There is a link between all huge ransomware attacks around the globe and their success behind it. This connection is somewhat related to time itself. The advantage these adversaries have over us till now is not their sophistication but our inability to stop them before their breakout or even to track them before they happen.
WannaCry was probably among the least advanced, a lot of inadequately written ransomware payloads ever. A big part of it was damaged, and it never ever even ran in many prominent businesses the worm element raked through and created chaos in. It was its sheer speed that eventually beat business defenses and out-paced Incident Response groups in the trenches.
The most crucial point of this post is that our defenses do not have enough speed to catch these adversaries. There is absolutely nothing extremely advanced about many attacks: they are merely faster than we are!
We Have To Stop With The Lies
How can we seize time back on our team? We can start by discarding untruths such as these:
“It depends on when not if, we will be jeopardized” and “An attacker just needs to be right when to be successful, whereas protectors need to be best 100% of the time to avoid a breach.”
The reality is that it is just a matter of “when not if” if we as protectors are not able to manage the “when.”
The truth is the many of us have invested the last 3-4 years developing an enormous stack of very loud services, the large bulk of which can just (by meaning) help us after the truth. We have then invested another 1-2 years trying to get all of them to talk with each other to learn what bad thing simply happened to the business.
We are standing here doing the exact same thing over and over once again while anticipating much better results.
The Strategy To Win
The essential to winning versus an enemy is to understand where all are going to be, what all will do when they get there, and then taking an effort that prepares for the opponent’s point in order to stop them in their courses. The battleground is the endpoint … particularly your endpoint.
We have run incident response groups, and we have been fortunate enough to have had access to countless compromise evaluation reports. We can currently inform you what your RCA is going to be; we understand how they are getting in. You do, too: spearphishing, creds, RDP, susceptible web services, expert risk, and (unfortunately) your MSSP or 3rd party/supply chain.
And yes, our top users are still clicking on things since this is mostly what end users do on gadgets made for clicking things! They are not the issue, and training them successfully is just ever going to be a partial option, even when we get quantifiable developments on their habits.
We have to manage our own endpoints if we want to win. Managing an endpoint is not the exact same thing as having passive presence into what occurred on it, nor is it the capability to restore it from a back-up. It is managing it at a procedure level, duration.
If we have all the exposure globally; crystal clear, 20/20 vision and best hindsight but it does not notify us quick enough to take the action that really matters before the bad thing takes place, then all we have acquired with that exposure is friction, sound, chance expense of valuable (human) resources, and a perpetuation of the issue.
Turning the Tables Versus the Enemy
It’s time to turn the tables and take back time to the protector’s benefit, and to do so on the protector’s soil. Earlier above, I priced estimate a typical misdirected order we inform ourselves:
“An aggressor just needs to be right when to be successful, whereas protectors need to be ideal 100% of the time to avoid a breach.”
Let’s reorganize that declaration to our benefit. Let’s be much better hackers than the Darwinian crooks making fun of our after-the-fact cloud security platforms:
The reality is we have had the benefit the entire time. We own the endpoint.
We can analyze genuine procedures before a bad actor ever gets a grip. We can take advantage of NLP and Machine Learning (ML) to learn the whole world of possible destructive activity well before a bad step foot in our domain.
We can remove that procedure before it even finishes running in memory if we see PowerShell generated from a Word file bring a remote file. Since it is our domain; it is our endpoint, we can do all this.
Let’s get the enemy be most trustworthy 100% of the time. If they want to gain, let’s make them get it accurate at every step. Let’s get the best shot at stopping them before they get the steps we realize they must!
The Time is Now!
Time is the endpoint, and the fight is the battleground. To win at the game of time on a machine-speed field, we need to automate.
Let’s do this on the endpoint where the step is! If we really put very first things initially and win back the time benefit on the endpoint, then we might lastly be able to lean forward and resolve our identity, qualifications, IoT, expert SSDLC, risk, and supply chain issues.
