The Key to Preventing Production Network Attacks Is to Start Looking Within

The business of cybercrime is rapidly increasing in scope and scale. The cost incurred by companies due to data breaches increased by nearly 10 percent from 2020 to 2021, meaning if the cost incurred by attacks was measured against the GDPs of all the nations of the world, it would be third largest, just lagging behind the U.S. and China. This growth only makes cybercrime more attractive to bad actors, giving this shadow economy access to more resources, talent, and, consequently, innovation — leading to our current predicament in which threats are emerging and evolving at an unprecedented pace.

Production environments are an especially attractive target for cybercriminals because disruptions to them are so costly. If a bad actor takes down a corporate network, it can inhibit business as usual for the employees, such as impacting payroll or their ability to communicate with one another. But if a production network is rendered inactive, the business is no longer able to provide its products or services — crippling their revenue flow and potentially severely damaging relationships with customers. It is hard to understate the devastating effect on long-term business continuity, reputation, and overall viability this creates. Given how much risk is associated with a production network attack, businesses need to start focusing seriously on this aspect of their operations if they want to be prepared for new waves of cyber attacks.

Fortunately, this risk can be mitigated. With network visibility, you can see indicators of threats or other anomalies in your production environment before they cause any headaches by developing into significant issues. Many DevSecOps teams might argue that they already have full visibility, but they typically only look at who’s entering and exiting their security perimeter or only examine NetFlow or other communication data in random samples. For true visibility, companies need a solution that lets them see all the communications being generated within their production environments. You can even think of it as an extension of the zero trust approach to security. While zero trust typically looks at each connection internally, this expands that notion to look at each external connection’s destination to understand whether it should be happening. Furthermore, while most every company has specified controls for security and corporate policies, without true visibility, it’s often impossible to validate that the controls are being properly and globally adhered to.

Much of the cybersecurity community still clings to an outdated perception of security as a wall around their enterprise’s networks. The main focus is on keeping everything bad outside the wall, while business continues unabated within its safety. But the reality of today’s world is that a bad actor will find a way to get past your defenses and in your production environment if they are determined to. Everyone can and will be breached, making the need for visibility critical for true business resiliency and business continuity.

These infiltrations still utilize traditional vulnerabilities like zero-day exploits, insiders, or social engineering scams, but our modern supply chain structure and use of cloud resources has introduced other risks. For example, many critical third-party programs utilize code from external libraries that, if compromised, can spread malware to all of the networks running the software. A similar scenario occurs when a third-party managed solutions provider is infected and exposes all of their customers. The SolarWinds attack in 2020 is a great example: Once its network was infiltrated, the bad actors responsible were able to use SolarWinds’ Orion software to hide and distribute malware to its users through updates. All told, more than 18,000 of the company’s customers were exposed to malicious code.

The real key to enhancing production environment resiliency is to not only watch out for attackers outside the wall, but also indicators that they might already be inside. For this approach, network visibility is critical, but many organizations aren’t closely monitoring their own internal communications. If you have no clue which of your devices are communicating with one another, which devices are sending traffic outside your network, and to whom they are sending it, you have a major blindspot for bad actors to exploit. You’re standing on the battlements, looking at the armies outside your gates, while undetected spies are wreaking havoc behind your back.

Without visibility, malware and other threats that have managed to get inside your production environment can remain hidden, but it also means these businesses don’t have a reliable way to ensure their policies and security controls are being followed. Following the maxim, “what gets measured gets managed,” having access to this insight spurs greater adherence to company dictates.

Fortunately, since most malware (more than 93 percent) and almost all communication uses DNS to identify external destinations, there is a scalable way to enable this visibility. After establishing a baseline of expected destinations and traffic patterns within and outside the production environment, deviations from it can indicate anomalies to be investigated and potential issues. For instance, traffic between devices that don’t usually talk to one another could be due to an intentional, innocuous change, but it could also indicate malware attempting to infect other devices. Likewise, by looking at outbound traffic, you can notice anomalies, such as a device suddenly starting to reach out to a previously uncontacted domain in Russia at the same time everyday.

However, the importance of visibility goes beyond enhancing your cybersecurity risk management. It also gives you a more accurate overall picture of what’s going on within your production environment, allowing you to detect all kinds of anomalies — including legacy issues, misconfigurations, violations of policies and controls, and potential future vulnerabilities. With this information, administrators can proactively address these problems, increasing overall network hygiene.

Cybercriminals are always looking for the next big score, and production environments make for enticing targets. Make no mistake — they will get in. However, with the appropriate visibility and controls in place, companies can diffuse these threats before they impact the most important part of their business and ensure business resiliency and continuity.

Featured

  • Maximizing Your Security Budget This Year

    Perimeter Security Standards for Multi-Site Businesses

    When you run or own a business that has multiple locations, it is important to set clear perimeter security standards. By doing this, it allows you to assess and mitigate any potential threats or risks at each site or location efficiently and effectively. Read Now

  • Getting in Someone’s Face

    There was a time, not so long ago, when the tradeshow industry must have thought COVID-19 might wipe out face-to-face meetings. It sure seemed that way about three years ago. Read Now

    • Industry Events
    • ISC West
  • ISC West 2024 is a Rousing Success

    The 2024 ISC West security tradeshow marked a pivotal moment in the industry, showcasing cutting-edge technology and innovative solutions to address evolving security challenges. Exhibitors left the event with a profound sense of satisfaction, as they witnessed a high level of engagement from attendees and forged valuable connections with potential clients and partners. Read Now

    • Industry Events
    • ISC West
  • Live From ISC West: Day 2

    What a great show ISC West 2024 has been so far. The second day on Thursday was as busy or even more hectic than the first. Remember to keep tabs on our Live From ISC West page for news and updates from the show floor at the Sands Expo, because there’s more news coming out than anyone could be expected to keep track of. Read Now

    • Industry Events
    • ISC West

Featured Cybersecurity

Webinars

New Products

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame. 3

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis. 3