Collaborate Disseminate
Technology, business and morality are not mutually exclusive, but rather fundamentally intertwined into the fabric of how our society operates and will have to increasingly operate in the future. As information about us is leveraged at the very… Continue reading The Bad, the Ugly and the Cyber Immoral – Thank you, Uber
Securing the government’s information systems is one of the most important tasks facing the new administration. It is a challenge that agencies have struggled with for over 20 years, and with the increasing complexity of federal networks, it is becoming more difficult. Like their private industry colleagues, agencies are turning to cloud and IoT technologies to increase access and efficiencies. In doing so, they must address the exposure of their entire attack surface, including legacy platforms and these new technologies.
Early White House appointments and a pending executive order demonstrate a focus on accountability and regaining control of government networks.
The government’s primary weapon in the fight to secure its networks has been money. The recently released budget blueprint includes a proposed $1.5 billion for the Department of Homeland Security to protect Federal networks and critical infrastructure from attack.
Throwing money at the problem will not solve it
My experience in and observation of cybersecurity efforts has shown that throwing money at the problem will not solve it. It is more important to make cybersecurity a cultural priority first and foremost. Organizations in government or industry which embrace the inherent importance of cybersecurity and exercise good systems and cyber hygiene are orders of magnitude more secure than those that spend more and prioritize less. Organizations and agencies need to understand their exposure and address the problems that have been there for years. Traditional cybersecurity focus on the network perimeter is no longer adequate. Technologies like cloud, IoT and DevOps processes introduce vectors that bypass the perimeter on the way into agencies’ systems and data. If you haven’t picked up on the irony of it, most of the high profile breaches are the result of adversaries exploiting well-known vulnerabilities and exfiltrating sensitive data.
Most high profile breaches are the result of adversaries exploiting well-known vulnerabilities
If network administrators and security professionals do not know their networks, they cannot possibly defend them. Knowing your network means knowing the architectures, systems, protocols, applications, users, data types, and the business and mission processes they support. This simple prerequisite for success gets incredibly challenging when you think about the proliferation of non-traditional compute platforms and processes across the enterprise.
The President is expected to appoint the National Security Agency’s Rob Joyce to handle government cybersecurity policy. Joyce, who heads NSA’s Tailored Access Operations hacking group, would work under homeland security advisor Tom Bossert, a former national security aide to President George W. Bush.
Joyce, with his hands-on experience in penetrating the networks of adversary nations, brings a great perspective to U.S. cybersecurity. At last year’s 2016 USENIX conference, he explained that there is no magic bullet for attacking or defending a network. The key to successfully attacking a network is “to know it better than the people who designed it and the people who are securing it.” Conversely, the key to defense is to know your own network better than your adversaries.
The key to defense is to know your own network better than your adversaries
Applying this message to U.S. cybersecurity means complete discovery and mapping of networks, identifying all systems and devices and assessing their configuration and security status. The National Institute of Standards and Technology has produced a library of cybersecurity standards and best practices, but this guidance cannot be used until agencies are aware of their networks and can monitor their systems.
Having a cybersecurity advisor in the White House who understands and lives by this will help ensure that agencies properly prioritize their cybersecurity efforts. The final version of the president’s executive order on cybersecurity has not yet been released, but I am encouraged that draft versions would hold agency heads accountable for their cybersecurity. Accountability is a powerful tool for focusing attention on the basics and to deny intruders the opportunity to burrow into our systems. Those of us who work in the commercial sector must also refrain from resting on our laurels. Staying ahead of our adversaries is a shared responsibility for all of us.
As a non-partisan issue, I have confidence that Bossert and Joyce will help bring a new focus to U.S. cybersecurity, and will work constructively with the private sector and government leaders to bring the best intelligence, process and technology to bear on the task of defending our networks.
The new administration does not have to start from scratch to form its cybersecurity policy. Cybersecurity has been a priority of previous administrations, and despite shortcomings, there have been important contributions that the president and his advisors can build on, including the NIST Cybersecurity Framework, the DHS Continuous Diagnostics and Mitigation (CDM) program, and the proposed IT Modernization Fund.
Change happens when cybersecurity is elevated to the highest priority in an organization
By building on what works and focusing on the basics of improving the security of our networks, we now have a chance to move government cybersecurity into a new era. Change happens when cybersecurity is elevated to the highest priority in an organization, including government. We must all protect the modern IT landscape, make smart investments in people and technology, improve cooperation, and embrace accountability to succeed.
Securing the government’s information systems is one of the most important tasks facing the new administration. It is a challenge that agencies have struggled with for over 20 years, and with the increasing complexity of federal networks, it is becoming more difficult. Like their private industry colleagues, agencies are turning to cloud and IoT technologies to increase access and efficiencies. In doing so, they must address the exposure of their entire attack surface, including legacy platforms and these new technologies.
Early White House appointments and a pending executive order demonstrate a focus on accountability and regaining control of government networks.
The government’s primary weapon in the fight to secure its networks has been money. The recently released budget blueprint includes a proposed $1.5 billion for the Department of Homeland Security to protect Federal networks and critical infrastructure from attack.
Throwing money at the problem will not solve it
My experience in and observation of cybersecurity efforts has shown that throwing money at the problem will not solve it. It is more important to make cybersecurity a cultural priority first and foremost. Organizations in government or industry which embrace the inherent importance of cybersecurity and exercise good systems and cyber hygiene are orders of magnitude more secure than those that spend more and prioritize less. Organizations and agencies need to understand their exposure and address the problems that have been there for years. Traditional cybersecurity focus on the network perimeter is no longer adequate. Technologies like cloud, IoT and DevOps processes introduce vectors that bypass the perimeter on the way into agencies’ systems and data. If you haven’t picked up on the irony of it, most of the high profile breaches are the result of adversaries exploiting well-known vulnerabilities and exfiltrating sensitive data.
Most high profile breaches are the result of adversaries exploiting well-known vulnerabilities
If network administrators and security professionals do not know their networks, they cannot possibly defend them. Knowing your network means knowing the architectures, systems, protocols, applications, users, data types, and the business and mission processes they support. This simple prerequisite for success gets incredibly challenging when you think about the proliferation of non-traditional compute platforms and processes across the enterprise.
The President is expected to appoint the National Security Agency’s Rob Joyce to handle government cybersecurity policy. Joyce, who heads NSA’s Tailored Access Operations hacking group, would work under homeland security advisor Tom Bossert, a former national security aide to President George W. Bush.
Joyce, with his hands-on experience in penetrating the networks of adversary nations, brings a great perspective to U.S. cybersecurity. At last year’s 2016 USENIX conference, he explained that there is no magic bullet for attacking or defending a network. The key to successfully attacking a network is “to know it better than the people who designed it and the people who are securing it.” Conversely, the key to defense is to know your own network better than your adversaries.
The key to defense is to know your own network better than your adversaries
Applying this message to U.S. cybersecurity means complete discovery and mapping of networks, identifying all systems and devices and assessing their configuration and security status. The National Institute of Standards and Technology has produced a library of cybersecurity standards and best practices, but this guidance cannot be used until agencies are aware of their networks and can monitor their systems.
Having a cybersecurity advisor in the White House who understands and lives by this will help ensure that agencies properly prioritize their cybersecurity efforts. The final version of the president’s executive order on cybersecurity has not yet been released, but I am encouraged that draft versions would hold agency heads accountable for their cybersecurity. Accountability is a powerful tool for focusing attention on the basics and to deny intruders the opportunity to burrow into our systems. Those of us who work in the commercial sector must also refrain from resting on our laurels. Staying ahead of our adversaries is a shared responsibility for all of us.
As a non-partisan issue, I have confidence that Bossert and Joyce will help bring a new focus to U.S. cybersecurity, and will work constructively with the private sector and government leaders to bring the best intelligence, process and technology to bear on the task of defending our networks.
The new administration does not have to start from scratch to form its cybersecurity policy. Cybersecurity has been a priority of previous administrations, and despite shortcomings, there have been important contributions that the president and his advisors can build on, including the NIST Cybersecurity Framework, the DHS Continuous Diagnostics and Mitigation (CDM) program, and the proposed IT Modernization Fund.
Change happens when cybersecurity is elevated to the highest priority in an organization
By building on what works and focusing on the basics of improving the security of our networks, we now have a chance to move government cybersecurity into a new era. Change happens when cybersecurity is elevated to the highest priority in an organization, including government. We must all protect the modern IT landscape, make smart investments in people and technology, improve cooperation, and embrace accountability to succeed.
Good cyber hygiene starts with visibility into all assets on your network. But with today’s infrastructures expanding into the cloud, web apps, virtual machines, DevOps containers, IoT and mobile devices, the network perimeter is disappearing and a comprehensive inventory is challenging to achieve.
This “elastic attack surface” is expanding rapidly, creating security gaps and business risks.
In a recent article on Dark Reading titled Securing Today’s ‘Elastic Attack Surface’ Amit Yoran shares his thoughts on modernizing the vulnerability management program and securing the elastic IT environment.
Two years ago, the message coming out of the RSA Conference was that the security industry had failed; new products kept emerging, yet breaches were still on the rise. Today, we still hear about daily security attacks. Organizations embrace new technologies to remain competitive, and security practitioners struggle to keep pace and preserve the enterprise from painful compromise. If you think the tech community hasn’t done a great job of understanding exposures and managing risk in traditional enterprise environments, things get a lot more complex with the rush to cloud, embracing the DevOps revolution, containers and other technologies that increase capabilities but that turn traditional infrastructure on its head. Simply put, enterprise technology risk is getting more difficult to assess and manage effectively.
As enterprise use of technology is rapidly evolving, security vendors must also evolve or become obsolete. The importance of cybersecurity is clear in every organization – not just to security professionals, but to CEOs, boards of directors, government agencies and customers. Security teams are starting to think about security more strategically. Senior executives couldn’t care less about the better mouse traps our industry is so fond of developing and marketing with great fanfare. The questions CISOs and senior executives want to know are quite foundational: “How exposed is our organization?” “How much risk are we facing?” and “How does that exposure and risk profile change as we make changes to our IT systems and business model?”
Vulnerability and risk management are going to look very different this year
At Tenable, we are transforming our products and company, looking at security solutions in a new light, and developing capabilities that empower our customers with the confidence they need to embrace their future. Vulnerability and risk management are going to look very different this year.
Tenable.io is going to change the way you think about vulnerability management
Tenable has always been the leader in vulnerability management; it’s in our DNA. Today’s enterprise exposes an attack surface that looks very different than how it looked a few years ago. From BYOD to virtual systems, web apps to containers, cloud to DevOps deployments, organizations struggle to achieve visibility, to understand their true exposure, and to determine how best to manage risk.
With the unveiling of Tenable.io™, our new vulnerability management SaaS platform, a foundational building block to that future is here. Tenable.io is going to change the way you think about vulnerability management.
Tenable.io helps you understand your vulnerabilities holistically, including enterprise computing environments, mobile systems, virtual machines, web sites, web applications, containers, IoT and control systems. The strategic approach to vulnerability management brings modular applications that address your business needs for Vulnerability Management, Container Security, and Web Application Scanning.
Tenable.io enables you to leverage nearly unlimited usage of the renowned Nessus® scanners. It also includes agents, passive scanning and web app scanning technology to give you the greatest visibility into your environments. Tenable.io is the only solution to build container security into vulnerability management.
Tenable.io is going to change the way you do vulnerability management
We know that it can be frustrating to assess your risk based on IP addresses when your business actually aligns with assets. At the core of Tenable.io is an asset-based understanding of your exposures and risk, not one tied myopically to IP addresses. Licensing based on assets provides simple pricing, more transparent licensing, more accurate identification of resources and more concise reports. What is an asset? An asset is simply a resource that can be identified and seen. It’s that easy. Elastic asset licensing is a better foundation for a complete and accurate view of your systems and risk. And Tenable.io is the only security solution that is licensed by assets.
The Tenable.io API and SDK and the Tenable Technology Integration Partner Program also provide seamless integrations with other critical solutions in the IT environment.
Tenable.io is going to change your understanding of risk and the way you do vulnerability management.
It’s an exciting time in our industry. Tenable has set ambitious goals to solve some of the most foundational security challenges and empower CISOs to gain control of their expanding environments. We will be bold and we will never stop innovating. We are proud to be your strategic partner in managing risk.
Continue reading 2017: Time to Shake Up Your Understanding of Risk
Today is a new beginning for RSA as we are now a part of the collective team of Dell Technologies, the world’s largest privately controlled tech company. No doubt, many of you are asking what the impact of this merger will be to RSA. I am happy to tell you that RSA’s mission remains unchanged.…
The post A New Beginning appeared first on Speaking of Security – The RSA Blog and Podcast.