Page 29 - FCW, May 2017

Shadow IT — a combination of unau- thorized and unidentified solutions — is a growing problem for federal agencies. Audits by inspectors gener- al and the Government Accountability Office demonstrate the lack of com- plete knowledge about what resides on and interacts with agency networks (hardware, software, mobile, IoT, etc.). Agencies cannot protect what they don’t know about.
Fortunately, new tools are much bet- ter at tracing networks and detecting/ identifying devices. Security analyt- ics correctly applied to network traf- fic helps shine light into the shadows. 3. People trained in advanced ana- lytical tools are crucial. Federal CIOs, CTOs and chief information security officers must hire and retain the right team for security analytics and treat it as an ongoing investment. Security analysts must be curious, explore the high-value anomaly data they collect, trace unusual patterns and follow the trail of an investigation wherever it leads.
Looking at individual or correlated events is not sufficient anymore. That approach is being augmented by a rise in “offensive hunting” in which highly trained analysts emulate bad actors (hired hacktivists, rogue nation-states, insider threats) and their tactics to pen- etrate networks, devices, applications and systems.
Advanced security analytics requires bridging two new profession- al domains: hacking and data science. Most experts specialize in one or the other but not both. Accordingly, data scientists and security experts need to work together to enable the use cases that are essential to good security diag- nostics and continuous monitoring.
Agencies still need competent secu- rity analysts to tweak models, confirm “good” versus “bad” anomalies and ana- lyze critical outputs of agentless appli- ances. Although red teams and hunt
There is no single tool, no single database and no single approach to solving a cyberthreat problem.
teams play a separate role in cyber defense in larger organizations, skills and experience are in short supply and often an outsourced capability.
Those capabilities, combined with effective incident response processes, are critical for continuous security improvements and a full understand- ing of different types of attacks, includ- ing commonly used phishing and other social engineering techniques.
More important, agencies must set up cyber analytics to fit their risk pro- file and threat vectors. It is not uncom- mon for agencies to drop sophisticated tools into their networks without hav- ing skilled employees do the required tuning to optimize detection and pro- tection for specific and unique threat ecosystems. One size does not fit all, but going with default settings is cre- ating such an environment, which is easy to breach and attack using zero- day exploits with far-ranging impacts. 4. Continuous monitoring must include continuous data sharing. Critical data for cyber analytics is typically not owned by the security departments. Instead, the business or program side of an agency is the data owner and access controller. Well- defined cyber and data governance and stakeholder management are needed to tackle that complication. Addition- ally, proper processes and technology are the key to collecting and delivering the right data.
Security officials should reset cur- rent approaches by clearly defining what they want to achieve with cyber analytics, followed by consideration of
three key initial steps:
• For agencies still relatively new to the cyber analytics space, it might be worthwhile to explore the open-source versions of tools or, alternatively, pur- sue time-bound pilots or “proofs of value” that can be up and running with demonstrated results in days or weeks before jumping to advanced tool acqui- sitions. That approach can help garner executive support and gain the IT team some experience with the tools.
• Agencies should follow a strategy and roadmap that embrace the idea that there is no single tool, no single database and no single approach to solving a cyberthreat problem. Locking into a vendor/solution in an evolving market could be premature, particu- larly if that vendor is not tuned into changing threat environments. Security analytics should complement diverse strengths rather than compete against one another.
• Setbacks should be expected. Secu- rity analytics will not solve all detection problems or pinpoint every threat. The tools can, however, reduce alert vol- umes and false positives, identify pre- viously unknown threats, and uncover abusive insider threats. Agencies must learn from each journey down thorny cybersecurity pathways — from their own mistakes and those of others. Continuous adaptation, learning and adjustment are necessary in such a complex and ever-changing cyberthreat environment. n
Dave McClure is chief strategist at Coalfire Federal.
May 2017 FCW.COM 29