Time to Batten the Cyber-Hatches | McAfee Blogs

We all like to think we’d know what to do if an emergency should occur. In split seconds, we try to recall the ratio of chest compressions to breaths of air learned in bygone health classes or that summer spent lifeguarding. We recognize the importance of a “to go” bag those final few days of pregnant pauses and false alarms before a baby arrives. We have seen enough television shows and cooking competitions to know Gordon Ramsey or Guy Fieri will be the first to scold us if we try to put out an erupted kitchen grease fire with anything other than salt and smothering.  

We pick up a fair amount of knowledge and traits along the way to employ should disaster strike – and we absolutely take necessary precautions if we are knowingly in harm’s way. For example, those that live within a fault line’s reach are apt to prefer housing with stronger foundations and reinforced windowpanes. If you choose to live close to the warm waters of the Atlantic Ocean’s “hurricane alley,” you most likely know the fastest route to a causeway. An underground storm shelter to escape a tornado’s wily path can certainly come in handy.  

We are taught that “hindsight is 20/20,” and that harboring regret is top on the list of feelings to avoid most throughout life. We obey the mantra many scouts learn in youth – being prepared – to the best of our ability. While earth’s natural disasters may never be preventable, it is clear preparation and readiness to face the inevitable can be a key differentiator when it comes to damage that can be incurred.  

So far in 2021, we have witnessed major infrastructure impairments, interrupted supply chains, and havoc wreaked on local and federal economies.  

This did not happen due to volcanic eruptions, tsunamis, nor mudslides, but rather through security breaches and attacks. And despite headlines shouting and nearly every security vendor urging enterprises the world over that cyberattacks are posed to continue to increase both in frequency and sophistication, especially ransomware threats, organizations have more often than not found themselves on the receiving end of hindsight and regret when it comes to these man-made, modern-day disasters.  

So, the question begs to be asked, if the damages mentioned above could have been lessened or avoided through preparation and readiness, why is it still so difficult for CISOs to convince the c-suite that it’s better to be prepared for cyber-disaster, than sorry? 

Coulda, Woulda, Shoulda 

Staying safe and secure is the main goal in any disaster or emergency, but another less-talked-about goal is obviously to avoid what could have been prevented. The phrase, “I told you so,” will never land softly or kindly, especially when you are left surveying the ravaged ruins of what is left in the aftermath.  

Many CISOs and SOC workers have encountered this situation recently, mentally kicking themselves or expressing frustration analyzing and evaluating breaches or attacks after they have occurred. Of course, the vulnerabilities are crystal clear when security experts look back on what happened, but muddy and missed when they play out in real time.  

Scientists will inform us when a volcanic eruption may be imminent; a tornado will be prefaced with a loud siren meant to be heard throughout the county or immediate area; we often see tropical storms gain momentum and destructive qualities far before they transition to hurricanes and make landfall. This is to say, when it comes to natural disasters, they’re going to happen regardless, but damage prevention is dependent on prediction and experience.  

Carefully measured and monitored gaseous pressure under the earth’s surface will indicate when a volcano may be imminent. Because of this, volcanologists can attempt to forewarn residents to vacate an area before disaster hits. This outcome is expected, and systems and processes are in place to thwart damage as much as possible. I imagine along with scientists; we’d be quite surprised if a volcano suddenly started spewing mass quantities of water instead of magma and ash. 

We rely on patterns from previous incidents when it comes to geological acts of nature, but in the cybersecurity industry, disasters are man-made, and progressively more dangerous – created with motive, intent, and intelligence. 

With cybercriminals, attacks have been unpredictable and indiscriminate. They are infiltrating via multiple attack vectors; sitting unknowingly across networks and systems, leeching data from an organization; and altering entire courses of business as resources are used to bring systems back online, determine causes, and quickly implement solutions. In short, cybercriminals are serving up water when we expect magma nearly every single time and enterprises are struggling to keep up.   

XDR Is a Must for Readiness Kits 

The rulebook of what can be planned for and prevented has narrowed. Enterprises need to adopt an updated mindset, knowing that like a natural disaster, damage prevention from a cyber-disaster is dependent on prediction and experience.  

We are going to continue to get water when we expect magma, flames when we’re on the lookout for floods, and harsh winds when we anticipate rumbles. Powered by human intelligence, cybercriminals will continue to evolve threats, it will just be a matter of who can stay one step ahead – the good guys or the bad guys. The only constant isn’t a matter of if an attack will happen, but when.  

A movement toward proactivity instead of reactivity when addressing a breach or attack after it occurs is crucial against today’s cybercriminals. Organizations must recognize that no industry is immune to cybercriminals and get a better handle on SOC functions and processes, and control over where data travels and lies.  

This can mean a massive overhaul of a security stack to streamline solutions and expose manual or siloed processes that can lead to hidden vulnerabilities, evaluating security staff and talent to create better efficiencies, or embracing AI-guided tactics to automate activities and provide quick, actionable next steps should a breach occur.  

Early adopters of extended detection and response (XDR) technology are already seeing the benefits this proactivity can hold. The simple, unified visualization XDR provides is a strong vantage point for enterprises seeking greater situational awareness, enhanced insights, and faster time to remediate threats across all vectors from endpoint, network, and the cloud.  

Today, the warning siren that disaster is forthcoming has been sounding for a while. Enterprises need to take heed of the alarm to thwart as much damage as possible, as like natural disasters, a cyber-disaster can lead to massive destruction and upheaval.  

Want to learn more about McAfee’s XDR technology? Check out McAfee MVISION XDR.