Ten Reasons for Optimism About Cyber Security, According to Morey Haber

Morey Haber, CTO of BeyondTrust, wrote this piece as the second half of a pair. A month earlier he had set out ten reasons to be pessimistic about cyber security. His summary of that first post was that the world is not ending, but security professionals face real problems that call for practical answers. Some people will keep debating whether the glass is half empty or half full, he wrote; everyone else is busy fixing the problems rather than treating them as insurmountable and complaining.

So he went back through the same ten topics and argued the positive side of each one.

Attackers, tools and the limits of security technology

Threat actors are one step ahead

The optimist, Haber says, would put it the other way round: defenders are only one step behind. That is not always so, but today's attacks are not so advanced that nobody can work them out. Attackers are clever, and so are security professionals. Many defences stop variants from ever appearing and force attackers to become extremely inventive to find their next working exploit. Basic measures such as removing administrator rights, application control and patch management block a whole range of attack vectors. His example: anyone who installed Microsoft's MS17-010 within 90 days of its release was not vulnerable to WannaCry. If the objection is that Windows XP and 2003 had no patch, he points to his point on end of life below, since a product being out of support does not excuse leaving it unprotected. Plenty of basic defences undercut the idea that attackers are always ahead.

Modern solutions are not keeping up with evolving threats

Haber rejects this. If anything, so many new technologies exist to guard against individual attack vectors that it is hard to keep track of them all. His advice is to pick vendors carefully: favour those with a vision and a roadmap that adapt to modern threats and deliver updates as part of maintenance, instead of charging extra for every new layer of protection. He recalls how anti-virus vendors tried to sell spyware and adware protection as add-ons on top of their core service. New features, advanced functions and new tools ought to come inside a platform, so that deployments evolve naturally alongside the threats without a fresh purchase each time.

Security tools are always defensive, never offensive

That is true, Haber agrees, and it is how it should be. If security technology could be used to attack, the consequences of it being compromised and turned on its owner would be severe. Consolidated systems such as centralised logging, vulnerability management and directory services already carry the risk of becoming a single point of failure, holding a great deal of sensitive data and command-and-control capability. A leak of vulnerability data alone can help an attacker establish a persistent foothold. Add offensive capability that an attacker or insider could use without authorisation, justification or automation, or after a breach, and the risk becomes too great in his view. Security products should stay defensive, he argues, with offensive capabilities left to government cyber security professionals who use them in warfare.

People, rules and ageing systems

There are not enough security professionals

Haber does not dispute the shortage, but he sees progress. Universities have started teaching cyber security, and some now offer bachelor's degrees aimed at preparing the next generation for careers in the field. Some programmes compress years of experience and knowledge into four years of study, CISSP certification included, so graduates can start contributing immediately.

Regulatory compliance initiatives are not sufficient

He compares this to the gap between theoretical and applied physics. Compliance frameworks set out the guidelines that organisations should follow, and in many cases must follow, while putting them into practice takes experience and expertise. That is the reason companies bring in security partners, buy professional services or work with system integrators, whose knowledge turns the documents into working reality for a particular business and its processes. In Haber's reading the initiatives are adequate; what is needed is to learn from other professionals how to implement them. The pessimist concludes it can never be done. The optimist asks who can help make it work.

There are no provisions for end of life

Haber places the responsibility on the customer and the business, not the vendor. Many vendors sell extended-life technology or paid support programmes that keep products running beyond their end-of-life dates. These can be very costly, he acknowledges, but understanding a product's life cycle before choosing it is the buyer's job. Many layers of technology and security best practice, from segmentation to preventing and detecting lateral movement, can also protect such devices long after support ends. Rather than blaming vendors, organisations should choose better or insist on extended support for the technology their business depends on.

The Internet of Things is growing fast

Haber treats this as a chance to teach. Many IoT vendors have never built connected products before and are newcomers to the field. They are making technology that is meant to make life easier, and communication is central to it. They need guidance, and they need to be held to account for poor design and implementation so that their next products are better and more secure. He also stresses that there are right and wrong ways to disclose a newly found vulnerability, and he urges researchers to act responsibly and give these vendors time to fix issues while they learn to build better IoT devices. The optimist, he says, takes the high road.

Hygiene, breach fatigue and net neutrality

Basic security hygiene is poor

Most people know which of their organisation's security practices fall short, Haber writes. The pessimist wins this one only if nobody is doing anything about it or if the business is going backwards, which can happen when key staff leave or a market is shrinking. He recommends using the moment to fix the fundamentals, from vulnerability management to removing administrator rights. Getting the basics right, patch management included, provides a foundation from which to face future threats with confidence.

People have become desensitised to breaches

Hearing the same story repeatedly can make anyone numb, and news coverage reports nearly every breach in the same way: "N" people had personal data stolen, or company "X" was hacked and its operations disrupted. Haber's answer is to read beneath the headline and ask why the breach happened. If every report said the attack came through default credentials, people would stop caring and nothing would get fixed. The optimistic approach is to study each incident at a technical level and learn from others' mistakes so they are not repeated in one's own organisation. Ideally each breach in the news differs from the last, so there is something new to learn; if they all share one attack vector, the pessimist wins and nobody pays attention any more.

The end of net neutrality could create security problems

Haber says he trusts in human nature and expects companies to act responsibly to protect the internet and businesses from attack. When organisations behave badly, governments and laws usually step in with penalties to change their conduct. If net neutrality really ends, his optimistic expectation is that providers will not slow down or block critical security updates and information. If the pessimists prove right, laws will forbid it, and government will be forced to intervene, which nobody wants. His call is for everyone to do the right thing and keep security information freely available on the web.

Haber's broader argument is that security work demands embracing change and approaching its challenges with optimism, because a pessimistic mindset will never protect an organisation. Everyone feels at times that they are in a no-win position, he concedes, but after 20 years in IT and security he says that things are clearly improving rather than getting worse or standing still. He still sees value in weighing both sides of each argument, and in understanding how attackers think and why they act as they do, as the way to stop the next breach.