A critical capability in effectively managing information risks for an enterprise is the ability to see and understand normal vs. nefarious activity. Information Security practitioners typically call this "Network Visibility". Without this visibility, organizations simply do not have the information they need to understand their information risks. In addition, in the event the firm learns of a major compromise, this lack of visibility negatively impacts their ability to make business decisions and take action, especially when those actions need to be taken in the midst of managing an information security incident.
Information security practitioners can use many tools and security technologies to help them see network activity. These technologies serve as critical element of understanding normal vs. nefarious activity. Tools such as network monitoring, SIEM, IDS, and DLP are just a few that come to mind. These should be viewed as basic blocking and tackling tools for most large organizations that have sensitive or high value data.
Gaining this visibility and understanding is often a monumental undertaking for organizations, especially for large enterprises than span geographies and leverage the use of 3rd parties to conduct business. The heavy lifting lands almost squarely in the “understanding” of what is seen and captured by a firm’s security technology. This is particularly true as it relates to Advanced Persistent Threats (APTs), as often these attacks make use of authorized credentials of the target firm to covertly extract a firm's sensitive or high value data (e.g. product designs, industrial designs, intellectual property or other trade secrets). Unfortunately, truly understanding network activity and being able to glean from large amounts of network activity what is nefarious, is where most network visibility efforts fall short.
I assist large enterprises in developing security strategies and programs, and often assist companies and organizations that are dealing with known compromises or expect they have been compromised. For organizations that are compromised there are three common themes I see:
Theme #1) There is no comprehensive information security strategy or their security strategy was not adequately funded, and thus the basic blocking and tackling leveraging security technologies for visibility has not been implemented.
Theme #2) IT Infrastructure has been managed in a decentralized and inconsistent manner and lacks maturity.
Theme #3) Business Intelligence and Analytics are non-existent or are not applied to information risks.
An IT Infrastructure that is managed inconsistently and lacks maturity typically results in a weak and unclear understanding of a firm’s information assets. This coupled with a lack of business intelligence to effectively analyze and provide business context to the data that is collected by security technologies, commonly results in firms merely gaining “visibility to activity”, but not fully understanding what the activity means.
Do keep in mind, many industry leading security technologies do provide sound analytics for the data those tools capture. However, if not complemented by both mature IT Infrastructure management practices and Business Intelligence, the understanding of network activity will often not be at the level necessary to minimize more sophisticated Advanced Persistent Threats (APTs).
I’ll outline some of the key elements of IT Infrastructure Management practices and Business Intelligence in an upcoming post and further explain why these three areas are necessary to be move to “Information Risk Visibility”.
Your comments are welcome...
Mark Brooks
