Security Verification and Offensive-Defensive Practice
A Hacker's Perspective: Three Approaches to Cyber Security Operations
Most cybersecurity professionals are taught to think about cybersecurity from a defensive perspective, but it is clear that even the most complete defensive measures seem hard-pressed to withstand pervasive hacker intrusions. As to how to guard against hacker attacks, why not try to ask this question: If I were a hacker, how would I penetrate this network?
Today, more than 90% of cyber technology spending is dedicated to defense technologies. The real challenge is that current defensive tools are not flexible or dynamic enough to evolve quickly and keep pace with advanced hacking techniques.
The following 3 important ideas are crucial to keeping your organisation secure, and the most critical is to change your own perspective:
Idea 1: Always think from a hacker's perspective
This is the primary consideration. When making cyber defence decisions, we must always think like a hacker.
Hackers who want to penetrate our systems are skilled professionals with malicious intent, and to fight them, we need people who can think like them and act like them. In short, we need a team that knows how to integrate a hacker's perspective; this is essentially like a hacker—someone who will do whatever it takes to penetrate our network.
In addition to strengthening security defences, understanding how to attack our own systems will provide us with more information to help protect ourselves. We encourage every company's cybersecurity team to have a member whose job it is to attack their own systems, and it is even better if this person has a rebellious mindset.
Understanding how hackers think and act will help organisations stay on the offensive, and offense is always the best defense.
Idea 2: Validate your network frequently
The persistence of hacking attacks, combined with today's advanced exploitation techniques, enables hackers to exploit vulnerabilities at any appropriate time. As a result, it is virtually impossible to protect your organisation using traditional cybersecurity methods.
It is estimated that 80% of cyber defence will be automated in the coming years, and it is crucial for organisations to be able to run intelligent, automated defence software 24/7. For example, the ability to perform automated penetration testing (continuously thinking and acting like a hacker) is one of the best ways to ensure your business has the tightest and strongest line of cyber defence possible.
Idea 3: Protect yourself from the inside out
One of the main pillars of a comprehensive cybersecurity strategy is to build and strengthen defensive walls (firewalls, WAFs, etc.) to keep hackers out, but many cybersecurity professionals do not realise that most attackers are already inside. To protect the most critical assets of the business, enterprises need to harden security systems from within to prevent irreversible damage. By following a few practical recommendations, the likelihood of an attack can be greatly reduced:
Proper authorization. By granting users the minimum privileges required for their scope of work, you can limit users' ability to access core business functions.
Strong passwords. Maintain a strict password policy. Passwords should be long, complex, and of high importance.
Monitoring and validation. Continuously monitor and validate the enterprise network, which will give you an accurate picture of your organisation's "security posture" and enable you to identify where security defence gaps lie.
