Today we are standing into the Dark Ages of Information Security..!!
Also organization that invest massive amount of money in protect themselves are continuous being compromised
Even largest enterprises in the world with the most sophisticated next generation security tools won't able to stop cyber criminals breaking in and making millions of dollars, stealing personal information, sensitive secrets, and damaging reputation...!!
We all security researchers should be the catalyst to change the industry mindset to start thinking doing things differently.
There is big different between knowing the path and working the path. We need to escape from the dark ages of information security. So how do we reprogram our self for a success? What is the path forward? Let me share 3 thoughts with you.
- Don’t believe that advanced threats protection works. Sure they work but they will fail also.
- We need a deep pervasive and true visibility. All this threats have some common characteristics for example stuxnet, equation group, and duqu 1.0, and yet duqu 2.0.all are stealthily, Undetectable, they use sophisticated advanced evasion detection technique. They bypass traditional defense mechanism. Even through some mitigation have been published online, there are some organization steel not aware of them. We need true visibility into our enterprise systems. You can’t say you are doing security today without doing endpoint compromise assessment visibility. Within our digital environment, we need to know exactly which systems are communicating with which, how. These are the core requirement of any modern security program. If you don’t have level of visibility, you only pretending to do security.
- Identity and authentication matter more. In case of our confidential data was disclosed. The most popular method of attackers get into your corporate network is web application attacks. And this case 95% of the time, attackers used stolen credentials and simply worked into you network. Even most knowledgeable man can fall into the most sophisticated social engineering attacks. We should defend what most important to us and defend with all resources we have. These ideas can work. They do work
Libery Deogratius (Penetration Tester)
NCF Tanzania
