This interview is an excerpt from our recent guide, The Future of Cybersecurity, which examines 15 trends transforming the way government safeguards information and technology.
“Security is all about trust,” said Richard Breakiron, Senior Director of Cyber Solutions of ViON, an information technology enterprise solutions provider. But how do you create that trust in the realm of cybersecurity, where users are remote and their identities are more difficult to verify?
Breakiron said the first impediment to a more secure cyberspace is a lack of critical attention to the risks of unsafe behavior. “What happened at Anthem, Target, Home Depot, and J.P. Morgan – those numbers are in the millions,” he said. “If those had been physical casualties that walked into emergency rooms in the United States, the reaction of the American citizenry would be very different. But because it’s virtual, people don’t have an appreciation for the dramatic problems that have occurred due to the missteps of just one or two employees.”
However, as the fallout from these attacks is increasingly felt by corporations and governments, Breakiron said we can expect to see more focus on cybersecurity best practices and identifying users who fail to uphold the practices.
Actually, Breakiron said cybersecurity isn’t that different from real-world security. For instance, he related it to security on the highway. As you drive, you trust that other drivers are licensed, following traffic rules, and maintaining safety to the best of their ability. However, that’s not always true and, in those cases, the security of everyone is compromised.
Similarly, network security can be compromised if a single user is breaking the trust of their colleagues and using bad cyber practices. “If there’s a weak link in physical trust and I lose my keys, my house is vulnerable. When I lose the virtual key, the entire network is potentially vulnerable,” said Breakiron.
So how do you strengthen that weak link? Breakiron said the key is to establish a virtual trust with your users. That process comprises four basic steps:
- Identity Management – Creating a virtual profile for an individual
- Authentication – Verifying that the user’s password, actions, and device match the established virtual profile
- Access Control – Granting access privileges to certain data and systems based on rules tied to that virtual identity
- Verification and Analytics – Auditing and tracing the first three steps
As cyber professionals implement this process, however, Breakiron emphasized a need to make sure they keep the end user in mind. “I want to maintain freedom of movement in the cyber domain,” he said. “I want to be able to log onto the network and share a credit card freely, knowing I can buy something, knowing that I’m not at risk doing that, because I love that convenience. But we have to come up with weighs and balances of the risks, relative to the rewards and the gains that we get from this capability.”
To efficiently execute this process and quickly establish virtual trust with end users, Breakiron said we are going to see cybersecurity strategies take a “Google car approach”. In the same way that self-driving cars mitigate the risk of bad drivers endangering our roads, automated security solutions will decrease bad cyber habits. “Our trust at the individual level is going to be automated. We recognize that [some users] don’t follow the rules… so we’re going to automate the rules,” Breakiron said.
In other words, when a link in this virtual trust chain is broken, solutions will create automated alerts and even take automatic actions to prevent a user from damaging a network. This automation will largely depend on the ability of these solutions to process massive amounts of data quickly, analyzing it for indicators of bad behavior and creating alerts when they are discovered.
“Once you understand how the mechanics of individuals and how business processes work, you try and devise ways to automate it. You come up with algorithms on how you can interpret data and make decisions,” Breakiron said. “What you see in industry today – what ViON and YaData are doing – is they’re bringing automated, next generation capabilities that rely on much faster computer processors, much faster software, and much more intelligent software to automate security.”
Breakiron said security is about trust. Yet it is also about having a plan when that trust is broken. With this ability to analyze large amounts of user data at rapid speeds, cybersecurity professionals can assuredly create virtual trust with their ends users. When that trust is broken, that weak link can be quickly identified and corrected.
