How Do You Protect Your Business When the Threat Landscape Is Always Evolving?

Staying ahead of the curve when it comes to security attacks can be a challenge many find to be nearly impossible to achieve. But why is it so difficult? Every day, attacks targeting juggernauts of industry are featured in breaking news. An example is the recent “Wannacry” ransomware attack, which affected thousands of computers all over the world—from Europe to Asia to North America, locking users out of their computers and demanding ransoms. What’s concerning about these attacks is not only the frequency of them, but how they quickly inspire imitators.  

New attacks using combinations of execution code to bypass defense systems are popping up. Even more concerning, ransomware/botnet attacks are now hijacking ICS to re-route ambulances causing life-threatening consequences. And the hard truth is this won’t stop; new malware will be written with multiple code execution paths that are designed to set off benign processes while under scan and then execute malicious code once your anti-virus deems it to be safe. 

You might be indignantly thinking why? My anti-virus is supposed to stop all threats—my vendor said so! Why is it so difficult to defend my organization? 

The short answer is that it doesn’t have to be. Having implemented and reverse engineered many security solutions, I can say honestly that you cannot adopt or rely upon a single strategy or single solution to defend your posture. It takes a holistic and tiered approach to be able to defend and take on attacks from different vectors. 

A long time ago, I was once on the offensive side acting out DDoS attacks while playing a game called “Counter-Strike.” Why is this relevant? It seems hard to believe, but this game helped me adopt a philosophy on cybersecurity that I will never forget and will use for the rest of my career. I hope you can take this philosophy to heart, and that it will also help you protect your business as well as yourself from being hacked. 

Know your risk. 

Designing a secure infrastructure starts with knowing your greatest risks and weaknesses. Think like a hacker. What is the most critical asset? What type of attacks are you vulnerable to? What would someone do to exploit it that risk? Knowing is the first step. 

Identify your risk. 

In the following tiers: Reputation, Operational, and Intellectual Property. Once you’ve identified your risk in these arenas, plan a defensive strategy accordingly.  

Defend. 

Your strategy should lead to you knowing your network better than anyone else. You are the first and last line of defense. Security solutions are simply technology, but without configuring that technology to its strictest potential, you will not win. Do not allow any attacker to exploit your posture. Conduct vulnerability assessments and risk audits. Conducting threat assessments regularly is a critical step in continually developing your security plan.