Modern field guide to security and privacy

What is the right way to prevent breaches?

It's imperative that a prevention mindset and related technological innovation take hold and become mainstream as we advance toward our increasingly connected future.

Organizations need a prevention-based approach to cybersecurity. Doubling down on detection and response will only continue to lead to costly breaches and harm to companies and consumers. Indeed, organizations need to strike a balance between prevention and detection/response capabilities.

The first step is to define the word “prevention.” True prevention means no damage has been done and there is no need for remediation because the attack has been prevented. Detecting that an endpoint has been compromised and then attempting to do something about it (quarantine, network isolation, etc.) is not prevention. This is detection and response. Detection and response is a key capability in your toolbox as a last resort, but if your capabilities are all based on this detection/response approach, you are at a clear disadvantage.

Ultimately, the adversary is interested in compromising an endpoint. The network is often a vector of attack and thus strong network security has the potential to thwart the attack. However, if the attack is not stopped on the network, or does not arrive via the network, the endpoint is the last line of defense when it comes to preventing targeted, advanced threats. 

Thus we need a new approach to prevent compromise of our endpoints, the laptops, desktops, tablets, servers, and other connected devices that make our enterprises run. The anti-virus and anti-malware products we have all relied on for decades are clearly not up to the task.

To help shed light on this new approach, we teamed up with the research group Forrester to ask organizations what they are doing to address this challenge. In particular, we asked what types of prevention-based endpoint protection technologies they have adopted and what features and capabilities are most important to them. Then we delved further into what’s working and what’s not working in regard to each of those approaches.

In this revealing paper, Forrester highlights the results of the study and provides a set of recommendations to organizations seeking to define a new strategy geared toward prevention of zero-day exploits and unknown malware. The full report can be found here.

The bottom line? A comprehensive prevention strategy involves three key elements:

  1. A natively-integrated platform that includes next-generation network security, advanced endpoint protection, and shared threat intelligence.
  2. The ability to prevent zero-day exploits and unknown malware on the endpoint, without waiting for a signature or other type of update.
  3. Balance, in the sense that security should not require a disproportionate sacrifice of operational efficiency or end-user performance.

With the expansion of Internet-connected devices, it is clear that security professionals across all industries will need to focus more on prevention in the coming years. When cyber attacks cross into the physical world, such as in the case of internet connected cars, after-the-fact measures are no longer an option. It is imperative that the prevention mindset, as well as related technological innovation, take hold and become mainstream as we advance toward our increasingly connected future.

Sebastian Goodwin is director of product marketing at Palo Alto Networks. Follow him on Twitter @SebGoodSF.

You've read  of  free articles. Subscribe to continue.

Dear Reader,

About a year ago, I happened upon this statement about the Monitor in the Harvard Business Review – under the charming heading of “do things that don’t interest you”:

“Many things that end up” being meaningful, writes social scientist Joseph Grenny, “have come from conference workshops, articles, or online videos that began as a chore and ended with an insight. My work in Kenya, for example, was heavily influenced by a Christian Science Monitor article I had forced myself to read 10 years earlier. Sometimes, we call things ‘boring’ simply because they lie outside the box we are currently in.”

If you were to come up with a punchline to a joke about the Monitor, that would probably be it. We’re seen as being global, fair, insightful, and perhaps a bit too earnest. We’re the bran muffin of journalism.

But you know what? We change lives. And I’m going to argue that we change lives precisely because we force open that too-small box that most human beings think they live in.

The Monitor is a peculiar little publication that’s hard for the world to figure out. We’re run by a church, but we’re not only for church members and we’re not about converting people. We’re known as being fair even as the world becomes as polarized as at any time since the newspaper’s founding in 1908.

We have a mission beyond circulation, we want to bridge divides. We’re about kicking down the door of thought everywhere and saying, “You are bigger and more capable than you realize. And we can prove it.”

If you’re looking for bran muffin journalism, you can subscribe to the Monitor for $15. You’ll get the Monitor Weekly magazine, the Monitor Daily email, and unlimited access to CSMonitor.com.