| | September - 2019ENTERPRISE SECURITY8IN MY OPINIONhe exploitation of information security vulnerabilities by our adversaries is inevitable, and the economic and reputational damage from these attacks can negatively impact the organization. Our adversaries are highly motivated, organized, and often well-funded, which gives them an advantage over current information security controls and methods. The primary mandate for information security programs is the protection of enterprise information and information systems from unauthorized access. It is challenging to safeguard the data assets of an enterprise in today's complex IT environment. Not only do information security personnel need to implement administrative, physical, and technical controls, they need to be mindful of all of the potential attacks that might compromise their systems. It would be easy to say that the unauthorized access to our data and systems is only due to the sophistication of our adversaries (including nation-states and organized crime) as well as the advanced tactics, techniques, and procedures (TTP) used by these adversaries. While there is evidence of advanced TTPs used in attacks, our adversaries often do not need to use these methods due to the inadequate security strategies as well as the ineffectiveness of the traditional security controls which are disproportionately technical and not always maintained. Proof of conventional security approaches failing is in the news almost every day.In 2017, the world experienced what happens when a combination of poor information security practices combined with a capable adversary exploits a system. The EternalBlue tool was used to weaponize the WannaCry attack against vulnerable systems which were unsupported (such as Windows XP) or not patched. The scale, speed, and impact of the successful attack were frightening. Over 150 countries and hundreds of thousands of computers were impacted in the first few hours, causing billions of dollars of damage.While some of the blame can be put on the software development and loss of the application by the government as well as the distribution of the tool by the cybercriminals, the organizations that were successfully attacked have to accept responsibility. Unless we change our practices, we will continue to see these types of attacks because organizations often use unsupported or deprecated systems as part of their business practice without adequate mitigating controls, do not routinely patch all firmware, operating systems, and applications, and do not adequately educate their workforce.Understanding how the adversaries target assets is an essential step in determining what controls are necessary or at least have the best chance of protecting the asset against TCybersecurity Assurance: Learning from the PastBy Cris Ewell, CISO, UW Medicine
< Page 7 | Page 9 >