The Key to Preventing Production Network Attacks Is to Start Looking Within

The business of cybercrime is rapidly increasing in scope and scale. The cost incurred by companies due to data breaches increased by nearly 10 percent from 2020 to 2021, meaning if the cost incurred by attacks was measured against the GDPs of all the nations of the world, it would be third largest, just lagging behind the U.S. and China. This growth only makes cybercrime more attractive to bad actors, giving this shadow economy access to more resources, talent, and, consequently, innovation — leading to our current predicament in which threats are emerging and evolving at an unprecedented pace.

Production environments are an especially attractive target for cybercriminals because disruptions to them are so costly. If a bad actor takes down a corporate network, it can inhibit business as usual for the employees, such as impacting payroll or their ability to communicate with one another. But if a production network is rendered inactive, the business is no longer able to provide its products or services — crippling their revenue flow and potentially severely damaging relationships with customers. It is hard to understate the devastating effect on long-term business continuity, reputation, and overall viability this creates. Given how much risk is associated with a production network attack, businesses need to start focusing seriously on this aspect of their operations if they want to be prepared for new waves of cyber attacks.

Fortunately, this risk can be mitigated. With network visibility, you can see indicators of threats or other anomalies in your production environment before they cause any headaches by developing into significant issues. Many DevSecOps teams might argue that they already have full visibility, but they typically only look at who’s entering and exiting their security perimeter or only examine NetFlow or other communication data in random samples. For true visibility, companies need a solution that lets them see all the communications being generated within their production environments. You can even think of it as an extension of the zero trust approach to security. While zero trust typically looks at each connection internally, this expands that notion to look at each external connection’s destination to understand whether it should be happening. Furthermore, while most every company has specified controls for security and corporate policies, without true visibility, it’s often impossible to validate that the controls are being properly and globally adhered to.

Much of the cybersecurity community still clings to an outdated perception of security as a wall around their enterprise’s networks. The main focus is on keeping everything bad outside the wall, while business continues unabated within its safety. But the reality of today’s world is that a bad actor will find a way to get past your defenses and in your production environment if they are determined to. Everyone can and will be breached, making the need for visibility critical for true business resiliency and business continuity.

These infiltrations still utilize traditional vulnerabilities like zero-day exploits, insiders, or social engineering scams, but our modern supply chain structure and use of cloud resources has introduced other risks. For example, many critical third-party programs utilize code from external libraries that, if compromised, can spread malware to all of the networks running the software. A similar scenario occurs when a third-party managed solutions provider is infected and exposes all of their customers. The SolarWinds attack in 2020 is a great example: Once its network was infiltrated, the bad actors responsible were able to use SolarWinds’ Orion software to hide and distribute malware to its users through updates. All told, more than 18,000 of the company’s customers were exposed to malicious code.

The real key to enhancing production environment resiliency is to not only watch out for attackers outside the wall, but also indicators that they might already be inside. For this approach, network visibility is critical, but many organizations aren’t closely monitoring their own internal communications. If you have no clue which of your devices are communicating with one another, which devices are sending traffic outside your network, and to whom they are sending it, you have a major blindspot for bad actors to exploit. You’re standing on the battlements, looking at the armies outside your gates, while undetected spies are wreaking havoc behind your back.

Without visibility, malware and other threats that have managed to get inside your production environment can remain hidden, but it also means these businesses don’t have a reliable way to ensure their policies and security controls are being followed. Following the maxim, “what gets measured gets managed,” having access to this insight spurs greater adherence to company dictates.

Fortunately, since most malware (more than 93 percent) and almost all communication uses DNS to identify external destinations, there is a scalable way to enable this visibility. After establishing a baseline of expected destinations and traffic patterns within and outside the production environment, deviations from it can indicate anomalies to be investigated and potential issues. For instance, traffic between devices that don’t usually talk to one another could be due to an intentional, innocuous change, but it could also indicate malware attempting to infect other devices. Likewise, by looking at outbound traffic, you can notice anomalies, such as a device suddenly starting to reach out to a previously uncontacted domain in Russia at the same time everyday.

However, the importance of visibility goes beyond enhancing your cybersecurity risk management. It also gives you a more accurate overall picture of what’s going on within your production environment, allowing you to detect all kinds of anomalies — including legacy issues, misconfigurations, violations of policies and controls, and potential future vulnerabilities. With this information, administrators can proactively address these problems, increasing overall network hygiene.

Cybercriminals are always looking for the next big score, and production environments make for enticing targets. Make no mistake — they will get in. However, with the appropriate visibility and controls in place, companies can diffuse these threats before they impact the most important part of their business and ensure business resiliency and continuity.

Featured

  • ASIS International and SIA Release “Complexities in the Global Security Market: 2024 Through 2026”

    ASIS International and the Security Industry Association (SIA) – the leading security associations for the security industry – have released ”Complexities in the Global Security Market: 2024 Through 2026”, a new research report that provides insights into the equipment, technologies, and employment of the global security industry, including regional market breakouts. SIA and ASIS partnered with global analytics and advisory firm Omdia to complete the research. Read Now

  • President Biden Issues Executive Order to Bolster U.S Port Cybersecurity

    On Wednesday, President Biden issued an Executive Order to bolster the security of the nation’s ports, alongside a series of additional actions that will strengthen maritime cybersecurity and more Read Now

  • Report: 15 Percent of All Emails Sent in 2023 Were Malicious

    VIPRE Security Group recently released its report titled “Email Security in 2024: An Expert Look at Email-Based Threats”. The 2024 predictions for email security in this report are based on an analysis of over 7 billion emails processed by VIPRE worldwide during 2023. This equates to almost one email for everyone on the planet. Of those, roughly 1 billion (or 15%) were malicious. Read Now

  • ASIS Announces ANSI-Approved Cannabis Security Standard

    ASIS International, a leading authority in security standards and guidelines, proudly announces the release of a pioneering American National Standards Institute (ANSI)-approved standard dedicated to cannabis security. This best-in-class standard, meticulously developed by industry experts, sets a new benchmark by providing comprehensive requirements and guidance for the design, implementation, monitoring, evaluation, and maintenance of a cannabis security program. Read Now

Featured Cybersecurity

Whitepapers

New Products

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file. 3

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis. 3