How to Build an Effective Security Posture

TL;DR

An effective security posture minimizes both the time required to detect a missed threat and the time required to respond. Achieving that outcome requires practical automation, strong segmentation and access controls, and out-of-the-box integrations among security products, because isolated tools and APIs that shift integration work to customers cannot deliver coordinated action.

Transcript

Hey gang, I'm David Ulevitch, and I lead the security practice, uh, at Cisco, and before that, I was the founder and CEO of OpenDNS. I wanna thank Mark for the great talk, and, uh, in the spirit of true vendor collaboration, I'm gonna give you a nearly identical talk right now. Just kidding. Mostly. Uh, I also know that I'm the only thing standing ... Read More

Key Insights

• Security is a continuous process, not a point-in-time condition. Asking whether an organization is secure captures only one moment, while measuring whether its security posture remains effective better reflects the changing nature of threats and defenses.
• Attackers hold a structural advantage because they can keep trying with extensive time and resources, and they need only one attempt to succeed. Defenders have limited resources and must understand all potential entry paths to protect their infrastructure.
• Security breaches function as a tax on global economic output because responding to them consumes money, time, and operational capacity. Reducing that burden protects organizations, communities, and the broader economy that depends on reliable digital infrastructure.
• Commodity attacks can disrupt critical infrastructure without sophisticated targeting. A scripted ransomware campaign found weaknesses in San Francisco's transit agency and disabled fare-issuing machines and ticket-accepting turnstiles, demonstrating the consequences of repeated automated scanning.
• The Mirai botnet was assembled by compromising vulnerable IoT devices connected directly to the internet. Attackers repeatedly scanned for exposed devices until they had a botnet large enough to launch a DDoS attack against Dyn.
• An effective security posture combines prevention with rapid detection and response. Organizations should block known threats, segment networks and user access, then tightly couple shorter detection times with shorter response times when preventive controls miss an attack.
• Security silos obstruct automation because organizations may use up to 50 vendors whose products are connected operationally but do not communicate or interoperate. This fragmentation makes coordinated detection, investigation, and response substantially more difficult.
• APIs provide potential rather than completed interoperability because they transfer the integration burden to customers. Effective automation requires integrations that work out of the box, along with safeguards against artificial stupidity, meaning automated actions that make poor decisions.

Questions & Answers

Q: What makes a security posture effective?

An effective security posture blocks known malicious activity, segments networks and user access, and applies as much user access control as practical. Because prevention will sometimes fail, the central objective is to shorten the time needed to detect a threat and tightly couple that improvement with a shorter response time. Rapid detection without rapid action does not complete the required defensive cycle.

Q: Why should security be treated as a continuous process?

Security conditions change continuously, so a point-in-time answer to whether an organization is secure becomes outdated immediately. A system judged secure at one moment may not remain secure at the next. Organizations should therefore evaluate whether their security posture is effective over time, focusing on sustained prevention, detection, and response capabilities instead of relying on a temporary declaration of security.

Q: Why do attackers have an advantage over defenders?

Attackers can repeatedly try automated scans and scripts, and they need only one successful attempt for their overall effort to succeed. Defenders face limited time and resources while needing to understand and protect every possible entry route into their infrastructure. This imbalance allows even unsophisticated attackers to continue searching until they discover a weakness with potentially serious operational consequences.

Q: How can faster detection and response improve security?

Faster detection limits the time that an undetected threat can remain active, while faster response enables defenders to act promptly after finding it. The two capabilities must be tightly coupled because identifying malicious activity without doing something about it leaves the organization exposed. Their combination is presented as the central goal of an effective security posture when preventive controls fail.

Q: Why is automation necessary for effective security?

Automation is necessary because defenders have limited resources and time, while attackers can repeatedly use scripts and scans without comparable consequences. Automated security can help organizations detect missed threats and initiate responses more quickly. However, its value depends on coordinated products and sensible decisions, since fragmented systems and poorly designed automated actions can prevent automation from producing effective outcomes.

Q: Why do security product silos make automation difficult?

Security environments can contain products from up to 50 vendors, with each solution operating independently and often failing to communicate or interoperate. Although these tools may be bolted together within the same organization, their isolation prevents coordinated workflows. This complexity makes it difficult to automate detection and response across the full environment, leaving customers responsible for connecting numerous specialized products.

Q: Why are APIs not enough for security integration?

APIs expose technical possibilities for products to exchange data or trigger actions, but they do not provide a completed integration by themselves. Relying on APIs shifts the responsibility and work of connecting products onto customers. Security automation requires integrations that function out of the box so that tools can communicate and coordinate without every organization having to build and maintain the connections independently.

Q: What do the ransomware and Mirai examples reveal about modern threats?

The examples show that attackers can create major disruption through repeated automation rather than sophisticated, individually targeted operations. A commodity ransomware script disrupted fare and ticketing systems at San Francisco's transit agency. Separately, attackers repeatedly scanned for vulnerable IoT devices, assembled them into the Mirai botnet, and used that botnet to conduct a large DDoS attack against Dyn.

Summary & Key Takeaways

• Security breaches impose economic costs, while defenders operate at a structural disadvantage. Attackers can repeatedly run automated scans and need only one successful attempt, but defenders have limited time and resources and must understand every possible route into their infrastructure to protect it effectively.

• Commodity ransomware and botnet-driven DDoS attacks illustrate how basic automation can produce serious consequences. A scripted ransomware campaign disrupted San Francisco transit systems, while attackers assembled the Mirai botnet from vulnerable internet-connected devices and used it to launch a DDoS attack against Dyn.

• Security should be treated as continuous motion rather than a fixed state. Effective programs block known threats, segment networks, control user access, detect missed attacks quickly, and respond quickly. Automation is necessary, but fragmented products and poorly designed automated decisions prevent organizations from realizing its full value.