Information Security Spartans are Fighting in the Shade

With well over 1 million pieces of malware discovered each month, security Spartans are fighting in the shade.  Borrowing a timeless quote from the brave warrior Dienekes, it appropriately conveys how modern information security professionals are committed to an enormous ongoing battle that may not be as pointless and depressing as the sheer numbers suggest.

Today’s modern electronic battlefield is strewn with weak operating systems, buggy software, and users who don’t act in their best interest to maintain security.  An army of attackers are constantly on the prowl for new ways to exploit systems, users, and data.  Every day they uncover a wealth of potentially new weaknesses and in turn develop thousands of ways to tap these opportunities for their crooked benefit.  These arrows of malware come raining down in the millions and can seem overwhelming to the security defenders manning the front lines.

History teaches us a lesson.  In Dienkes time, foot soldiers did not need to fear all arrows in a barrage, only those few which would land near or on them.  Knowing they would stand in harm’s way, they came prepared with well chosen equipment, training, and a good strategy.  In this way the Spartans earned the reputation of a highly efficient and effective fighting force, regardless of the opposition’s size.  Those principles resonate with today's battle against computer malware and the vulnerabilities they exploit.  Information security organizations must apply the same basic thinking to find a balance between applicable controls and the risks of likely attacks, in order to maintain an optimal level of security.

Although millions of malware samples are discovered every year, many represent a low or negligible risk to even a modestly secure environment.  Here are some recommendations to tighten up your battle ranks:

  • Minimize your exposure footprint by keeping up with the best common security practices

  • Place emphasis on security controls which will interdict those threats likely to adversely affect your environment and cause unacceptable loss

  • Apply a defense in depth structure to predict those methods which likely would succeed in your environment and then invest in preventative controls to close those vulnerabilities

  • Depth of the structure must also provide a detection and response capability as eventually some arrows will penetrate the first lines of defense.  Being able to quickly identify problems and restore services is imperative

  • Avoid the inefficient treadmill of trying to protect from every arrow.  It will divert resources and prove to be an unavoidable distraction

Facing endless waves of malware may seem insufferable.  But being armed with well chosen controls, veteran experience, and a good security strategy, will make fighting in the shade a little easier.
Other Related Blogs:
The hard truth of anti-virus
Published on Categories Archive
Matthew Rosenquist

About Matthew Rosenquist

Matthew Rosenquist is a Cybersecurity Strategist for Intel Corp and benefits from 20+ years in the field of security. He specializes in strategy, measuring value, and developing cost effective capabilities and organizations which deliver optimal levels of security. Matthew helped with the formation of the Intel Security Group, an industry leading organization bringing together security across hardware, firmware, software and services. An outspoken advocate of cybersecurity, he strives to advance the industry and his guidance can be heard at conferences, and found in whitepapers, articles, and blogs.