Predictive Security Intelligence: Achieving Holistic Cybersecurity

By: John Lainhart is a Partner and Christopher Ballister is an Associate Partner with IBM’s Global Business Services

To be effective in their security efforts, agencies must be proactive — using cyber analytics and cognitive-based systems to develop true security intelligence.

No longer can security programs rely on an “if it’s not broke, don’t fix it” approach — adversaries could already be inside systems, stealing data or probing for weaknesses. Too many CIOs and CISOs have thought their systems and data were secure when in fact they were anything but.

Security programs need effective protection of valuable information and systems to prevent data breaches, and to comply with the ever-increasing federal compliance requirements. Among others, there are the Federal Information Security Management Act (FISMA), the Privacy Act, policy and guidance from the Office of Management and Budget and the National Institute for Standards and Technology, the General Services Administration’s Federal Risk Authorization and Management (FedRAMP) program, and the Federal Acquisition Regulation to be considered.

To be effective, CIOs and CISOs need timely cyber security insights to take proactive actions, because today’s security challenges are greater than ever.

With massive increases in data, mobile devices and connections, security challenges are increasing in number and scope. The aftermath of a breach can be devastating to an organization in terms of both reputational and monetary damages, and can be experienced through three major categories of security challenges: external threats, internal threats and compliance requirements.

External threats

The nation faces a proliferation of external attacks against major companies and government organizations. In the past, these threats have largely come from individuals working independently. However, these attacks have become increasingly more coordinated, and are being launched by groups ranging from criminal enterprises to organized collections of hackers to state-sponsored entities. Attackers’ motivations can include profit, prestige, or espionage.

These attacks target ever-more critical organizational assets, including customer databases, intellectual property and even physical assets that are driven by information systems. They have significant consequences, resulting in IT, legal and regulatory costs, not to mention loss of reputation. Many of these attacks take place slowly over time, masked as normal activity. The vector known as Advanced Persistent Threat requires specialized continuous monitoring methods to detect threats and vulnerabilities prior to breaches or loss of sensitive data.

Internal threats

In many situations, breaches come not from external parties, but from insiders. Insiders today can be employees, contractors, consultants and even partners and service providers. The causes range from careless behavior and administrative mistakes (such as giving away passwords to others, losing back-up tapes or laptops, or inadvertently releasing sensitive information) to deliberate actions taken by disgruntled employees. The resulting dangers can easily equal or surpass those from external attacks.

A strong security program must include capabilities to predict both external and internal threats and assess their mission impacts, validated by cognitive technology and cybersecurity experts serving mission operators.

Compliance Requirements and Effective Protection

Public sector enterprises face a steadily increasing number of federal, industry and local mandates related to security, each of which have their own standards and reporting requirements. In addition to the federal requirements noted above, there are sector-specific requirements like the Health Insurance Portability and Accountability Act and the Health Information Technology for Economic and Clinical Health Act (HIPAA/HITECH) for health information and Sarbanes-Oxley for financial information. And then there are state privacy/data breach laws, Control Objectives for Information and Related Technology (COBIT), and various international standards and privacy directives. Complying with these and other requirements often takes a significant amount of time and effort to prioritize issues, develop appropriate policies and controls, and monitor compliance.

To address external, internal, and compliance challenges through a proactive approach, mission-oriented cognitive cybersecurity capability is needed. To achieve such capability, four key areas must be addressed:

Security architecture effectiveness. Agencies must focus on rapidly accessing vulnerabilities in the security architecture and developing a prioritized road map to strengthen cyber protection that plugs security gaps and meets policy expectations. Ensuring the identity of users and their access rights, and reducing the number of privileged users, is critically important to effective security architecture.

Critical data protection. Agencies must focus on rapidly accessing the data architecture, and shortfalls in tracking and protecting critical data. Prioritized action plans can reshape data architecture for more focused security protection and improved continuous monitoring.

Security compliance. Agencies must focus on rapidly accessing compliance gaps and establishing a roadmap to prioritize issues, develop appropriate policies and controls, and achieve compliance.

A holistic security program. Effectively implementing the first three areas above enables agencies to lay the foundation of a program that addresses risk management and IT governance at the enterprise level. Organizations can then identify risks to critical business processes that are most important to mission success, as well as threats and vulnerabilities that can impact critical business processes. They can also craft appropriate IT governance, which is a key enabler of successful cybersecurity protection. IT governance provides the “tone at the top,” emphasizing that ensuring security and privacy is the responsibility of all staff. In addition, consistent and standardized security protocols, privacy processes and technology configurations support protection at a lower cost.