Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics //

Security Monitoring

02:06 PM
Amit Yoran
Amit Yoran
Connect Directly
E-Mail vvv

Time To Turn The Tables On Attackers

As a security industry, we need to arm business with innovative technologies that provide visibility, analysis, and action to prevent inevitable breaches from causing irreparable damage.

Last week, Amit Yoran was named the President of RSA. Amit joined RSA after the company's acquisition of NetWitness, a market leading network forensic vendor which he co-founded and served as CEO. Since the acquisition he has been the driving force behind expanding and transforming RSA's product strategy and portfolio. Amit previously co-founded and served as the CEO of Riptech, which was acquired by Symantec in 2002. He has also served as the founding director of the US Computer Emergency Response Team and as a founding member of the US Department of Defense's CERT program.

Dark Reading asked Amit to reflect on the changes he has seen in the threat and defensive landscape in his career, the future of the security industry and how he hopes to affect that in his role at RSA.

I've been fortunate enough to work in a field that I am very passionate about, and to work alongside so many extraordinary people. I started my career in information security doing incident response work in the Department of Defense over 20 years ago and was exposed to some of the most aggressive adversaries. Those early years made a profound and lasting impression on me. I saw firsthand how well-designed systems can fail, how mature security programs can be circumvented and how focused adversaries orchestrate strategic campaigns.

In the years since we've been faced with the reality that as an industry we've reached a point of catastrophic failure. Networks have become more complex, perimeters have become more porous, mobile and BYOD have become widely adopted and SaaS platforms more prevalent. Cyber criminals have taken advantage of our shortcomings and are winning the war.

How has the industry responded? Unfortunately the response is not enough, offering up more of the same old solutions with only modest improvements in firewalls and signature-based approaches to antivirus and intrusion detection systems. Solutions that by their very definition can't address sophisticated threats and lack the context to adequately scope what is going on in the network. Organizations weren't getting the visibility they so desperately needed to stand a chance going up against increasingly sophisticated adversaries. An adversary with technical acumen, focus, intent, and enough time can make compromises an inevitable reality for any network.

It all sounds very ominous, so how do we turn the tables on our attackers? Where do we go from here?

As an industry we're positioned to incite change in how organizations are securing their notably more modern and complex corporate environments. It's our obligation to arm businesses with the most innovative technologies fit to combat these advanced threats. I believe in an intelligence-driven security -- a strategy that provides the visibility, analysis and action needed to help prevent inevitable breaches from causing irreparable damage or loss. This strategy empowers organizations to effectively address the challenges they can see today and those still beyond the horizon.

The first steps toward stronger security are aligning and integrating our capabilities to better enable organizations to embrace modern computing, and also deliver the most effective security possible. Security has evolved beyond just simply seeing an exploit attempt, and now requires pervasive visibility that identifies an entire sequence of activities, or an orchestrated, strategic campaign. Technology needs to keep pace with this need and facilitate organizations' migration to next-generation computing platforms.

So how exactly do we achieve this? What are the tools we need?

With perimeters on their way out the door, identity matters now more than ever. For RSA, that means creating flexible multifactor authentication that the end user won't find burdensome and moving identity and access management (IAM) and governance from theoretical or a paper-based model to an operational, living, breathing organism that organizations can rely on. Security technologies should leverage the wealth of information offered by identity that offers critical context for a much broader understanding of what's happening in traditional environments, as well as mobile and cloud-based applications and services.

Equally crucial as managing identity is forming comprehensive visibility into network operations and a deep understanding of the digital environment. By establishing pervasive and true visibility we enable organizations to see not only what is occurring across their networks, but give them the analytics to understand what they're seeing. This paired with a mature GRC practice gives the business context and insight necessary to prioritize security efforts where they can make the greatest difference.

In my new role I'll be working across the business to deliver a simpler, seamless, and more unified customer experience alongside an industry poised to drive awareness about threats enterprises face, and the most advanced technologies they will need to combat those threats. As compromise has become inevitable, so must change. Hoping our current defensive technologies will keep us safe is ignoring the attacker already in the room. Historical attack patterns only tell us what has already been attempted, while the adversary has likely already changed their approach.

Intelligence-driven security isn't a marketing term. It requires businesses to know everything they can about their environment, their activity, their risk and their vulnerability. Only then can a business truly adopt a more agile stance, one in which it can confidently say, "I am ready for anything that comes at me, even if I've never seen it before." Today's advanced adversaries, in many cases, know businesses better than the businesses know themselves. As an industry and as individual organizations, it's time to take a hard look in the mirror, and use what we see to reflect, deflect, and fight the enemy on a level playing field.

Amit Yoran is chairman and CEO of Tenable, overseeing the company's strategic vision and direction. As the threat landscape expands, Amit is leading Tenable into a new era of security solutions, empowering organizations to meet the challenges of evolving threats with ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Ninja
11/20/2014 | 7:31:48 AM
Re: Two things,--
look up the meaning of "apoplectic" : Extremely angry; furious:

="the "NSA was apoplectic."

this explains why this critical technology has been diluted (x.509)  and is not well understood.     This needs to change.
User Rank: Ninja
11/20/2014 | 7:27:17 AM
Two things,--
two things need to happen:

(1) use a secure operating system

(2) insist on authentication of transmittals

a Secure O/S will not allow itself to be modified by activity of an application program.

authentication is something that each user needs to be involved in: each of us needs to vett the x.509 certificates we want to trust and each of us needs to learn how to authenticate transmittals and then make a practice of insisting on authentication.

the need and method for authentication has been established since the '70s:

see: https://medium.com/stanford-select/keeping-secrets-84a7697bf89f


A year earlier, Hellman had published "New Directions in Cryptography" with his student Whitfield Diffie, Gr. '78. The paper introduced the principles that now form the basis for all modern cryptography, and its publication rightfully caused a stir among electrical engineers and computer scientists. As Hellman recalled in a 2004 oral history, the nonmilitary community's reaction to the paper was "ecstatic." In contrast, the "NSA was apoplectic."
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
11/16/2014 | 1:58:51 PM
Re: It's time to wake up.
The vision sounds great to me. But I'm wondering how, as a competitive industry, will security vendors unite to deliver that vision to their customers.
User Rank: Strategist
11/15/2014 | 6:37:44 AM
It's time to wake up.
"In the years since we've been faced with the reality that as an industry we've reached a point of catastrophic failure."

It's nice to see someone state the ugly truth. I've been saying this for a while now, but most folks I talk to think I'm being alarmist. They think that we will all muddle through somehow.

Yet the pace of serious breaches quickens with every passing month. Most disturbing to me is that so many of these incidents are the result of bone-headed blunders by folks who are getting paid to know better. Also disturbing are the complaints from folks who do know better that their managers are unwilling to make the necessary investment to improve the situation.

I'm not a security expert; I don't have a solution to the problem. I can only hope that the folks who are in a position to do something will wake up before it is too late.
User Rank: Ninja
11/13/2014 | 6:25:18 PM
FOSS Access to RSA Innovation
I completely agree with your vision and I feel this is a great step in the right direction.  One of the best ways to innovate across an industry is to share knowledge, make APIs available and demonstrate solid functionality across platforms.  I hope that part of this initiative includes a deeper relationship with the Free and Open Source Software (FOSS) communities.  One reason is that, because FOSS is so "cheap" many start-ups and established companies use it in an Enterprise setting.  However, this is not always the most secure way to operate, especially for IT shops using FOSS that aren't well-versed in security and haven't done all they can do to tighten access to their digital assets.  This doesn't necessarily mean free up all your source, and make "free" your tools; rather, developing that tight relationship with one of the most influential technical bodies in the Enterprise (FOSS) can mean better code coverage (even if the source isn't open, the FOSS community can be hard on new tools and technologies, often revealing vulnerabilities before any other group), and when the relationship is a good one, FOSS users might be more willing to spend money on a solution than simply roll out a free one.
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Google's new See No Evil policy......
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-18
An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make server keep waiting for the packet to finish the connection, until its resource exhausted. Then the web server is denial-of-service.
PUBLISHED: 2021-06-18
An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67.Attacker could send a huge amount of TCP SYN packet to make web service's resource exhausted. Then the web server is denial-of-service.
PUBLISHED: 2021-06-18
An issue was discovered on 4GEE ROUTER HH70VB Version HH70_E1_02.00_22. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make server keep waiting for the packet to finish the connection, until its resource exhausted. Then the web server is denial-of-service.
PUBLISHED: 2021-06-18
Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value "zzip_file_read" in the function "unzzip_cat_file".
PUBLISHED: 2021-06-18
Secure 8 (Evalos) does not validate user input data correctly, allowing a remote attacker to perform a Blind SQL Injection. An attacker could exploit this vulnerability in order to extract information of users and administrator accounts stored in the database.