I spent last week in Las Vegas attending Enfuse 2017. While I always look forward to the 100 degree days and sunshine, I especially enjoy the conference’s opportunity for informal and one-on-one chats with experts in cybersecurity, forensics and eDiscovery.
Some of the events I most look forward to are the keynote speeches, including the opening keynote address by Patrick Dennis, president and CEO of Guidance Software.
His message was simple: Don’t fear the breach. Of course we have to pay attention to breaches and endpoint protection is necessary, but sometimes we get so caught up on how to protect and defend breaches and data that we forget that breaches are just one part of cybersecurity and cyber incidents. And, Dennis said, by focusing so much on data breaches, we are doing a disservice to overall security.
It’s easy to see why we are so worried about data breaches. Information has never been more readily available or so easy to distribute.
At the same time, Dennis warned that it has never been so easy to spread misinformation, as well. That statement gave me pause, but he is right. Look at the proliferation of highly targeted phishing attacks, the spread of “fake news” sites, embedded malware in what we think are legitimate sites, and stolen or spoofed identities on social media.
Dennis said we need to do a better job of focusing on rapid response and better detection of potential threats rather than waiting around for something to happen. I think that has to include improved detection of misinformation and how to respond to it. One thing I heard over and over at Enfuse last week and at RSA in February is that security’s weakest link is human behavior. How do we keep employees from falling for the spread of misinformation that results in infected systems? We can preach better training and education, but you know what? Based on all the conversations and talks, we still don’t have a clue how to protect ourselves from human behavior. It will continue to be our number-one cybersecurity challenge.
Okay, so human behavior is our top security challenge. What’s our top security problem? Dennis’s response might surprise you. He said it is Russia and kompromat (compromising materials). Right now, you think of Russia and security and your mind turns to election tampering, the spread of fake news and the like. It’s a story that’s on the news nightly: Russian interference. But that’s the tip of the iceberg. Russia, said Dennis, is using old cybercrime techniques with new technologies in order to spread misinformation in order to cause damage to untold numbers of networks and organizations.
Finally, it wouldn’t be a cybersecurity conversation in 2017 without some discussion about the Internet of Things (IoT). Dennis said there are two “S” word concerns regarding IoT: security and safety. As we see the IoT moving deeper into our workplaces and everyday lives, we have to figure out how to balance security and privacy concerns in order to keep people safe.
Security isn’t just about endpoint protection and data breaches. We are working and living in a world without true boundaries (Dennis called them edge points) and where misinformation meant to cause damage is spreading as quickly as real information.
Sue Marquette Poremba has been writing about network security since 2008. In addition to her coverage of security issues for IT Business Edge, her security articles have been published at various sites such as Forbes, Midsize Insider and Tom’s Guide. You can reach Sue via Twitter: @sueporemba
