Following the news on the government’s 1.9 billion announcement in cyber defence spending, IT security experts from Corero Network Security, Glasswall Solutions, HEAT Software, SentinelOne, Imperva, ESET, comparitech.com, CrowdStrike, Veracode, WhiteHat Security, Barracuda Networks, Digital Guardian, ForgeRock and DQM GRC commented below.
Dave Larson, COO and CTO at Corero Network Security:
“These initiatives must be paired with consumer education in understanding the threats that exist and how to avoiding becoming an unintentional pawn in cyber warfare. Additionally, when you think about attacks on the Internet of Things escalating from consumer devices to businesses, enterprises, government agencies, utilities and more – you realize it is time to more aggressively secure every endpoint so entire networks including cloud services don’t collapse and leave us vulnerable to other forms of terrorism.”
Greg Sim, CEO at Glasswall Solutions:
The National Cyber Security Strategy must recognise the severe dangers posed by these threats and implement new innovations which are needed to overcome the conservatism and reliance on outdated methods that are undermining our defences.
The majority of organisations are still deploying security solutions that search in the wrong places and are designed to remove previously identified threats or signatures. But the reality is that criminals have moved on and are attacking the lifeblood of organisations, striking at the heart of the business email systems with weaponised documents by making sophisticated alterations in the structure of common file-types such as Word documents, PDFs, Excel and PowerPoint files. When these files are opened, their malicious payload executes and companies are immediately plunged into the damage limitation and clean-up process, which assumes they realise the breach in time and they are not victims of resident malware for many months.
There must be wider recognition that traditional signature-based AV security no longer cuts the mustard and that criminals are also using social engineering techniques, gaining a detailed picture of people and organisations all along the supply chain so they can achieve maximum impact.
While investment in cyber-security training is a positive step, too much of the focus is on detecting and mitigating attacks that have already happened. Prevention is much better than cure and innovative solutions that eliminate malware attacks must be the way forward, allied to an approach that hands the initiative back to organisations by putting them in charge of security policy in relation to files.
The only effective solution to defend against these attacks and the deliberate corruption of email-bound documents lies in file-regeneration technology that produces a benign, sanitised file at sub-second speeds which is checked against the manufacturers’ standards.”
John Ferron, CEO at HEAT Software:
An especially important aspect of the proposed strategy is that it highlights the susceptibility of old legacy IT systems to cyber-attacks. The strategy noted that many organisations, including government organisations, are still reliant on legacy systems, which leaves them incredibly vulnerable to ransomware attacks or data breaches. This is because these legacy systems were not designed to be able to deal with the cutting edge tools used by modern cyber-criminals.
The government should be using this new strategy, and its budget, as an opportunity to lead by example and educate all other organisations on how to use a layered approach to deal with cyber-crime. Pure prevention strategies such as blacklisting and antivirus alone are ill equipped to deliver anything like the levels of protection they once did. The UK needs to understand that there’s no silver bullet that can entirely insulate them from cyber and data security threats. However, a layered approach to security that incorporates people, process and technology will enable them to mitigate against 99% of their risks. Automating the installation of security updates and combining this with application control makes it almost impossible for unapproved software to run on public systems. On top of this encryption and device control provides added protection against insider threats, a growing issue made worse by the impact of BYOD.
We continue to assist UK government bodies in this area and have worked closely with NCSC in particular to ensure our technology meets the public sector’s needs and requirements.”
Andy Norton, Risk Officer – EMEA at SentinelOne:
Let´s hope the money is well spent on vigilance and protection, fixing the current failings, rather than testosterone fuelled posturing trying to attribute attacks and “strike back against those that try to harm our country.”
Amichai Shulman, CTO at Imperva:
Most modern nations spend much more on the attack side rather than the defense side. When they do spend on defensive technologies it is to protect “national interests” and “critical infrastructure”. While these are important causes, over the years modern nations have failed to invest in “cyber safety” for the masses – making the Internet a safer place for people who conduct commerce and surf for information and fun.
If, as stated by the UK official the additional funds are going to be invested in better policing of cyber space as well as helping commercial organizations to get protection then this is a much desired long deserved investment.”
Mark James, Security Specialist at ESET:
One of the problems we have always seen is information sharing, being able to get real time useable data on how threats are incoming and evolving will be invaluable for our defence. But having the means and processes in place to not only stop attacks but find and prosecute the criminals responsible wherever they may be, is what we need. With international boundaries and the ability to administer an attack from almost anywhere in the world successfully, prosecuting cyber criminals with the sentences that sends a clear message would do a lot of good.
Investing in our upcoming cyber security professionals is one of the areas that needs to be expanded, it should be an area teenagers consider alongside traditional careers and one that should be easily accessible by all. We also need to ensure help and training is available for anyone who needs it in understanding the everyday risks involved in using computers, tablets and mobile devices.”
Lee Munson, Security Researcher at Comparitech.com:
“Automated defences, designed to nullify phishing and other nefarious emails, sound like an awesome solution to a problem that has plagued the best business and technical minds for at least a generation.
“Quite how they will work is entirely unclear at this time, but this security researcher is super-excited at the prospect of the silver bullet so many of us in this industry have yearned for since the dawn of the internet.
“More than that, I am even keener to see how the UK will ‘stike back’ at those who threaten Britain across the interwebs when there isn’t enough cash on offer for the process of identification, let alone retaliation, unless ‘Russia done it’ is now the official government line in response to all cyber-attacks.”
Mike East, VP EMEA at CrowdStrike:
“The UK’s cash injection to shore up cyber defence is a nod to its acceptance that reactive action to cyber threats is no longer enough. The next step is to use intelligence to support the detection and management of attacks, and better counter criminal activity.
“The theft of information to uncover a government’s national security strategy is one thing, but the theft of information in order to influence elections, is another – it changes the dynamic.
“Ultimately, the UK government has a fundamental right to protect its citizens. Moving forwards it must focus on understanding its adversaries better – their motives, their tactics, and how that intelligence can be used in order to stay one step ahead.”
John Smith, Principal Solution Architect at Veracode:
“Following the launch of the National Cyber Security Centre last month, the British government is clearly making a concerted effort to secure the country against the ever-evolving threat landscape. From organised criminal groups and script kiddies, to ‘hacktivists’ and foreign states, the threat of data breaches is real and the effects can be severe. The data, digital identities and even lives of citizens can be impacted and, in some cases, put at risk. Both the UK government and UK businesses suffer when valuable secrets are stolen and given to outside interests.
“However, it is essential that beyond investing in the agencies which deal directly with active cyber defences, the government must take a more holistic approach to cybersecurity. Greater education around security threats is needed to reduce the nation’s cyber risk. Only consider that the government’s Cyber Streetwise campaign which recently found that two thirds of SMBs don’t consider their business to be vulnerable – despite evidence proving that cyber-attacks are on the rise. When combined with the recent NAO report attacking the government’s “dysfunctional” approach to data security, it is clear that much more can – and needs to – be done.”
Ryan O’Leary, VP Threat Research Centre at WhiteHat Security:
Paul Lyden, VP Northern Europe at Barracuda Networks:
Thomas Fischer, Threat Researcher and Security Advocate at Digital Guardian:
Most organisations already accept that it is not if, but when, they were breached. This expectation may well reflect the fact that malicious parties are now more likely to extort the victim, or release the data to forums or even the public. Time and the security skills shortage are the enemies in this situation and they make it hard to ensure the three cornerstones are kept current and relevant.
Simon Moffatt, Senior Product Manager at ForgeRock:
However, we are really just keeping pace with the ever-changing threat landscape. From an end user perspective, increased awareness and education of potential threats is a must, whilst private sector organisations need fully documented data breach plans in place.
As more organisations undergo digital transformation and place more and more services and applications online, they need to implement strong device and person-based identity and access management practices, providing secure contextual authentication and protection of identity related data, which will allow them to give the right access to the right people, at the right time.”
Christine Andrews, Managing Director at DQM GRC:
Assistance from the government is a supportive step in the right direction, but it is vital that the organisations themselves implement an engaging staff training programme to ensure all employees are aware of the need to manage data securely. The most common and destructive mistakes are often due to human error – not state-sponsored, powerful cyberattacks. For example, even the simple loss or theft of a USB stick or laptop containing personal information about the business could seriously damage your organisation’s reputation, as well as lead to severe financial penalties”
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.