Download as PDF, PPTX
security-team-guide-reducing-operational-risk.pdf
- 1. The Security Team’s Guide toReducing Operational Risk How Threat Intelligence Provides a Critical Advantage
- 2. Introduction: In today’s worldof global complexity and instability, security teams face unprecedented challenges in safeguarding their organizations. Executives and practitioners alike need to ask themselves: are we equipped with the insight and capability to effectively protect our organization now and in the future? Your organization and leaders know they can’t be reactive. The news is littered with stories of businesses who were disrupted by cyber threats and suffered reputation damage, financial losses, and operational downtime. Leadership needs to know if your organization is resilient, able to stay secure amidst turmoil and continue to thrive so they can be more successful in the long term. Threat intelligence provides security teams with a significant advantage. It is the connecting layer across your cyber, supply chain, and physical infrastructure that powers your security tools, processes, and people to reduce operational risk. By implementing threat intelligence, security teams can proactively defend against threats targeting both your dynamic attack surface and third-party relationships. Furthermore, they can strengthen defenses against ransomware attacks and enhance operational workflows through automation. In this eBook, we will explore the challenges that increase operational risk and demonstrate how threat intelligence can empower your team to overcome them. Key Topics covered in this eBook: • Why security teams should be concerned with operational risk • The advantage that Threat Intelligence provides • Four key challenges increasing operational risk and how to overcome them with Threat Intelligence • The Power of Recorded Future for reducing operational risk “The character of cyber threats has changed. Respondents now believe that cyber attackers are more likely to focus on business disruption and reputational damage. These are the top two concerns among respondents.” - World Economic Forum, Global Cybersecurity Outlook 2023
- 3. What is OperationalRisk? Operational Risk is the risk of loss due to failed internal processes or external events. Resulting in business disruption, system failure, infrastructure damage, fraud & more. Organizations of all sizes, across the world face operational risk. It is the nature of the complex digital and physical worlds we operate in today. These risks don’t stem from one point, they can arise from technical failures, human errors or omissions, failed internal processes and systems, or from external events that are nearly impossible to control or plan for. of companies who have experienced a cyber incident over the past two years have suffered lost productivity 1 organizations have experienced a significant outage in the last three years that negatively affected their reputation, revenue, and compliance adherence 2 41% 1in 5 Why Does Operational Risk Matter? As businesses grow more interconnected and dependent on technology, safeguarding sensitive data and reducing operational risk has become increasingly important. Yet the complexity of cyber threats makes it difficult to manage operational risk and impacts to: • Business disruptions • Infrastructure • Employee and client safety Clients unable to access their data Poor client experience Customers unable to transact Purchase similar item from competitor Employees unable to use their tools Loss of productivity Customer data compromised Trust goes down Risk Effect 1 https://www.splunk.com/en_us/form/state-of-security.html 2 https://trilio.io/wp-content/uploads/2022/08/true-Cost-of-Downtime-infographic.pdf
- 4. To cover all attacksurfaces To prioritize To enhance automation To drive better ROI Intelligence Advantage With the current model, reducing operational risk isn’t easy. Detection tools only see traffic that hits a network, they can’t see all of the different exposures and misconfigurations that attackers can. There’s no control over third parties to enforce, detect, respond, or control. Ransomware consists of a complex web of activities, and while some of your security tools may give you a partial view of what and how to defend, they fail to provide the full picture. Automation is increasingly important, but there’s often confusion around how, what, and when to automate. Without answering these questions, automation strategies may fail due to unrealistic expectations. To get around these problems, an advantage is needed. An advantage that helps you go beyond internal telemetry to enhance security controls and defenses with comprehensive external data that’s contextualized, analyzed, and prioritized, layered with probability and implications, in an actionable format. Threat Intelligence provides an advantage to identify and get ahead of risks that matter, make the right decisions for your organization, and build resilience, at the speed and scale of today’s threat environment. Threat intelligence protects against internal failures and external threats, providing the connecting layer needed to reduce operational risk.
- 5. How Threat Intelligence ReducesOperational Risk “Threat actors are looking at your digital footprint outside the organization to launch an attack. You must take proactive measures. You have to monitor your digital assets. You have to remediate incidents. You must proactively protect your brand and your image. To do that you need timely intelligence.” - Group Head/CISO, Allied Bank “To support our proactive approach to security, we needed to invest in threat intelligence to prepare us for cyber attacks before they happen.“ - General Manager of Cyber Security Center, Toshiba Protect Your Expanding Digital Attack Surface Mitigate Third-Party Risks in Your Supply Chain Defend Against Ransomware Automate Security Workflows for Real-time Remediation What benefits can threat intelligence offer your organization? Threat intelligence provides a comprehensive shield by covering all attack surfaces, including digital, physical, and third-party. It enables organizations to prioritize their most critical assets, ensuring that valuable resources are allocated effectively. In addition, integrating threat intelligence into existing systems and processes enhances automation, reducing human error and response times. As a result, businesses achieve a higher return on investment, as a secure and efficient infrastructure allows for uninterrupted growth at scale.
- 6. Overcoming Operational Risk Challenges with ThreatIntelligence Protect Your Expanding Digital Attack Surface Implementing various technologies and systems to support remote work, digital experiences, and innovation significantly expands your attack surface. This also increases the number of employee credentials that need to be secured and software vulnerabilities that must be patched. In addition as your reputation grows, so do the risks to your brand, which could take the form of company or executive impersonation, domain abuse, or the creation of fake mobile apps. It’s not just the high-profile items; even small assets, often considered unimportant, can contribute to increased operational risk. For instance, a Fortune 500 financial institution was running a vulnerable version of WordPress allowing unrestricted file upload and remote code execution. To protect your expanding digital attack surface it’s critical that all doors into your organization are under lock and key. Threat intelligence provides proactive warning signals and automatically detects digital risks to your organization – such as domain abuse, vulnerable assets, compromised credentials, and more – allowing you to prioritize critical risks and keep your attack surface secure. Visibility into the vulnerable version of WordPress the financial institution was using enabled them to immediately flag for internal investigation and remediation. Digital Transformation Real-time visibility Unknown Assets Digital Risks Compromised Credentials Vulnerable Applications M&A Events Prioritized exposure & risk to address Business Growth Business Growth Challenges Threat Intelligence Outcome 3 https://www.csoonline.com/article/3648998/look-for-attack-surface-management-to-go-mainstream-in-2022.html of organizations have experienced a cyberattack that started through the exploit of an unknown, unmanaged or poorly managed internet-facing asset 3 69%
- 7. Mitigate Third-Party Risks inYour Supply Chain Third-party vendors are a critical component for today’s modern business, helping them to streamline supply chains, accelerate product deliveries, spur innovation, increase efficiency, and lower costs. But there is a cost to these relationships and achieving these benefits. Organizations must grant third parties access to information systems that support core functions such as product design, manufacturing, logistics, order fulfillment, and finance. While critical to continued success, every vendor introduces potential threats to your organization, with more than 80 percent of organizations reporting a third-party related breach in the past year. The stakes are far too high to ignore third-party risk. Your third parties’ attack surface evolves continuously as new infrastructure is spun up, all while threat actors continue to wage attacks. To stay ahead of ever-evolving threats in our business world, you need a threat-focused approach. Threat Intelligence provides comprehensive visibility into your supply chain threat landscape so you can detect threats earlier. This empowers security teams and business leaders to make fast, informed decisions about the companies in their supply chain and reduce the overall risk of business disruption, data breaches, and reputational damage. For example, a media & entertainment company deals with a lot of executive anxiety about product details being leaked before they are released since many small vendors and contractors are involved in product launches and directly handle their high value data. Threat intelligence helps them spot check each vendor’s security hygiene in real-time to identify vulnerabilities or anomalies in niche technologies, enabling them to mitigate risks before they can have a detrimental impact. Geopolitical Instability Visibility into third-party vulnerabilities Limited Visibility Uncertainty Reactive Approach Reliance on Third Parties Context on cyber and physical risk Supply Chain Weakness Proactive mitigation and faster incident response Challenges Threat Intelligence Outcome 4 https://www.sonatype.com/state-of-the-software-supply-chain/introduction of third-party vendors are properly evaluated for security vulnerabilities 4 50% Less than
- 8. Defending Against Ransomware Ransomware.The very name strikes fear in the heart of organizations. Ransomware methods continue to evolve and multiply increasingly threatening small, medium, and large organizations around the world. The two most notable mass exploitation campaigns by ransomware groups this year targeted a virtualization tool - VMWare ESXi, and file transfer software - GoAnywhere MFT. Both of these campaigns have been wildly successful in terms of the number of victims, but not all that profitable for the ransomware gangs. Organizations and businesses are no longer willing to pay ransoms, and many countries aren’t letting them pay. In many cases companies have wiped & restored rather than paid the ransom, and are willing to deal with the fallout of whatever data was stolen. But that’s not defending against ransomware. To defend against ransomware we need to get further upstream to understand the motivations and the tools, tactics, and procedures our adversaries use. However, defending against ransomware gangs can feel like a chess match where security teams are always playing defense. Threat Intelligence provides the context necessary to turn the tides and put threat actors on their back foot. Real-time intelligence on ransomware threat actors, their tactics and targets, enables you to proactively protect your business from attacks. Using threat intelligence, a public automotive company was alerted about compromised identities being sold on a ransomware site just a few hours after seeing a failed-login. They quickly reset the passwords, safeguarding themselves against a ransomware attack. Vulnerabilities Hunt Lack of Context Noise Dynamic Indicators Misconfigurations Detect Compromised Credentials Monitor Challenges Threat Intelligence Outcome 5 https://www.verizon.com/business/resources/reports/dbir/ of all breaches in 2022 5 25% Ransomware was involved in
- 9. Improve Workflow Automation Timeis perhaps the most important element in the cyber world. Everything’s moving too fast, the number of alerts, the questions from executives, the hours ticking by. Security teams still struggle with manual processes and keeping up with a changing threat landscape that leaves security teams to try and do more with less. Threat Intelligence gives us back time, but getting it right is hard. It’s not about stitching together some feeds or just having an analyst peruse through reports. Threat Intelligence must be scalable, unbiased, and actionable. When done right it helps our automation tools truly automate by creating smarter rules and workflows, it makes our analysts become more efficient by enabling them to perform research within one product and providing actionable context that separates the signal from the noise. Maybe you need to automate simple tasks to free up your analysts for more important projects, or perhaps you need a better way to inform executives of your security posture and threats to be concerned about. Whether your use case is tactical, operational, or strategic, threat intelligence can give you back time. For a global equipment provider, automating threat intelligence into many of their day-to-day activities has helped them cut out manual processes and gives them confidence to know what’s high-risk versus what they shouldn’t be spending their time on. 6 https://www.fortinet.com/content/dam/fortinet/assets/reports/report-2022-skills-gap-survey.pdf Sophisticated Attackers Reduce noise Dynamic Indicators Lack of Context Alert Fatigue Analysis Burnout Cybersecurity Skills Shortage Improve detection and response time Security Stack Complexity Enhance analyst efficiency Challenges Threat Intelligence Outcome of organizations suffered one or more breaches that they could attribute to a lack of cybersecurity skills and/or awareness 6 80% Worldwide
- 10. The Benefits ofThreat Intelligence Protect Expanding Attack Surface Accelerate brand impersonation detection Discover unauthorized logo use, typosquats, fake executive profiles, and fake mobile applications Continuously monitor your changing attack surface Identify internet-facing assets, where they’re being hosted,and if they’re vulnerable, misconfigured or out-of-policy Implement risk-based patch prioritization & tech stack monitoring Use risk scoring to prioritize patching based on likelihood of exploitation and identify vulnerabilities affecting your infrastructure Defend Against Ransomware Understand your threat landscape Gain real-time visibility into ransomware threat actors targeting your industry and organization Monitor changing IOCs Mitigate ransomware attacks with real-time intelligence on IOCs and threat hunting playbooks to stop threats before they happen Identify initial access before it’s too late Unlock visibility into compromised credentials for your employees and partners before they can be used for initial access Mitigate Supply Chain Risk Improve time to identify and proactively respond to threats Identify digital and physical threats early to improve incident response and business continuity Enhance risk assessment speed and quality Gain comprehensive and actionable information to make fast, informed decisions when assessing vendor risk Understand risk exposures across key locations and geographies Determine risk exposure across the globe to prepare for the next big geopolitical or cyber event that could have profound impacts across your supply chain Automate Security Workflows Improve analyst efficiency Minimize manual investigation and research with real-time threat intelligence, embedded into the tools you use on a daily basis Automate manual workflows Automate manual processes to reduce risk of human errors and provide breathing room for analyst to focus on high- impact projects Improve detection and response times Implement high-fidelity risks lists to correlate internal telemetry with current threats to identify activities that are relevant to your organization
- 11. Our results areproven. Recorded Future users have reported: improvement of their understanding digital footprint hours per week saved due to actionable intelligence reduction in manual workflows increase of visibility into their threats 85% 13 20% 62% Recorded Future powers your organization with real-time visibility into your expanding attack surface and threat landscape so you can act with speed and confidence to reduce your risk and securely drive business growth. The Recorded Future Intelligence Cloud elevates your existing security defenses by enhancing the depth and breadth of protection by giving you insights into threats and attacks before they impact your business, so you can stay ahead of attackers, at the speed and scale of today’s threat environment. The Power of Recorded Future Automated & Real-time Comprehensive Independent & Integrated Actionable Trusted Internet-scale collection and analysis in minutes The world’s largest intelligence repository, covering the widest range of use cases Unbiased, only focused on Intelligence 100+ integrations into top security tools to accelerate workflows Actionable for every user, across every maturity journey, through optimized user experiences, channels and outputs Trusted by 1600 clients, governments and 8/10 largest companies in the world Begin Reducing Operational Risk Today About Recorded Future® Recorded Future is the world’s largest intelligence company. Recorded Future’s cloud-based Intelligence Platform provides the most complete coverage across adversaries, infrastructure, and targets. By combining persistent and pervasive automated data collection and analytics with human analysis, Recorded Future provides real-time visibility into the vast digital landscape and empowers clients to take proactive action to disrupt adversaries and keep their people, systems, and infrastructure safe. Headquartered in Boston with offices and employees around the world, Recorded Future works with more than 1,600 businesses and government organizations across more than 70 countries. Learn more at recordedfuture.com and follow us on Twitter at @RecordedFuture