If you can't keep hackers out, find and remove them faster
[Commentary] In the wake of recent intrusions into government systems, it is difficult to identify anyone who believes defenders have the advantage in cyberspace. Digital adversaries seem to achieve their objectives at will, spending months inside target networks before someone, usually a third party, discovers the breach. Following the announcement, managers and stakeholders commit to improving security, yet offer few reasons to justify their optimism. It is time for governments at all levels to embrace a new strategy for defending information. That strategy should focus on finding and removing intruders already in the network, not shoring up defenses against adversaries assumed to be waiting to attack. To understand why this strategy change is needed, consider history.
In 2007, the public learned of a serious 2006 intrusion at the United States Department of State. The fallout is familiar: outrage over an intrusion affecting government systems, China suspected as the culprit, and questions regarding why the government's approach to security does not seem to be working. Following that breach, the State Department hired a new chief information security officer (CISO), who pioneered the Continuous Monitoring (CM) program. CM later became Continuous Diagnostic Monitoring (CDM), later renamed Continuous Diagnostics and Mitigation. CDM is a necessary part of a security program, but it should not be the priority. In brief, security strategy should not prioritize closing and locking a house’s doors and windows while there are intruders inside. Accordingly, I recommend a detect-and-respond strategy first and foremost, with CDM a lesser priority.