Threat prediction a flawed security approach

Recently, I wrote about the challenge of trying to predict attacks, and how that approach leads to “anti-X” security strategies that are rapidly made obsolete by each new wave of threats.

The strategy of threat prediction suffers from two major flaws. First, it assumes predictability in a field that is full of surprises. Security is adversarial, and the adversaries already knows what we are doing — they can read this magazine, for example. New attacks are not designed in a vacuum; they are designed explicitly to sidestep our expectations. If we base our defenses on predicted threats, attackers sidestep our defenses when they sidestep our expectations.

Second, threat prediction causes tunnel vision. It pushes us to focus on attacks rather than assets, on the “bad” rather than the “valuable.” This plays right into the hands of attackers, as tunnel vision narrows our defenses thereby making them easier to bypass. Rather than trying to predict threats, we should focus on general security preparedness.

Read more

For more articles on security issues, visit IT World Canada’s Security Knowledge Centre

After all, there is no such thing as a “secure” company or system. Everything can be broken with enough effort and money. Secure companies are not those that do not get breached; every company will suffer a security failure (or several) sooner or later. Rather, secure companies are those that minimize both the incidence of successful attacks and then further minimize the impact of those few breaches. Accepting breaches as normal, business-as-usual and unavoidable puts the emphasis on preparedness rather than prediction.

Of course, this does not invalidate the need to establish defenses and controls that are specific. Just like a flu shot in the fall, you may take precautions against specific threats that are known and predictable. But most companies put a lot less emphasis on preparedness that they do on specific threats. We have seen this in our research year after year, where we find very few companies with specific, well designed and well drilled incident-response policies. It’s as if “incidents” represent the failure of security that no one wants to acknowledge. “Incidents” are of course the norm, not the exception. To repeat a biological example, we should be putting a lot more emphasis on frequent hand washing while keeping some chicken soup in stock, rather than trying to find more vaccines to take every fall.

Security preparedness favours the operational over the technological and the generic over the specific. The emphasis on operational security means more skilled people and fewer shiny appliances. The emphasis on the generic means more broad security controls (encryption, authentication, audit and monitoring) rather than specific silver bullets (anti-X). Uncertainty makes us uncomfortable but in fact is an ally. The less we focus on specific threats and the more we accept uncertainty, the better we can prepare for new threats.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Empowering the hybrid workforce: how technology can build a better employee experience

Across the country, employees from organizations of all sizes expect flexibility...

What’s behind the best customer experience: How to make it real for your business

The best customer experience – the kind that builds businesses and...

Overcoming the obstacles to optimized operations

Network-driven optimization is a top priority for many Canadian business leaders...

Thriving amid Canada’s tech talent shortage

With today’s tight labour market, rising customer demands, fast-evolving cyber threats...

Staying protected and compliant in an evolving IT landscape

Canadian businesses have changed remarkably and quickly over the last few...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now