From: Dark Reading

As attacks become more sophisticated and breaches abound, it’s time for enterprises to change their cybersecurity thinking from the ground up, experts say

By Tim Wilson

Layered security. Security integration. Defense in depth. For years now, cybersecurity professionals and vendors have been preaching sermons on the merits of an enterprise security strategy that mixes a variety of tools and technologies to create a complex barrier that hackers can’t penetrate. “Layered security” has become as much a part of industry parlance as authentication or encryption.

There’s just one problem: It isn’t working.

While enterprises and government agencies have invested unprecedented resources in cybersecurity over the past few years, the incidence of new data threats and breaches remains at record highs. The most recent Verizon Data Breach Investigations Report (PDF) indicates that breaches involving hacking and malware were both up considerably last year, with hacking involved in 81 percent of incidents and malware involved in 69 percent. According to the Cost of a Data Breach Report, malicious attacks on enterprise data rose last year, and the cost of a breach is at an all-time high ($222 per lost record). According to figures posted this month by Panda Labs, more than 6 million new malware samples were detected in the third quarter alone, and more than a third of machines across the globe are already infected.

Is it time to hit the “reset” button on cybersecurity strategy? Should organizations challenge current thinking around security architecture — and, particularly, the effectiveness of layered defense? Many experts think so.

“Organizations are implementing incremental improvements to their information security capabilities to provide short-term solutions — without tackling the issues associated with the overall information security threat,” says research and consulting firm Ernst & Young in its Global Information Security Survey 2012, published in October. “The need to develop a robust security architecture framework has never been greater.”

However, 63 percent of organizations have no such framework in place, the study says. “For years, companies have been approaching security as a technical problem, usually by buying products to solve specific problems,” says Jose Granado, principal and practice leader for IT security services at Ernst & Young and one of the authors of the new report. “There hasn’t been much thought put to how those technologies will work together, or to the people and process sides of the equation.”

While many large organizations have systems architects or network architects who help create the framework for the evolution of hardware and communications technology across the enterprise, most of E&Y’s large clients do not have security architects, Granado says.

“There is a huge [difference] between organizations that have a security architect and those that don’t,” he comments. “When there is an architecture that’s tied to the company’s business goals, then there’s a realization that security problems can’t be solved in a silo.” A well-defined architecture helps dictate how the various single-function security technologies will work together — and makes it easier to find the weak spots in enterprise defenses, he says.

Vinnie Liu, partner and co-founder of Stach & Liu, a consulting firm that works with large enterprises on security architecture and tests companies’ defense strategies, agrees that enterprises’ historical focus on point solutions has prevented many organizations from developing a broader security strategy.

“The industry has been approaching the cybersecurity problem like the TSA has been approaching the air-security problem,” Liu says. “First the bad guys brought guns on board, so they put in metal detectors. Then somebody put a bomb in his shoe, and now we all have to take our shoes off. Then they found liquid explosives, so now we can’t bring on any liquids. It’s one problem, one solution, with no real thought to the big picture.”

If enterprises do have a broader defense strategy, then it’s usually focused on “layering,” in which the organization buys a variety of different point products, essentially creating an obstacle course that the attacker must navigate to get to the sensitive data, Liu observes. By implementing a patchwork of firewalls, antivirus software, intrusion prevention systems, and the like, the enterprise hopes to detect a wide variety of attacks and mitigate them before they can do much damage.

Read Complete Article