How to Refocus Cybersecurity on Information

TL;DR

Protect information first by strengthening identity controls and encrypting data correctly, especially when cloud services place information across assets the organization does not own. Reusable passwords are linked in the cited reports to roughly 60–70 percent of data exposures, while correctly encrypted stolen data is not treated as a breach under the regimes discussed.

Transcript

Hello, and welcome to this edition of our RSAC 365 Webcast Series. We are pleased to host today's session, Remember When We Called It InfoSec? Let's Get Back To That, with our guests, John Pescatore, Anne Johnson, and Anton Chuvakin. During the webcast, all participants will be in listen-only mode. Our guests will be taking questions at the end of ... Read More

Key Insights

• Information security originally focused on protecting data rather than protecting computing equipment. Mainframes and disk drives were kept in controlled locations, dumb terminals had little intrinsic value, and physical access controls helped determine who could reach organizational information.
• Early authentication effectively combined two factors: what a user knew and where the user was. A username and password established knowledge, while using a dumb terminal inside the building supplied location-based confidence that supported organizational trust.
• Encryption emerged as an information-protection measure during the 1960–1980 period. The transcript identifies the approval of the Data Encryption Standard for symmetric encryption and the publication of Diffie and Hellman's public-key cryptography papers as important developments during this era.
• Early viruses and major internet worms primarily disrupted computers rather than stealing information. The transcript characterizes attacks such as Slammer, Blaster, Code Red, Nimda, and Melissa as denial-of-service events that crashed systems or consumed computing and network resources.
• The term cybersecurity gained prominence around 2001–2005 as defenders concentrated on preventing computers and networks from being disrupted. This change encouraged multiple layers of security products around servers and PCs, an approach described critically as spending in depth.
• Phishing works by persuading people to surrender usernames and reusable passwords. Because layered products could protect servers and PCs more readily than people, attackers increasingly exploited human trust to obtain credentials and gain access to information.
• Ransomware combines loss of availability with loss of control over information. It can encrypt data or executable files, then add pressure by threatening disclosure. The transcript says the HIPAA regime treated ransomware as a breach because control of patient health information had been lost.
• Cloud adoption strengthens the case for information-first security because organizations often do not own the underlying hardware and their data can exist across multiple cloud services. The transcript identifies improved identity management and correct, strong encryption as central ways to reduce exposure.

Questions & Answers

Q: Why should cybersecurity refocus on protecting information?

Cybersecurity should refocus on information because breaches and ransomware now directly threaten data, while cloud adoption weakens the value of concentrating mainly on physical systems. Organizations may not own the hardware supporting software or infrastructure services, and their information can be distributed across several cloud services. Security therefore needs controls that follow and protect the information, especially stronger identity management and encryption.

Q: How did early information security protect organizational data?

Early information security relied heavily on physical location and controlled access. Mainframes and disk drives were placed in protected rooms or basements, while users worked through dumb terminals. Usernames, passwords, and group permissions added logical controls. Because a user was inside the building and knew valid credentials, organizations treated location and knowledge together as a practical form of two-factor authentication.

Q: Why did information security become known as cybersecurity?

The term cybersecurity emerged when security teams increasingly dealt with malware, worms, computer crashes, and network disruption rather than direct theft of information. Around the 2001–2005 period, prominent attacks were largely denial-of-service events that harmed computers or consumed network capacity. The new label reflected a growing emphasis on protecting hosts and networks, although the webcast argues that protecting the internet itself is an imprecise mission.

Q: How did defense in depth affect security strategy?

Defense in depth led organizations to deploy multiple layers of products intended to protect servers, personal computers, and networks. John Pescatore criticizes this approach as spending in depth because it encouraged repeated product purchases without solving every security problem. In particular, technical layers could not easily protect people, leaving attackers an opening to use phishing and persuade users to reveal reusable credentials.

Q: Why are reusable passwords a major data exposure risk?

Reusable passwords are risky because attackers can trick users into disclosing them through phishing and then use the stolen credentials to reach protected information. The transcript says data from the Identity Theft Resource Center identifies people surrendering passwords as a leading factor. It also says that password-related causes account for roughly 60–70 percent of data exposures in the cited Verizon Data Breach Investigation Report information.

Q: How does encryption reduce the consequences of a breach?

Correct, strong encryption protects information even when attackers obtain a copy of it. The transcript states that if stolen information is properly encrypted, the event is not considered a breach under the regimes being discussed, and defenders do not need to treat the attacker's possession of the encrypted data in the same way as exposed readable information. Encryption therefore concentrates protection on the data itself.

Q: Why can ransomware be treated as a data breach?

Ransomware can be treated as a breach because the organization loses control of its information, even when an attacker has not yet publicly released it. The transcript says ransomware first emphasized encrypting data or executable files to block access, then evolved to include threats of disclosure. It also states that the HIPAA regime classified ransomware involving patient health information as a breach because control had been lost.

Q: How does cloud computing change information security priorities?

Cloud computing makes asset-centered protection less sufficient because customers may not own the underlying hardware, particularly with software as a service and much of infrastructure as a service. Information also resides across multiple cloud assets because companies do not use one cloud service for everything. Security priorities must therefore center on the data across those environments, supported by identity controls and encryption rather than ownership of physical systems.

Summary & Key Takeaways

• Information security originally concentrated on controlling access to data stored on mainframes and departmental computers. Physical security, building location, usernames, passwords, group permissions, and emerging encryption supported that mission. Organizations largely trusted users who accessed dumb terminals inside controlled buildings, while the information itself remained the principal asset requiring protection.

• The growth of PCs, networks, and the internet shifted attention toward malware, worms, denial-of-service attacks, and protecting computers from disruption. The term cybersecurity emerged during the 2001–2005 period, encouraging layers of products around servers and PCs. Attackers then increasingly targeted people through phishing and stolen reusable credentials.

• Breaches, ransomware, and cloud adoption make information-centered security necessary again. Cloud customers may not own the underlying hardware, and business information commonly exists across multiple cloud services. The proposed priorities are stronger identity management, reduced dependence on reusable passwords, and correct, strong encryption that limits the consequences of unauthorized data access.