The Key to Preventing Production Network Attacks Is to Start Looking Within

• By David Ratner
• Jul 30, 2022

The business of cybercrime is rapidly increasing in scope and scale. The cost incurred by companies due to data breaches increased by nearly 10 percent from 2020 to 2021, meaning if the cost incurred by attacks was measured against the GDPs of all the nations of the world, it would be third largest, just lagging behind the U.S. and China. This growth only makes cybercrime more attractive to bad actors, giving this shadow economy access to more resources, talent, and, consequently, innovation — leading to our current predicament in which threats are emerging and evolving at an unprecedented pace.

Production environments are an especially attractive target for cybercriminals because disruptions to them are so costly. If a bad actor takes down a corporate network, it can inhibit business as usual for the employees, such as impacting payroll or their ability to communicate with one another. But if a production network is rendered inactive, the business is no longer able to provide its products or services — crippling their revenue flow and potentially severely damaging relationships with customers. It is hard to understate the devastating effect on long-term business continuity, reputation, and overall viability this creates. Given how much risk is associated with a production network attack, businesses need to start focusing seriously on this aspect of their operations if they want to be prepared for new waves of cyber attacks.

Fortunately, this risk can be mitigated. With network visibility, you can see indicators of threats or other anomalies in your production environment before they cause any headaches by developing into significant issues. Many DevSecOps teams might argue that they already have full visibility, but they typically only look at who’s entering and exiting their security perimeter or only examine NetFlow or other communication data in random samples. For true visibility, companies need a solution that lets them see all the communications being generated within their production environments. You can even think of it as an extension of the zero trust approach to security. While zero trust typically looks at each connection internally, this expands that notion to look at each external connection’s destination to understand whether it should be happening. Furthermore, while most every company has specified controls for security and corporate policies, without true visibility, it’s often impossible to validate that the controls are being properly and globally adhered to.

Much of the cybersecurity community still clings to an outdated perception of security as a wall around their enterprise’s networks. The main focus is on keeping everything bad outside the wall, while business continues unabated within its safety. But the reality of today’s world is that a bad actor will find a way to get past your defenses and in your production environment if they are determined to. Everyone can and will be breached, making the need for visibility critical for true business resiliency and business continuity.

These infiltrations still utilize traditional vulnerabilities like zero-day exploits, insiders, or social engineering scams, but our modern supply chain structure and use of cloud resources has introduced other risks. For example, many critical third-party programs utilize code from external libraries that, if compromised, can spread malware to all of the networks running the software. A similar scenario occurs when a third-party managed solutions provider is infected and exposes all of their customers. The SolarWinds attack in 2020 is a great example: Once its network was infiltrated, the bad actors responsible were able to use SolarWinds’ Orion software to hide and distribute malware to its users through updates. All told, more than 18,000 of the company’s customers were exposed to malicious code.

The real key to enhancing production environment resiliency is to not only watch out for attackers outside the wall, but also indicators that they might already be inside. For this approach, network visibility is critical, but many organizations aren’t closely monitoring their own internal communications. If you have no clue which of your devices are communicating with one another, which devices are sending traffic outside your network, and to whom they are sending it, you have a major blindspot for bad actors to exploit. You’re standing on the battlements, looking at the armies outside your gates, while undetected spies are wreaking havoc behind your back.

Without visibility, malware and other threats that have managed to get inside your production environment can remain hidden, but it also means these businesses don’t have a reliable way to ensure their policies and security controls are being followed. Following the maxim, “what gets measured gets managed,” having access to this insight spurs greater adherence to company dictates.

Fortunately, since most malware (more than 93 percent) and almost all communication uses DNS to identify external destinations, there is a scalable way to enable this visibility. After establishing a baseline of expected destinations and traffic patterns within and outside the production environment, deviations from it can indicate anomalies to be investigated and potential issues. For instance, traffic between devices that don’t usually talk to one another could be due to an intentional, innocuous change, but it could also indicate malware attempting to infect other devices. Likewise, by looking at outbound traffic, you can notice anomalies, such as a device suddenly starting to reach out to a previously uncontacted domain in Russia at the same time everyday.

However, the importance of visibility goes beyond enhancing your cybersecurity risk management. It also gives you a more accurate overall picture of what’s going on within your production environment, allowing you to detect all kinds of anomalies — including legacy issues, misconfigurations, violations of policies and controls, and potential future vulnerabilities. With this information, administrators can proactively address these problems, increasing overall network hygiene.

Cybercriminals are always looking for the next big score, and production environments make for enticing targets. Make no mistake — they will get in. However, with the appropriate visibility and controls in place, companies can diffuse these threats before they impact the most important part of their business and ensure business resiliency and continuity.