Five cyber security imperatives for all companies

Managing access to privileged accounts

Third, it is very important for organisations to manage access to privileged user accounts because according to every independent security report, the vast majority of successful cyber attacks have abused a privilege.

Insiders have either abused their own privilege or outsiders have stolen it, guessed it, or colluded with someone who has it, he said. “Maybe you simply have to change the [privileged user account] passwords because you have never done it before or it has been the same for the past 12 years.”

Carlson said about 95% of privilege that boils down to a person mapping to a privileged account and having that be in the right place.

“Change the password, record what they do, turn it off if you don’t need it. Spend your time on things that matter to your business, and use a tool or a process to do the things that can be automated, like password rotation and multi-factor authentication. Stop thinking about it, and do it. Too many people get stuck in analysis paralysis,” he said.

Vulnerability and patch management

Fourth, organisations need to get smarter about vulnerability and patch management because many are still not very good at it, despite the fact that the most attacks use vulnerabilities that have already been patched.

“Businesses typically upgrade their most critical processing system at least one a year with new business logic, so why can’t we as security and infrastructure people open a change ticket, follow the business process and patch the thing? If we don’t, we risk losing to a botnet,” he said.

Just by addressing privileged access and patch management, organisations can eliminate at least 90% of successful exploits used by attackers.

However, he said an organisation’s vulnerability management programme should focus on its particular critical assets to limit the scope of critical vulnerabilities it has to keep on top of. “Look at the ones that are the greatest risk to your organisation and have a known exploit so you can patch what is important to you,” said Carlson

“It is no longer a question of whether you should do this. I want to challenge you why you have not done so already. If you are still thinking about the edge cases [like developers], put them down as edge cases and solve immediately for the other 98%,” he said, adding that most of these edge cases have been addressed by privilege account management software suppliers.

Detecting malware

Fifth, Carlson said all organisations need to ensure their ability to detect things focuses on the abuse of privilege and that relate to their most important data assets.

“Through increased co-opetition, which is awesome, closed-loop remediation is becoming a thing again. You can detect malware and trigger a privilege change. You can detect misbehaviour and trigger a re-attestation. With Stix and Taxii, with APIs, Siems, and privilege management systems you can react in real time.

“When you look at how to detect and respond, you have to do the basics like turning on the logging functionality and have a Siem to organise this information, but if you can respond to what is critical and what is abused, it will help you to respond as quickly as possible.

“Layered security is still a thing. We still need something to prevent people from breaking in, you need to protect your endpoint from malware and privilege abuse, you should have a gatekeeper between your people and the datacentre, and inside the datacentre you should log, detect and control,” he said.

“If you are not already doing those things, start doing them now.”