The Key to Preventing Production Network Attacks Is to Start Looking Within

The business of cybercrime is rapidly increasing in scope and scale. The cost incurred by companies due to data breaches increased by nearly 10 percent from 2020 to 2021, meaning if the cost incurred by attacks was measured against the GDPs of all the nations of the world, it would be third largest, just lagging behind the U.S. and China. This growth only makes cybercrime more attractive to bad actors, giving this shadow economy access to more resources, talent, and, consequently, innovation — leading to our current predicament in which threats are emerging and evolving at an unprecedented pace.

Production environments are an especially attractive target for cybercriminals because disruptions to them are so costly. If a bad actor takes down a corporate network, it can inhibit business as usual for the employees, such as impacting payroll or their ability to communicate with one another. But if a production network is rendered inactive, the business is no longer able to provide its products or services — crippling their revenue flow and potentially severely damaging relationships with customers. It is hard to understate the devastating effect on long-term business continuity, reputation, and overall viability this creates. Given how much risk is associated with a production network attack, businesses need to start focusing seriously on this aspect of their operations if they want to be prepared for new waves of cyber attacks.

Fortunately, this risk can be mitigated. With network visibility, you can see indicators of threats or other anomalies in your production environment before they cause any headaches by developing into significant issues. Many DevSecOps teams might argue that they already have full visibility, but they typically only look at who’s entering and exiting their security perimeter or only examine NetFlow or other communication data in random samples. For true visibility, companies need a solution that lets them see all the communications being generated within their production environments. You can even think of it as an extension of the zero trust approach to security. While zero trust typically looks at each connection internally, this expands that notion to look at each external connection’s destination to understand whether it should be happening. Furthermore, while most every company has specified controls for security and corporate policies, without true visibility, it’s often impossible to validate that the controls are being properly and globally adhered to.

Much of the cybersecurity community still clings to an outdated perception of security as a wall around their enterprise’s networks. The main focus is on keeping everything bad outside the wall, while business continues unabated within its safety. But the reality of today’s world is that a bad actor will find a way to get past your defenses and in your production environment if they are determined to. Everyone can and will be breached, making the need for visibility critical for true business resiliency and business continuity.

These infiltrations still utilize traditional vulnerabilities like zero-day exploits, insiders, or social engineering scams, but our modern supply chain structure and use of cloud resources has introduced other risks. For example, many critical third-party programs utilize code from external libraries that, if compromised, can spread malware to all of the networks running the software. A similar scenario occurs when a third-party managed solutions provider is infected and exposes all of their customers. The SolarWinds attack in 2020 is a great example: Once its network was infiltrated, the bad actors responsible were able to use SolarWinds’ Orion software to hide and distribute malware to its users through updates. All told, more than 18,000 of the company’s customers were exposed to malicious code.

The real key to enhancing production environment resiliency is to not only watch out for attackers outside the wall, but also indicators that they might already be inside. For this approach, network visibility is critical, but many organizations aren’t closely monitoring their own internal communications. If you have no clue which of your devices are communicating with one another, which devices are sending traffic outside your network, and to whom they are sending it, you have a major blindspot for bad actors to exploit. You’re standing on the battlements, looking at the armies outside your gates, while undetected spies are wreaking havoc behind your back.

Without visibility, malware and other threats that have managed to get inside your production environment can remain hidden, but it also means these businesses don’t have a reliable way to ensure their policies and security controls are being followed. Following the maxim, “what gets measured gets managed,” having access to this insight spurs greater adherence to company dictates.

Fortunately, since most malware (more than 93 percent) and almost all communication uses DNS to identify external destinations, there is a scalable way to enable this visibility. After establishing a baseline of expected destinations and traffic patterns within and outside the production environment, deviations from it can indicate anomalies to be investigated and potential issues. For instance, traffic between devices that don’t usually talk to one another could be due to an intentional, innocuous change, but it could also indicate malware attempting to infect other devices. Likewise, by looking at outbound traffic, you can notice anomalies, such as a device suddenly starting to reach out to a previously uncontacted domain in Russia at the same time everyday.

However, the importance of visibility goes beyond enhancing your cybersecurity risk management. It also gives you a more accurate overall picture of what’s going on within your production environment, allowing you to detect all kinds of anomalies — including legacy issues, misconfigurations, violations of policies and controls, and potential future vulnerabilities. With this information, administrators can proactively address these problems, increasing overall network hygiene.

Cybercriminals are always looking for the next big score, and production environments make for enticing targets. Make no mistake — they will get in. However, with the appropriate visibility and controls in place, companies can diffuse these threats before they impact the most important part of their business and ensure business resiliency and continuity.

Featured

  • AI Is Now the Leading Cybersecurity Concern for Security, IT Leaders

    Arctic Wolf recently published findings from its State of Cybersecurity: 2025 Trends Report, offering insights from a global survey of more than 1,200 senior IT and cybersecurity decision-makers across 15 countries. Conducted by Sapio Research, the report captures the realities, risks, and readiness strategies shaping the modern security landscape. Read Now

  • Analysis of AI Tools Shows 85 Percent Have Been Breached

    AI tools are becoming essential to modern work, but their fast, unmonitored adoption is creating a new kind of security risk. Recent surveys reveal a clear trend – employees are rapidly adopting consumer-facing AI tools without employer approval, IT oversight, or any clear security policies. According to Cybernews Business Digital Index, nearly 90% of analyzed AI tools have been exposed to data breaches, putting businesses at severe risk. Read Now

  • Software Vulnerabilities Surged 61 Percent in 2024, According to New Report

    Action1, a provider of autonomous endpoint management (AEM) solutions, today released its 2025 Software Vulnerability Ratings Report, revealing a 61% year-over-year surge in discovered software vulnerabilities and a 96% spike in exploited vulnerabilities throughout 2024, amid an increasingly aggressive threat landscape. Read Now

  • Motorola Solutions Named Official Safety Technology Supplier of the Ryder Cup through 2027

    Motorola Solutions has today been named the Official Safety Technology Supplier of the 2025 and 2027 Ryder Cup, professional golf’s renowned biennial team competition between the United States and Europe. Read Now

  • Evolving Cybersecurity Strategies

    Organizations are increasingly turning their attention to human-focused security approaches, as two out of three (68%) cybersecurity incidents involve people. Threat actors are shifting from targeting networks and systems to hacking humans via social engineering methods, living off human errors as their most prevalent attack vector. Whether manipulated or not, human cyber behavior is leveraged to gain backdoor access into systems. This mainly results from a lack of employee training and awareness about evolving attack techniques employed by malign actors. Read Now

New Products

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis.

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.