Attackers only have to get it right once: Defenders 100% of the time!

𝐀𝐭𝐭𝐚𝐜𝐤𝐞𝐫𝐬 𝐨𝐧𝐥𝐲 𝐡𝐚𝐯𝐞 𝐭𝐨 𝐠𝐞𝐭 𝐢𝐭 𝐫𝐢𝐠𝐡𝐭 𝐨𝐧𝐜𝐞, 𝐝𝐞𝐟𝐞𝐧𝐝𝐞𝐫𝐬 𝐡𝐚𝐯𝐞 𝐭𝐨 𝐠𝐞𝐭 𝐢𝐭 𝐫𝐢𝐠𝐡𝐭 100% 𝐨𝐟 𝐭𝐡𝐞 𝐭𝐢𝐦𝐞!

Do defenders really have to get it right 100% of the time though? 🤔

I’ve heard this phrase so often over the last decade and sometimes by people who should know better, 𝐢𝐭’𝐬 𝐭𝐢𝐦𝐞 𝐭𝐨 𝐜𝐚𝐥𝐥 𝐁𝐒 𝐨𝐧 𝐭𝐡𝐢𝐬! 💩

Its true attackers do have the element of surprise to a certain extent and can attack at any time using any means possible.  But the reality is for the most part they are opportunists and if you have:

🔵 solid cyber security foundations
🔵 a layered approach to trip up an attacker
🔵 monitoring and alerting in place that is effective
🔵 automated blocking in place for the most nefarious activities

You will identify and stop most attacks from happening.  If you have the ability to go further and use:

🟢 an assumed breach mindset
🟢 proactive threat hunting
🟢 incident response techniques (DFIR)

𝐓𝐡𝐞𝐧 𝐭𝐡𝐞 𝐚𝐭𝐭𝐚𝐜𝐤𝐞𝐫 𝐜𝐚𝐧𝐧𝐨𝐭 𝐡𝐢𝐝𝐞.  In your own organisation think about the layered defences you already have.

As an example, you should have a perimeter email gateway with policies and controls in place to detect malware, spam, phishing emails.  You should also have a next generation Firewall in place that performs further checks and prevents bad traffic from entering your enclave.  You then might have network monitoring, intrusion prevention systems and finally endpoint detection and response.  Hopefully some of these components are monitored with the right alerting in place to pick up those attacker behaviours as they make their way in and around your network.

Like any crime scene attackers will leave breadcrumbs that can be easily found if you know where to look.  Getting those breadcrumbs into your security operations strategy mix and alerting mechanisms isn’t always easy, but will go a long way to shifting the balance back in you the defenders favour.

So you don’t have to be perfect because neither is your attacker, after all they are only human and can trigger anyone of the controls or alerts you have in place.  The trick you must have though is to be smarter and outwit them.  🎯🛡️

𝐖𝐡𝐚𝐭 𝐝𝐨 𝐲𝐨𝐮 𝐭𝐡𝐢𝐧𝐤?