Ten Strategies of a World-Class Cybersecurity Operations Center

The MITRE Corporation is offering a free book, "Ten Strategies of a World-Class Cybersecurity Operations Center," by Carson Zimmerman.

A Vulnerable Network Can Cost Your Business

Did you know that a vulnerability scanner can save you money? If you look at the various reports that have come out regarding the costs of security incidents, you will find that the per incident cost can range from a few thousand dollars to several million.

Last year, a Bloomberg report cited a study by the Ponemon Institute that found that the costs of security incidents involving credit card or social security number breaches cost an average $7.2 million per incident. Even on the low side, a report co-sponsored by HP put the average cost of a security incident at $416,000. When you compare this to the costs of identifying and properly securing a company’s vulnerabilities before a breach occurs, it seems obvious that securing your systems is the most economical approach to take. But before we look at how to approach this, consider the longer term impacts of a security breach.

A vulnerable network can cost your business in more ways than one. The expenses associated with cleanup pale in comparison to the costs from a damaged reputation. Lost business, reduced consumer confidence and the long term press coverage that comes with any security incident will have a financial impact that can last years beyond the actual event. While it is impossible to attach an accurate dollar amount to what might have been, you have to consider the revenue lost because a potential customer chose your competitor in part because they weren’t sure about entrusting their business with a company that has had a security incident.

The sad thing most businesses find out too late is that the costs of remediation would have been far less. Whether your costs are on the low end or the high, the simple fact is that practically all security incidents are avoidable, if you know where to look. And that is where a vulnerability scanner comes into play.

A vulnerability scanner is a tool you use to assess the state of your workstations and servers. When you use a vulnerability scanner, you examine all the systems connected to your network. This assessment will not only tell you what state your systems are in, it also gives you the same sort of information malicious attackers will have into your systems.  

You can use a vulnerability scanner to assess their patching level and the services running on them. You can also check for common misconfigurations that can lead to security incidents, and other vulnerabilities such as weak or default passwords. A vulnerability scanner provides you with the information you need to go about securing your systems, addressing configuration issues, and ensuring that you computers are secure.

Use a vulnerability scanner regularly, update your scanner’s definitions each time you use it, and scan your systems both from the outside and within. Regular scanning ensures that as new systems are brought online or configuration changes are made, you will detect any new vulnerabilities that are introduced or discovered on your network. By scanning externally, you can see things the way attackers over the Internet do, and by scanning internally, you can get a feel for your exposure to inside threats, whether those are malicious or merely curious users, malware, or other potential threats.

The costs of a vulnerability scanner are a fraction of the costs associated with even a minor security incident, and the money you will save remediating issues before they become incidents will repay you many times over. Start using a vulnerability scanner today to save money, protect your reputation and to help secure your customers’ continued loyalty.

This guest post was provided by Casper Manes on behalf of GFI Software Ltd. GFI is a leading software developer that provides a single source for network administrators to address their network security, content security and messaging need. Learn more on what to look out for when choosing a vulnerability scanner.

Is Network Security an Oxymoron?

As recent events have clearly demonstrated, no matter how highly-defended a network is, someone will find a way to penetrate it. If RSA and Symantec can’t keep intruders out, and APTs (an euphemism for Chinese-sponsored attacks?) continue to plague public, private, and government systems, what hope is there?

Remember PPT—people, process, and technology? We can throw technology at the problem and achieve middling success. If we are eternally vigilant and paranoid, we may realize great success. But what about people and process?

Despite comprehensive signed policies and awareness training, users still click on email attachments or embedded links, and willingly provide their user IDs and passwords to people calling from tech support. And this is without the burgeoning BYOD and BYOT problem. Who know what users are introducing to the network when they connect their USB drives, tablets, and smartphones to their desktops?

What’s the solution? Jim Tiller, now Head of Professional Services, Americas at HP Enterprise Security, suggests that regulations and compliance, and now insurance, are trying to do what PPT couldn’t. He thinks that government has accepted that because we have been doing hasn’t worked, then increasing the regulatory burden will. So, has network defense become notification and remediation once an organization has become compliant? Yes, it’s a loaded question.

Under this scenario, security becomes strictly a cost/benefit analysis. If the cost of an intrusion is, say, $1 million to cover notification and remediation, and the cost of preventing the intrusion is $1.5 million, then an organization would decide to accept the risk of an intrusion rather than take actions to prevent it. And now that an organization can obtain insurance, the insurers will determine the risk, instead of using the standard infosec risk formulas.

Assuming the organization was compliant with all regulations, then it’s done all it’s required to do to protect its network and information. It no longer has to compete in an ever escalating arms race against hackers of all ilks, from privately to government sponsored.

Of course, an enterprise could simply disconnect critical systems and employees from the Internet, which would prevent intrusions from the outside, but do little against insider threats. (It still amazes me that SCADA and other ICS are Internet-facing, and that things will inevitably get worse as M2M and the Internet of Things creates more points to attack.) As Jim concludes, efforts to protect and defend networks won’t go away, but response may well take precedence.