are partially integrated, and together they create huge management and monitoring burdens on security teams. Analysts and researchers suffer from alert and monitor fatigue, and there are good reasons practitioners in all disciplines are looking for easy-to-use, converged systems.
Vendor overload is directly related to the People and Process myths above. More chief information security officers (CISOs) are looking to cut back on the number of solutions they have while maintaining their security capabilities and operational readiness. This can be backtracked to the layered-security approach: The notion is true; you do need multiple layers for defense. Yet this does NOT mean you need more and more disparate systems to achieve it! The number of systems that analysts need to work with has become a burden. We don't need more tech — we need smarter, easier-to-use tech. We need to develop muscle, not fat.
It's Time to Bust These Myths for Good
To sum things up, we have to acknowledge these misconceptions about cybersecurity. If you read reports from almost 20 years ago, you will see the same problems and issues. Now is a great time to turn things around and bust these myths forever.
The adoption of cloud architectures gives us an opportunity to change the way we think and approach cybersecurity challenges. We can take these myths and put them behind us. As another great thinker, Albert Einstein, said, "The measure of intelligence is the ability to change."
Successful Trading is the art of minimizing long term risk and maximizing capital allocation.
Recent CRWD News
- National Australia Bank Selects CrowdStrike to Protect SMBs from Cybersecurity Threats • Business Wire • 04/16/2024 02:01:00 PM
- CrowdStrike Extends Cloud Security Leadership at Google Cloud Next ‘24 • Business Wire • 04/09/2024 12:00:00 PM
- クラウドストライク、アジア太平洋・日本地域パートナーアワード受賞者をパートナー・シンポジウムにて表彰 • Business Wire • 03/29/2024 08:26:00 AM
- CrowdStrike Asia Pacific Japan Partner Award Winners Recognized at Partner Symposium • Business Wire • 03/28/2024 10:00:00 PM
- Industry Leaders CrowdStrike and Rubrik Announce Strategic Partnership to Transform Data Security • Business Wire • 03/27/2024 12:00:00 PM
- CrowdStrike and HCLTech Announce Global Strategic Partnership to Drive Enterprise Cybersecurity Transformation • Business Wire • 03/25/2024 01:30:00 PM
- CrowdStrike Collaborates with NVIDIA to Advance Cybersecurity with Generative AI • Business Wire • 03/18/2024 10:00:00 PM
- CrowdStrike SEC Readiness Offering Prepares Public Companies for New Breach Disclosure Rules • Business Wire • 03/14/2024 01:00:00 PM
- CrowdStrike Gov Threat Summit Brings Together Public Sector Leaders to Discuss the Future of Cybersecurity • Business Wire • 03/13/2024 01:00:00 PM
- Form 4 - Statement of changes in beneficial ownership of securities • Edgar (US Regulatory) • 03/08/2024 11:31:04 PM
- Form 4 - Statement of changes in beneficial ownership of securities • Edgar (US Regulatory) • 03/08/2024 11:30:59 PM
- Form 4 - Statement of changes in beneficial ownership of securities • Edgar (US Regulatory) • 03/08/2024 11:30:54 PM
- Form 4 - Statement of changes in beneficial ownership of securities • Edgar (US Regulatory) • 03/08/2024 11:30:49 PM
- Strong Performances in the Fourth Quarter Drive Couchbase and CrowdStrike in Pre-Market • IH Market News • 03/06/2024 10:57:56 AM
- Form 8-K - Current report • Edgar (US Regulatory) • 03/05/2024 09:07:26 PM
- CrowdStrike Reports Fourth Quarter and Fiscal Year 2024 Financial Results • Business Wire • 03/05/2024 09:05:00 PM
- CrowdStrike to Acquire Flow Security to Expand Its Cloud Security Leadership with Data Security Posture Management (DSPM) • Business Wire • 03/05/2024 09:02:00 PM
- Dell Technologies and CrowdStrike Expand Partnership Delivering Comprehensive Managed Detection and Response • PR Newswire (US) • 03/05/2024 01:00:00 PM
- U.S. Futures Dip, Crude Oil Fluctuates • IH Market News • 03/05/2024 11:05:54 AM
- 2024 CrowdStrike Global Threat Report: From Breakout to Breach in Under Three Minutes; Cloud Infrastructure Under Attack • Business Wire • 02/21/2024 08:00:00 AM
- CrowdStrike Unifies Security & IT, Unleashes the Transformative Power of Generative AI • Business Wire • 02/20/2024 01:00:00 PM
- CrowdStrike Significantly Invests in India Operations to Continue Protecting Businesses from Modern Cyber Attacks • Business Wire • 02/15/2024 05:45:00 AM
- Form SC 13G/A - Statement of acquisition of beneficial ownership by individuals: [Amend] • Edgar (US Regulatory) • 02/14/2024 09:06:13 PM
- CrowdStrike and Ignition Technology Partner to Address UK Market Cybersecurity Demand • Business Wire • 02/13/2024 09:00:00 AM
- CrowdStrike Named a Founding Member of NIST Artificial Intelligence Safety Institute Consortium • Business Wire • 02/08/2024 02:00:00 PM
FEATURED Cannabix's Breath Logix Alcohol Device Delivers Positive Impact to Private Monitoring Agency in Montana, USA • Apr 25, 2024 8:52 AM
Bantec Reports an Over 50 Percent Increase in Sales and Profits in Q1 2024 from Q1 2023 • BANT • Apr 25, 2024 10:00 AM
Kona Gold Beverages, Inc. Announces Name Change to NuVibe, Inc. and Initiation of Ticker Symbol Application Process • KGKG • Apr 25, 2024 8:30 AM
Axis Technologies Group and Carbonis Forge Ahead with New Digital Carbon Credit Technology • AXTG • Apr 24, 2024 3:00 AM
North Bay Resources Announces Successful Equipment Test at Bishop Gold Mill, Inyo County, California • NBRI • Apr 23, 2024 9:41 AM
Epazz, Inc.: CryObo, Inc. solar Bitcoin operations will issue tokens • EPAZ • Apr 23, 2024 9:20 AM