Article by Stuart McIntosh
Villainize cyber criminals all you want. The truth is cyber-attacks happen for one basic reason – Economics.
Attackers are human – just like you and I. They are motivated by the same things we all are – money and power – as guided by emotional and rational drivers.
I believe that one of the major drivers making cyber-crime so attractive is the asymmetry that exists in our domain.
What do I mean by asymmetry? Simply stated it is the difference between the effort it takes to mount an attack and the amount of effort it takes to defend against one. Compound this over our large & complex IT environments, and this asymmetry tips immensely in favor of the attackers.
Add to this that there is almost zero downside for attackers to launch a failed attack. Even if we could quickly attribute and locate the source of the attacks, rarely are the bad actors prosecuted or fined. Many of them have set up “legitimate” business operations in non-extradition countries or sovereign enemies of the US.
For me, this puts cyber attackers in a new light. Applying a first principles approach leads me to break down attacks into their core elements:
Why are they attacking? What is their primary motivation? This helps you “get inside their heads” somewhat, to understand what makes them tick – but the answers to these questions are realities that you probably can’t change.
What are they attacking specifically? What are they targeting? We can potentially influence the systems and data that attackers target, but it does require definition and prioritization on our part, then implementing boarders and defenses in the order of the business impact priorities (the “crown jewels” approach).
How do they attack? I do not mean specifics here, but pattern recognition of the types of elements involved. The “hit list” of where attackers hit or succeed often. Identifying these gives us another priority list, but this one includes where we focus on defensive prevention & detection.
There is significant asymmetry in cybersecurity today. Arguably the more than in any other industry. Worsening that fact is the high percentage of success attackers eventually obtain. Maybe they have 20,000 failed attacks, but all they need is one to work in order to extract a financial or strategic return.
So the true goal is to reduce the significant asymmetry we face, anything less will only produce temporary gains. Economically put – we need to raise the cost of attacks and lower the cost to defend. But how?
In situations like this, I like to look at other examples of asymmetric attackers vs. defenders. What were effective approaches to mitigate or eliminate the systematic imbalance?
A relatively recent example of this is from the battle fronts of Iraq and Afghanistan. In both engagements, the allied forces faced an opposing force that would lay in-wait and only strike when they could maximize damage and fatalities – typically in locations or situations where defenses were at the bare minimum.
One of the most successful approaches against this style of warfare was called Seize-Clear-Build-Hold (https://manassaloi.com/2020/03/16/seize-clear-hold-build.html). The essence of the approach was to penetrate the most dangerous, insurgent controlled neighborhoods in a city, and establish a foothold; “Seize”. The second step was to branch out from that foothold – going house to house if necessary – to root out the sleeping enemies ; “Clear”. With the danger cleared from the “controlled” area, the operation extended to residents living in those areas – thousands of civilians just trying to survive in a brutal time of war – now with at least some protection offered by the allied forces; “Build”. Finally, as the foothold expanded and the military had gained the trust of the residents on “their side”, there was a good change of longer term stability; “Hold”.
How can we use this as inspiration for bolstering our defense in cyber security? I see the Seize-Clear-Build-Hold phases relating directly to the activities we are already doing. We just haven’t aligned them in terms of a repeatable battle plan. I think we need to start by believing ALL of the areas of our company need to be re-taken. While it sounds dauting, it allows you to reestablish your knowledge and test assumptions about your organization's security. Let’s relate the phases to the security space:
Seize - We identify an area we will be focusing on to extend the boundary of safety and security. Then we organize the data, patches, assets, and users through logs as well as knowledge experts of the area. The first move into the area is to find anomalies or malicious behavior.
Clear - Once anomalies and malicious activities begin to be processed and cleared, we need to cast wider nets. Focus our security tooling on all assets; proper inventory, logging, secured privileged accounts, & full vulnerability scans.
Build - With control taken of the environment, we can begin incorporating proper and appropriate security into it. This includes ports closed, systems patched, endpoint and network security controls deployed and systems hardened. We also work with the knowledge experts on the systems and process to incorporate security into the lifecycle of their environment. This can be software release, code scanning, or audits. This is a cooperative exercise leveraging the strengths of all involved.
Hold - We tend to have a difficult time holding onto advantages in technology for very long. Staff turner over, competing projects, budget reduction and the speed of technology being adopted all contribute to this. It is important to outline the activities necessary for holding the defense of our assets including the evolution of detections, preventative controls, addressing vulnerability and testing gaps identified. One method of aiding this is to develop central talent and procedures, as well as continually incorporate additional environments into a central strategy. A good example of this is onboarding a newly acquired company.
Most importantly, this is not an academic approach. We have seen this process work inside large enterprises. Executed as iterative feedback loops, these repeated activities gain their own momentum and gravity. Talent flourishes, teams communicate effectively, and understanding of your environment grows.
We cannot change why attackers attack. And they will most certainly attack. What we can do is be ready for them, fight them when the attack comes, making their jobs hard enough that they decide it’s not worth it to keep fighting us, and move on to the next town.
