Vanguard Magazine

www.vanguardcanada.com APRIL/MAY 2017 17 cYBersecurItY c We already know that often cyber-threats target "inherent-to- the-design" vulnerabilities, and also deficient maintenance prac- tices and misidentified assets that result in a lower security posture. Like the emperor's new clothes, a false sense of risk mitigation shields exposure and liability leading to unnecessary technological safeguards acquired under the auspices of "hardening the envi- ronment." Eventually these fail and diminish in their returns and new safeguards are sought, further draining the IT budget. A crucial step in moving beyond "technology as a solution" is the development and implementation of an effective, well- implemented, cross-domain cyber-security framework, as well as instituting supportive processes and accurately identifying organi- zational assets and their value to threat actors. If the problem is anchored in exploiting multiple domains, the solution must ad- dress the vulnerabilities of those domains. But before all of this frame-working and planning starts, a shift in mindset should occur: we need to start thinking differently about cyber-threats. think Like the criminals In order to drive this shift in thinking, three concepts should be adopted and should lead the prevention and detection phases of cyber-security: 1 Think and plan like the "bad guys" – Face it, the "bad guys" are winning. In part because that is their full-time job and it is part of their daily practices. With technology out- pacing our efforts to implement countermeasures, and legislation lagging behind, it's time we adopt a new strategy. Foundation- ally, cyber-security approaches must mirror the approaches of the actors behind cyber-threats we're trying to prevent; approaches must be cross-domain and asymmetrical, target and asset-focused, and differentiated by committed, skilled resources. This becomes more important where electronic assets – telemetry, biometrics and trace evidence records – require a higher level of integrity due to the asset's applied value. 2 Targets are as important as assets – No one puts a lock on a door to prevent the theft of the door. Often we forget to view targets along with assets, as well as their value, but as distinctly different entities. Not unlike a property crime, for a criminal there is the thing you want to get and the stuff you have to break to get it; think of targets as the stuff that needs to be broken. By adopting this perspective, one starts to view security safeguards not as single remedies but as part of a layered approach to protect an asset. Sin título-2 1 16/02/2017 14:19:46

• Cover