How Can Organizations Stay Resilient After Breaches?

TL;DR

Organizations stay resilient by detecting compromises quickly, responding with capable teams and technology, and actively hunting for intruders instead of trusting purchased defenses alone. Security must remain a continuing practice after a breach because management can relax when no new incidents occur, skilled defenders can leave, and the organization can become vulnerable again.

Transcript

Hi, I'm Tom Field, vice president of editorial with Information Security Media Group. I'm talking about the threat landscape today, and it's my pleasure to be talking with Kevin Mandia. He's the senior vice president and chief operating officer with FireEye. Kevin, thanks for joining me today. Hey, thanks for having me. So let's start out and talk ... Read More

Key Insights

• Advanced threats are dangerous when they enter networks without being noticed and take information that matters to an organization. Mandia distinguishes these effective intrusions from less consequential incidents while emphasizing that any attack capable of succeeding deserves concern.
• Cyber threats range from attractive nuisances and website defacement to financially motivated crime and nation-state activity. Criminal intrusion is expected to persist, while nation-state operations represent the highest level of capability and talent described in the interview.
• The most concerning threat is a highly capable actor that does not follow rules of engagement in cyberspace. Such an actor may be nation-state sponsored, ideologically opposed to its targets, and willing to destroy, change, or manipulate data rather than merely copy it.
• Destructive cyber operations can affect more than information confidentiality. Mandia identifies threats that could disrupt how organizations operate, damage their data, manipulate its contents, or attack utilities in ways that produce consequences in the physical world.
• Human targeting is a central vulnerability because defensive measures have strengthened many internet-facing servers. Attackers therefore use spear-phishing messages, Skype, instant messaging, or email to persuade insiders to click links and effectively compromise their own systems.
• Security maturity is a continuum that organizations must advance gradually. Moving from a weak posture toward resilience requires improvements in people, processes, and technology, rather than expecting an immediate jump from the lowest level to the highest.
• Cyber resilience is the ability to operate through compromise while detecting and addressing intrusions quickly. Mandia describes a strong organization as one that can identify a compromise within roughly the first 10 minutes and respond with capable personnel and technology.
• Victim's fatigue is the decline in vigilance that can follow an aggressive post-breach response. After months without another incident, management may reduce security activity, highly skilled defenders may leave because the work becomes less challenging, and the organization can be breached again.

Questions & Answers

Q: What cyber threats are most concerning to organizations?

The most concerning threats are highly capable intrusions that operate secretly, take or damage information important to an organization, and may not follow accepted rules of engagement in cyberspace. Mandia is particularly concerned about actors that may be nation-state sponsored and ideologically opposed to their targets because they could destroy operations, alter data, or attack utilities with physical-world consequences.

Q: How do advanced cyber threats differ from ordinary attacks?

The threat landscape described by Mandia has several levels. Attractive nuisances may compromise any available target or deface a website. Criminal actors are more capable and use intrusions to make money. Nation-state activity sits at the highest level of capability and talent, while the gravest scenario combines that capability with ideological conflict and a willingness to act destructively.

Q: Why do cyberattackers increasingly target employees?

Attackers increasingly target employees because organizations have built stronger defenses around internet-facing servers through vulnerability management, patch management, and penetration testing. That protective wall pushes adversaries toward people inside the network. A convincing message delivered through email, Skype, or instant messaging can persuade a recipient to click a malicious link and effectively participate in compromising the organization.

Q: How does spear phishing persuade people to compromise themselves?

Spear phishing works by presenting a message that appears to come from a trusted person, such as a boss or coworker, and connecting it to a familiar topic. Mandia gives the example of a message discussing a football game and inviting the recipient to click a related link. Once the person follows the link, the attacker can achieve the compromise.

Q: What does cyber resilience mean for an organization?

Cyber resilience means being able to continue operating through a compromise while identifying and addressing the intrusion quickly. Mandia describes a mature organization as one that detects compromise within roughly the first 10 minutes and acts through a capable team supported by technology. Resilience also requires observing likely entry points, recognizing anomalies, and actively hunting for compromise.

Q: How can an organization improve its cybersecurity maturity?

An organization can improve by treating security as a continuum and advancing one level at a time. Mandia explains that a company cannot simply jump from a weak grade to the strongest grade. Progress requires coordinated development of people, processes, and technology, followed by the ability to detect compromises quickly, respond effectively, observe anomalies, and hunt for intruders.

Q: Why is active threat hunting necessary after defenses are installed?

Active threat hunting is necessary because purchased technologies and perimeter defenses cannot guarantee that attackers will remain outside. Mandia says resilient organizations recognize the corners where adversaries can still enter and watch those areas for anomalies. They deliberately search for evidence of compromise instead of assuming that vulnerability management, patching, penetration testing, and other established controls have prevented every intrusion.

Q: What is victim's fatigue after a data breach?

Victim's fatigue is the pattern in which an organization strengthens its security team and aggressively confronts attackers immediately after a breach, then relaxes after about six months without another incident. Management may decide that the intensive work is no longer needed, skilled experts may leave for more challenging roles, and the weakened organization can become vulnerable to another breach.

Summary & Key Takeaways

• Kevin Mandia describes a threat landscape ranging from opportunistic website defacement to financially motivated crime and highly capable nation-state activity. The most concerning actors may combine nation-state sponsorship, strong technical abilities, ideological conflict, and few restraints, potentially seeking to destroy or manipulate data or cause physical effects through attacks on utilities.

• Attackers increasingly target people because organizations have strengthened internet-facing systems through vulnerability management, patch management, and penetration testing. Spear-phishing messages can impersonate bosses or coworkers and exploit familiar interests to persuade recipients to click malicious links. Email, Skype, and instant messaging can all become delivery channels that lead people to compromise themselves.

• Cybersecurity maturity develops along a continuum through improvements in people, processes, and technology. Resilient organizations aim to detect compromise within roughly the first 10 minutes, respond with capable teams, observe likely entry points and anomalies, and hunt actively for intruders. Sustaining that effort helps prevent the post-breach decline called victim's fatigue.