February 12, 2018 by
The Good, The Bad, and the Lucky - (Why improving security may not decrease your risk)
This was originally posted on blogger here.
Introduction
The general belief is that improving security is good. Traditionally, we assume every increment ‘x’ you improve security, you get a incremental decrease ‘y’ in risk. (See the orange 'Traditional' line below.) I suspect that might not be the case. I made the argument in THIS blog that our current risk markers are unproven and likely incorrect. Now I’m suggesting that even if you were able to accurately measure risk, it might not matter as what you do might not actually change anything. Instead, the relationship may be more like blue 'Proposed' line in the figure below. Let's me explain it and why it matters...
Threats
I think we can break attacks into two groups:
- Already scaled, automated attacks.
- Everything else (including attacks that could be automated or even are automated, but not scaled.)
Type-1 is mostly single-step attacks. Attackers invest in a single action and then immediately get the return on that investment. These could be ransomware, DoS, it shoautomated CMS exploitation, or phishing leading to stolen credentials, to compromised bank accounts.
Type-2 includes most of what we traditionally think of as hacking. Multi-step attacks including getting a foothold, pivot internally, and exfiltrate information. Not-petya attacks would fall in here as would the types of hacks most pen testers simulate.
Security Sections
Section one in the above figure is driven by risk from type-1 attacks. If you are vulnerable to these, you are just waiting your turn to be breached. Sections two and three relate to type-2 attacks.
In section two, your defenses, are good enough to stop type-1 attacks, but are likely not good enough to stop attackers willing and able to execute type-2 attacks. This is because, having an ability to execute a multi-step attack flexibly, the threat here has many different paths to choose from. If you either aren't studying all of your attack paths in context with each other, or are simply not able to handle everything thrown at you, the attacker gets in regardless of what security you do have. As such, the primary driver of risk is attacker selection (mostly unrelated to your security).
Once your security reaches section three, you start to have the path analysis and operational abilities to stave off attacks that can flexibly take different paths. As such, the more you improve, the more you see your risk go down (if you can measure it).
Risk vs Security
The first takeaway is that if you are in section one, you are a sitting duck. Automated attacks will find you on the internet and compromise you. Imagine the attackers with a big to-do list of potential victims and some rate at which they can compromise them. You are on that list somewhere, just waiting your turn. You need to get out of section one.
The second takeaway is that if you are better than the first section, it doesn’t really matter what you do. Increasing your security doesn’t really do anything until you get to a pretty darn mature point. All the actors looking for a quick ROI are going to be focused on section one. There are so many victims in section one that to target section two they would literally have to stop attacking someone easier. Even as type-2 attacks become commoditized, there’s absolutely no incentive to expand until either all of section one victims are exploited or the type-2 attack becomes a higher Return on Investment (ROI) than an existing type-1 attack. Here, because the attacks are type-2 attacks, the biggest predictor of if you will be breached is if you are targeted.
That is, until you get to section three. In this section, security has started to improve to the point where even if you are targeted, your security plays a significant role in if you are breached or not. These are the organizations that 'get it' when it comes to information security. The reality is most organizations probably are not able to get here, even if they try. The investment necessary in security operations, advanced risk modeling, and corporate culture are simply outside the reach of most organizations. Simply buying tools is not going to get you here. On the other hand, if you're going to try to get here, don't stop half-way. Otherwise you've wasted all investment since you left section one.
There is another scenario where someone not engaged in section one decides to go after the section two pool of victims with an automated attack. (Something like not-petya would work.) If this was common, it'd be a different story. However, there's no incentive for a large number of attackers to do this (as the cost is relatively fixed, and multiple attackers decreases the available victims for each). In this case, the automated attack ends up being global news because it's so wide-spread. As such, rules are created, triage is executed, and, in general, the attacker would have to continue significant investment to maintain the attack, decreasing the ROI. Given the easy ROI in section one, the sheer economics will likely prevent this kind of attack in section two.
Testing
Without testing, it's relatively hard to know in which section you are in. Pen testing might tell you how well you do in sections two and three, but knowing you lose against pen testers doesn't even tell you if you are out of section one. Instead, you need security unit testing to replicate type-1 attacks and verify that your defenses mitigate the risk.
If you never beat the pen testers, you're not in section three. However, once you start to be able to handle them, it's important to measure your operations more granularly. Are you getting better in section three or slipping back towards section two? That means measuring how quickly operations catches threats and what percent of threats they catch. Again, automated simulation of a type-2 attacks can help you capture these metrics.
Conclusion
Most organizations should be asking themselves "Am I in section one and, if so, how do I get out?" Even if you aren't in section 1, commoditization of new attacks may put you there in the near future. (See phishing, botnets, credential stuffing, and ransomware as examples over the last several years.) You need to continue to invest in security to remain ahead of section one.On the other hand, you may just have to accept being in section two. You can walk into an organization and, in a few minutes know whether they 'get it' or not when it comes to security. Many organizations will simply never 'get it'. That's ok, it just means you're not going to make it to section three so best not to waste investment on trying. Better to spend it to stay out of section one.
However, for the elite few organizations that do 'get it', section three takes work. You need to have staff that can close their eyes and see your attack surface with all of your risks in context. And you need a top-tier security operations team. Investment in projects that take three years to fund and another two to implement may keep you out of section one, but it's never going to get you into section three. To do that you need to adapt quickly to the adversary and meet them toe-to-toe when they arrive. That requires secops.