[BreachExchange] Should we change our thinking around data breaches?

[Destry Winant]

https://www.siliconrepublic.com/enterprise/data-breaches-steve-tout

Cybersecurity expert Steve Tout says that a more proactive approach is
crucial to guard against data breaches.

Data breaches are a growing risk and can have devastating effects on
the organisations that experience them as well as the people whose
information is stolen.

As founder of Forte Advisory and previous CEO of VeriClouds, Steve
Tout has seen trends develop over his 18 years in the security
industry with firms such as PwC and VMware.

Tout is a seasoned expert in identity and access management, and he
told Siliconrepublic.com that the way many security professionals
approach breaches needs to change to truly tackle the issues in a
proactive manner.

What should be done to change the narrative around data breaches?

In 2019 we are already seeing data breach incidents that are largely
preventable. The patterns I am seeing are: overprivileged access, lack
of visibility in multicloud environments, little to no access
governance in place and poor password hygiene. None of these problems
are related to technology – they are leadership and management
challenges.

Historically we’ve seen business leaders look at investment in their
cybersecurity portfolio as a cost centre, as a cost of doing business.
Their rationale has been: ‘We haven’t had a breach yet and if we did
the recovery costs would amount to less than doubling or tripling our
budget on protection.’

The CFO will look at breach avoidance as an operating expense on an
Excel spreadsheet, and there is no compelling return on investment
(ROI) when looking at cyber in this way.

I’ve always talked about there being two ROIs in the investment in
cyber: the risk of ignoring and the ROI. The main point I would make
about changing the narrative around data breaches is that most of them
are totally avoidable. Customers and citizens are beginning to hold
companies and governments to higher standards of ethical behaviour and
due care.

Can you talk about the issue of credential compromise and how this
relates to dealing with breaches?

The game strategy is so simple that my 11-year-old daughter
understands it: use the same compromised credentials that hackers do,
albeit in a secure manner, but as a protection mechanism, not a hacker
scheme. Problem solved.

The reality today is that many leading organisations think they are
protected from these types of attacks by enabling 2FA or by calling on
the popular service Have I Been Pwned (HIBP) in a programmatic way,
and that is just a false sense of security.

2FA is not and cannot be deployed everywhere, and HIBP is not a
security solution. Having the ability to prevent logins using breached
credentials is a transformation for most organisations, and fills a
huge gap left by low adoption rates of 2FA solutions. 2FA and HIBP are
not enough.

How can organisations streamline their cybersecurity responses?

The best way for an organisation to streamline its incident response
is to not have an incident to begin with. That comes from being
proactive with regards to investment in its cybersecurity technology
portfolio, embracing adaptive, intelligence-driven security solutions,
and investing in maturing the disciplines and capabilities of the
programmes themselves.

First off, we looked at how investing in a cybersecurity programme can
have ROI measured in top-line growth. Not only can an organisation
achieve a better security posture overall, delivering safer online
experiences, it can touch the customer in important ways that enhance
the lifetime value of that customer.

Secondly, there are some excellent new technologies available today –
PETs such as identity proofing, identity threat protection and
authentication protocols like FIDO U2F security keys – that enhance
security posture while providing enhanced user experiences across
desktop, mobile devices and things.

Thirdly, technology alone doesn’t cut it. Every security programme has
risks. Not acknowledging them or planning for them puts the programme
at risk of failure (best case) or leaves the business vulnerable to a
data breach, and none of us want that to happen.

What poor habits lead to breaches in terms of both individuals and
organisations?

A major shortcoming in business today is the fixed mindset of security
leaders – ‘This is my security strategy for 2019, so I’m set’ – and a
false sense of security that comes from the idea that ‘I have MFA
enabled, so I’m protected’.

I posit that weak and compromised credentials have never been the
leading cause of data breaches. That just so happens to be how
cybercriminals get into a network, which is right through the front
door.

It’s the fixed mindsets of business and security leaders that leave
organisations vulnerable to cyberattacks and consequently to
devastating data breaches. The fixed mindsets and false confidence are
dangerous, yet I encounter them a lot more than I’d like to.

Do you think a change in outlook is on the way for how we deal with
breaches? If not, what will it take for it to happen?

The silver lining in all that I’ve said so far, which might sound
gloom-and-doom, is that I do see a change in outlook for how we, as an
industry, are beginning to think more proactively about breaches.

There are some companies who are finally going far beyond asking Have
I Been Pwned to assuming a state of breach, that we are all victims
now and U Have Been Pwned already.

In 2018, we saw a renewed interest in zero-trust security, which
acknowledges that controlling access through legacy perimeter-centric
models is no longer effective. A lot of companies are already on board
with this movement. Like any model or framework, zero trust has its
own set of challenges, but it’s promising. I just hope that it doesn’t
come and go like the Macarena dance did.

I’m also encouraged by the amount of interest in privacy by design and
the potential to persuade businesses to proactively invest in better
security controls that differentiate their offerings, if not to simply
do the right thing.

In October 2018 the Oasis group announced support of dozens of
companies and 12 countries (including the UK, China, Canada and Korea)
to define a new international standard for consumer privacy by design.
This is the ISO Project Committee 317 aiming to prevent data breaches
and give consumers more control. With companies such as American
Express, Amazon, Equifax and many others behind this initiative, I am
optimistic about the future of privacy.

Ryerson University and Deloitte have partnered to offer privacy
certification that shows promise of ushering in a new era of privacy
protection for the consumer.

My hope here is that more vendors will join the movement and help
organisations become more proactive and less remedial with less
effort.
b