I am on my way back from RSA Conference 2015 @ San Francisco. It is a cloudy day at New York. Perfect day to write a quick blog. Here's my interpretation of Amit Yoran's talk with a bit of my thoughts poured into it.
Taller walls won't solve the problem. We need fundamentally different approach which is not discovered yet.
We need fundamental shifts in computer science research to be more effective in building better security. All our current day approaches are incremental in nature and won't solve the problem. Less than 1% of Advanced Attacks are detected by SIEM. No matter how high the walls are hackers will find a way in.
Stop believing that Advanced Protections work
No matter how high the wall is, focused adversary shall find their way. The Advanced protections don't work against the most motivated and skilled attacker.
CISO Platform's view: We appreciate the honesty. We wish more vendors had been so candid. Here's one of the blogs on CISO Platform which we published on this last year. http://www.cisoplatform.com/profiles/blogs/apt-secrets-that-vendors-don-t-tell
Read more: Top Talks from RSA Conference 2015 - San Francisco
We need pervasive and true visibility along with Identity
Well, this is not new. True visibility of network, end points and identity combined in a smart manner shall be more effective. trusting the trusted can be fatal. We need multi-dimensional information for real analytics.
CISO Platform's view: This is important. However my belief is that it is still incremental and not the fundamental change which the industry needs.
External threat intelligence is important
Threat intelligence once more is the buzzword in the expo floor just like last year. Amit also stressed on external threat intelligence for improving security.
CISO Platform's view: Before you rush for external threat intelligence first ask: Am I utilizing internal threat intelligence/ Threat intelligence should be adopted in a mature manner. Else we will end up having strong iron doors but with wide open windows.
Prioritize- Limited resources for maximum impact
Find out the most important and defend it with everything that you got.
CISO Platform's view: We cannot agree more. Use 80-20 rule. Priortization is an art and science which can not only help in improving security in your organization but also your life. Make prioritization and focus your way of life.
Read more: Top Talks from RSA Conference 2015 - San Francisco
Comments