By: Mark Sangster, VP, Chief of Strategy

Fiat Lux: Lighting the Way to Cybersecurity

Detection is key in many aspects of life, from medical diagnosis to positive treatment to more existential threats posed by massive storms like hurricanes or destructive tornadoes. The quicker we can detect something threatening or dangerous, the sooner we can respond accordingly. While we take this for granted in everyday life, we don’t always appreciate the value of early detection in cybersecurity. Put another way, making cyber threats visible is key to mitigating the risk.

This three-part blog series focuses on how we bring light to the threats and make them visible. In this series, I will explore what we mean by visibility in terms of cybersecurity, methods to detect or make visible threats, and how to measure your ability to detect and respond to those threats, measured in terms of business outcomes.

Part I: There is More to This Than Meets the Eye

When it comes to understanding the meaning of this statement, astronomy is a good teacher. Throughout the ages, scientists and novices alike have stared into the night skies, seeking answers. They looked to understand the celestial motions to predict the season for agriculture, suitable times for trade and travel, or simply to understand the world around them. Until the invention of the telescope in the early 1600s¹ only six planets in our solar system were visible. Not nearly 200 years later, advances in telescope lenses aided William Hershel in discovering a seventh planet, Uranus.

Yet observers of this planet were perplexed that the Newtonian physics thought to govern the motion of the planets could not account for certain anomalies in Uranus’ orbit. Astronomers predicted the presence of another planet that would explain these perturbations. In 1846, advances in telescope acuity and predictive orbital calculations led to the discovery of Neptune. Yet it wasn’t until 1989 that Voyager 2’ flyby discovered additional moons and dark rings that orbit the blue gas giant.²

The Power of Visibility in Cybersecurity

Lesson 1: The Need for Tools

There are two critical lessons from this brief history of planetary discovery. The first is that there is more to this than meets the eye. We need to develop tools and instruments to detect invisible objects. As thriller author Chris Pavone mused, “The best hiding spots are not the most hidden; they’re merely the least searched.³

In terms of cybersecurity, we develop new instruments to detect threats year after year. Firewalls, antivirus, endpoint detection and response, and so on. Each technology provides a set of detection capabilities that overlap the least searched locations, as Pavone suggests.

Lesson 2: The Presence of Inferential Threats

The second lesson is that not everything is obvious to the naked eye, even with the help of a telescope or similar augmentation of acuity. Consider another comparison to visible light. The portion of the electromagnetic (EM) spectrum that our eyes can detect is visible light.⁴ Yet this visible portion of the EM spectrum accounts for about 0.0035 percent of its entirety. The vast majority remains invisible. Our eyes cannot detect radio or microwaves or see infrared or ultraviolet light or X-rays.

Yet we can hear radio waves when captured by a sensor and converted into sound waves. We use microwaves to heat food. We can feel the heat of infrared and ultraviolet light, leading to sunburn when skin is unprotected. And X-ray imaging is a staple of medical care. We can’t see these forms of EM energy, but we can infer their presence from secondary evidence.

That’s the second lesson: not all cybersecurity threats are obvious or come in the form of an alert thrown by a firewall, endpoint defense, or antivirus. Those obvious threats like spam emails or messages from streaming services about declined payments are the background radiation of the internet. While primarily harmless at this point, they have the negative consequence of lulling too many pre-victims into a false sense of security.

Harnessing Implicit and Inferential Detections

Many threats are inferential, they don’t elicit an alert. They are the signals hiding in Pavone’s “least searched spots.” For example, most attacks begin with compromised credentials accessing security controls to create the appearance of legitimate activity. Credentials that were stolen using subtle phishing lures like student requests for mentoring or notification of fake lawsuits.

Once in, criminals use compromised accounts and devices to map your network, connect to critical services to identify valuable assets, and even create new user accounts in Active Directory. Lateral movement, privilege escalation, reconnaissance, staging, and more are all precursors to attacks. In many cases, these events go undetected. And these activities traverse your remote access gateways. Using your tools against you is a broad category of tactics called “living off the land.”

Leveraging Threat Hunting and Artificial Intelligence

Creating a robust cybersecurity defense requires multiple, overlapping sources that cover your entire attack surface. Full spectrum coverage includes more than internet traffic, endpoints and in-network communications, and cloud-service access. It’s covering remote access points and correlating those data points to create a contextual fabric of visibility: who is accessing what and why. Beyond tactical visibility, your attack surface includes vulnerability management and patching, simulated attacks, asset discovery, and security awareness programs.

Detecting these threats requires line speed analysis of network traffic and the correlation of users, groups, devices, and systems. It means collecting enormous volumes of data, normalizing and aggregating the data, and then analyzing it as fast as criminals can move inside your environment.

Of course, like light, the more security information you collect, the harder it is to focus the data to create a big picture. As you open the security aperture, the resource load is almost exponential. Most security teams will attest that exhausted resources and diminished budgets are no match for increasing cyber threats and growing regulatory requirements.

Up Next: Parts 2 & 3

In the next part of the series, we will explore how we harness implicit and inferential detections, use threat hunting to take the fight to the adversary and employ artificial intelligence to manage alert overload and spot invisible threats.

For more information about why implementing proactive security measures is essential to visibility, download “The Executive’s Guide to Cybersecurity.”