Defend Forward: Cybereason and PLDT's CISO on Stopping Attacks Before They Land

Cyber attacks are becoming more frequent once again, and their frequency is only part of the problem. Threats are also growing more sophisticated, which should concern organisations of every size in every part of the world, as should the ease with which criminals are able to get through network perimeters of all kinds.

Cybereason's recent report, RansomOps: Inside Complex Ransomware Operations and the Ransomware Economy, shows how serious the problem has become, with ransomware among the most troubling threats. Ransomware is not the only thing keeping IT teams and CISOs under pressure, though. Angel Redoble, first vice-president and group chief information security officer at PLDT and Smart Communications, counts five threats, any one of which could cripple an organisation:

1. distributed denial-of-service (DDoS) attacks;
2. attacks on the web application layer, which can put the organisation's database at risk;
3. ransomware targeting infrastructure;
4. ransomware targeting users;
5. a successful data breach.

On top of these come elaborate cyber espionage campaigns run by state actors or by politically motivated groups working for hostile interests. And after the Lapsus$ group broke into major technology companies such as Microsoft and NVIDIA with apparent ease, it is fair to conclude that no organisation is safe, now or in the future, unless defenders can reverse the adversarial advantage: the position in which criminals always seem a step ahead, equipped to strike however, whomever and whenever they like.

What Defend Forward means

Drawing level with attackers will take a leap in both technology and approach, and taking the initiative away from them will take a bigger one. Cybereason's Defend Forward sets out to do exactly that: reverse the adversarial advantage and improve defenders' chances against attackers.

Eric Nagel, general manager for APAC at Cybereason, described Defend Forward as a cyber strategy for stopping malicious activity proactively, before it reaches its target. The concept originated with the US Department of Defense, he said, and Cybereason has adopted it. One of the company's first steps this year under the Defend Forward push was to work with leading CISOs across many countries and industries. "If we can connect the dots, then we'll be more effective at stopping what's going on," Nagel said.

The strategy rests on five elements:

• Intelligence: gathering information on the tactics, techniques and procedures used by advanced groups.
• Resiliency: hardening security systems and networks so that reaching their goals becomes harder and costlier for adversaries, discouraging them from trying at all.
• Collaboration: working with law enforcement across industries and bringing the public and private sectors together to support a better-informed defence.
• Capability: capabilities for countering adversaries that are scalable, adaptive, lawful and diverse.
• Analytics: in Nagel's words, enterprise security tools must run at machine speed and be combined with large-scale data analytics so that malicious activity is spotted as early as possible.

Ending the silos: the Cyber Defenders Council

Collaboration sits at the centre of Defend Forward, and it is the purpose of the Cyber Defenders Council. Formed by Cybereason, the council is an independent group of leading global security figures working to strengthen cyber deterrence, with Defend Forward as a main instrument. Its aim is to give private sector companies concrete security guidance.

Redoble said the community needs such a body. For a long time, he said, defenders have worked in isolation while their opponents band together and grow stronger and more capable. In his view the industry has now reached the point of collaborating and working together at tactical and operational level.

A gathering of this kind was overdue and may prove to be what shifts the advantage away from attackers. Indirectly, the success of the council and of the strategy it promotes leads back to an aspect of security that gets too little attention: its people.

People are still the engine

Discussion of cybersecurity tends to centre on sophisticated technologies designed to deter attacks, among them threat intelligence, endpoint detection and response, and managed detection and response. Each of these helps a great deal in a fight that never ends. It would be unwise and unfair, however, to overlook the security professionals who do the unseen work of keeping attackers out.

Nagel stressed that however much technology an organisation has, human capital remains fundamental. Continually bringing new talent into the field is essential for the industry to thrive, he said, while technology can make practitioners more effective and efficient.

Practitioners need that help, because the work is extremely demanding. Contrary to its image in the media, security work is unglamorous. It is laborious and time-consuming, and it calls for firm resolve, a relentless work ethic, deep dedication and a healthy measure of paranoia: when nothing seems to be happening, something is probably being prepared.

Redoble said the job demands a great deal of dedication and sacrifice, going beyond affection for the organisation or the work. Plenty of people want to join what he called a "sexy" industry, but he acknowledged that only a few actually make it. "Cybersecurity is biblical: 'Many are called but few are chosen,'" he said. Once newcomers see what really happens in operations, he explained, they start thinking about their holidays, weekends and free time, and very few are prepared to give those up. The ones who commit are the people needed to win.

Redoble and Nagel count among those few, working alongside other professionals worldwide and their fellow council members. They could use more recruits of the same kind. With improving technology and initiatives such as Defend Forward, they appear to have just enough for now, though attackers are improving quickly enough that a further leap would be welcome.