Addressing both unknown threats and CVEs can’t be achieved by having a reactive security strategy alone. If you’re looking to prevent known threats only, sure, it might be enough. But acting only reactively can enhance an organization’s exposure to zero-day vulnerabilities, emerging advanced persistent threats (APT) and more sophisticated cyber attack vectors. This is why we need to shift from a reactive to a more proactive approach to security. But is one approach inherently better than the other?
What is reactive security?
Reactive security practices are considered a staple, as basics among cybersecurity strategies. Reactive strategies focus on building up your defenses to common attack methods and cyber risks, and discovering whether malicious attackers have already breached your defenses and are inside of your network.
Common reactive security measures include:
- Firewalls
- Antivirus solutions
- Spam filters
- Disaster recovery plans
- Vulnerability assessment
Reactive cyber security methods are used by organizations to deal with more traditional attacks. They basically consist of waiting on visible signs of intrusion and indicators of compromise (IoC), then taking action. And this makes sense—when it comes to attacks on low-hanging fruit, the time it takes for an attacker to perform damage is greater than the amount of time needed to detect and react to the incident. All of these techniques and methods of reactive security are great for preventing known malware and viruses, and if one slips into your network, they can help you catch the actors.
The biggest issue with reactive security is that organizations often rely only on them and consider themselves properly protected and cyber resilient. In reality, a reactive security approach should only be one part of the bigger defense puzzle.
Best reactive security practices to implement
Reactive security, while with its flaws, is important and shouldn’t be overlooked. Antivirus solutions and endpoint detection and response are crucial in helping your organization recover after an attack and get back to operating as normal.
Let’s see how the most common and effective reactive security procedures can help you protect your organization against known threats and respond in cases of attack:
Vulnerability assessment
Vulnerability assessment, also known as vulnerability analysis, is a systematic process of detecting, evaluating and prioritizing and proposing remediation or mitigation of vulnerabilities on a network or in a system. In plain English, it’s a review of the security weaknesses in an organization’s information system.
Vulnerability assessment can be observed as a four-step process, with the first step being security testing, or vulnerability identification. Here, a list of all vulnerabilities in a tested application, server or system is discovered. Vulnerability analysis is the next step, in which root causes of discovered vulnerabilities are noted. Next we have a risk assessment that prioritizes security vulnerabilities based on the sensitivity of data and systems that are affected, potential for an attack and the damage that the potential attack can bring. The final step is remediation, where proper steps and mitigation strategies are presented in order to close those security gaps.
Vulnerability assessment, due to its multiple steps and wide scope, can be looked upon as both a reactive and proactive security approach, but because it concerns already existing vulnerabilities, it does fall more into the reactive bracket.
Disaster recovery plan
A disaster recovery plan is exactly how it sounds—the steps an organization should take after fallout from a cyber attack. It includes all policies, tools and procedures that help organizations recover after an attack, data breach or even a natural disaster such as flooding. A proper disaster recovery plan should include identification of critical and sensitive digital assets, a list of all organization’s resources, notes on the cyber crime insurance or general insurance coverage, emergency response actions, authorized and key personnel to assist, a proposal for dealing with media and legal issues, and the like.
Even in the worst-case scenario of suffering a major data breach or a security incident, having a disaster recovery plan will ensure that the damage is minimized, avoiding any panic that can affect normal operations as everyone will be familiar with the right steps to take, and ultimately, act quickly and efficiently.
Endpoint detection and response (EDR)
Endpoint detection and response, or EDR, solutions help organizations detect threats across their entire IT environment and investigate their lifecycle. This aids in understanding how a threat evades the existing defenses, how it behaves once it’s in the network and provides insights into how to triage and stop the threat. Because they work on endpoints (all devices in an organization’s network) they can contain it at the point of intrusion and prevent it from both spreading across the systems and inducing further damage on critical parts of the system.
Key capabilities of EDR solutions include security incident investigation, alert triage, suspicious activity detection, and stopping of detected malicious activity. All of these capabilities are important in any security program across all organizations, but as it only focuses on endpoints, EDR should be considered only one component of it, and not as a standalone defense. We have an article that’s fully dedicated to Endpoint Detection and Response so head over there to find more in-depth information about its benefits and how to use its full capabilities.
Incident response
Any security incident that is not properly handled and contained can escalate to a much bigger problem that leads to a major data breach—and with it, financial losses and operational collapses. Incident response (IR) is an approach that involves policies and procedures to address and manage cyber attacks and their aftermath.
When working on an incident response plan, six stages are usually addressed. The first stage is preparation, as with any good plan, and it consists of documenting reasonable use of sensitive data and security policy violations, and defining what constitutes a security incident. The next step is the identification and detection of malicious activity and security incidents, followed by containments to prevent the threat from spreading.
After containing the threat, the incident removal process begins where the attack vector is identified, the scope of the attack is evaluated and any leftovers from the threat are removed from the system. Recovery and lessons learned are the two final stages, concerned with bringing operations back to normal and highlighting all mistakes and lessons that were learned in the process so future incident response efforts can be improved.
Responding to security incidents quickly, efficiently and in an organized manner will help organizations minimize damages, mitigate threats; restore operations, services and processes; and even go so far as to reduce risks that future incidents can bring. While incident response is about having a plan set before an incident happens, it often falls into reactive security approaches. There have been changes in the approach to IR to make it more proactive, but as it is usually used in organizations, its activities do fall into “reacting to an attack after it happens”.
What is proactive security?
Proactive security involves methods that are used to prevent cyber attacks. While being reactive is more concerned with detecting threats after they’ve already turned into attacks and made their way into your network, proactive security attempts to locate and correct your organization’s vulnerabilities before they’re exploited by cybercriminals.
Popular proactive cyber security methods include:
- Ethical hacking
- Pentesting
- Data loss prevention (DLP)
- Attack surface management
- Organizational cybersecurity awareness
Taking a proactive security approach can help organizations prevent major data breaches and security incidents before they happen. These measures are taken in order to anticipate potential situations and prevent data theft, data breaches and cyber extortion as well as the financial, reputational and operational losses that can follow an attack. In contrast to reactive security, proactive security methods are more concerned with indicators of attack (IoA) and actually take charge over all processes, technology, systems and people, with the approach of preparing for an attack, not waiting for it to happen.
Best proactive security practices
Many organizations already have most of the reactive safeguards in place but a common mistake they make is relying solely on those safeguards. This is why implementing a proactive security approach and tried-and-true best practices will help you find security threats and weaknesses before they are exploited. Doing so can prevent incidents from happening in the first place, saving the time and stress of waiting for one to happen in order to react.
Data loss prevention (DLP)
Data loss prevention, or DLP, is a set of procedures, processes and tools used to prevent data loss by ensuring that an organization’s data isn’t accessed by unauthorized users. The term is usually used to describe tools and programs that classify sensitive data and control user access and data transfer. This is done to protect sensitive data from unauthorized users and to prevent authorized users from misusing it.
The way most DLP tools work is by monitoring entry points on an organization’s network and controlling data transfer between internal users and external third parties. They secure data at rest, in motion and in use, monitoring for any suspicious activity. They don’t specifically detect inherently malicious activity, but will flag activity such as staff transferring organization’s data to an external device, or forwarding an internal email to someone outside of an organization.
Having a DLP solution in place is an important step toward knowing what data needs to be protected, proactively monitoring it for suspicious activity and access and preventing anyone from tampering with or compromising your most critical data.
Penetration testing
Penetration testing, often referred to as pentesting, is the practice of ethical hackers testing a system, network or application in order to find security vulnerabilities that malicious attackers can exploit. One of the core offensive security methods, pentesting is basically wearing an attacker’s shoes and viewing a target like an attacker would.
By using various red team tools, pentesters evaluate the security of an organization’s infrastructure in a controlled environment to identify, attack and exploit security vulnerabilities. The process begins by gathering information about the target, identifying all possible entry points and attack vectors, attempting to attack and break into the system (or network or application) and report the findings back to the organization.
Penetration testing is also used to test an organization’s security policies, adherence to compliance regulations, and even the employees’ cybersecurity awareness. Once the report and findings are finished, organizations can use this information to prioritize investments and developers can better understand how to build more secure apps, as they can now see how attackers are able to break into them.
Nurturing cybersecurity culture
Organizations invest heavily in cybersecurity tools and technology, but don’t sufficiently address the human side of it. Human error, after all, is the leading cause of 95% of security breaches. When it comes to cybersecurity, culture in the workspace plays an important role in keeping a resilient security posture. This is how we arrive at creating and nurturing cybersecurity culture.
Some of the more common ways to do this include raising awareness about possible cyber risks, threats and their implications; enforcing safe cybersecurity procedures that can easily integrate with day-to-day routines; and showing how behaviors can help or hinder the entire organization. There are some obvious steps in nurturing security culture in your organization, such as educating employees to not click on suspicious links, to not share their passwords and to have different passwords for different accounts. But that’s only the start. Head to our post on Cyber Security Culture: Why It Matters for Your Business and learn more about how to put effective training in place.
Attack surface management
An organization’s attack surface will include all known and unknown digital assets: domains, subdomains, open ports, SSL certificates, open databases, servers, all endpoints, VPSs, shadow IT, forgotten environments and misconfigured services as well as third-party vendors. So, it’s a lot.
Attack surface management is a crucial proactive cybersecurity methodology that includes continuous identification, inventory, classification, monitoring and prioritization of all digital assets an organization owns that make up its attack surface. It allows organizations to identify all of their attack surface components, attack vectors and cyber exposures, and uses that knowledge to proactively protect against future attacks.
ASRv2 is there to support you throughout every step of the attack surface management, and will provide you with asset discovery, inventory management, risk detection and even proactive alerts to any changes in your attack surface.
Don’t miss this chance to explore your attack surface:
Conclusion: Reactive vs. proactive security – which one does your organization need?
Now that we have an understanding of what is reactive and proactive security and best practices for both, the question is: which approach is better and which should your organization choose?
Ultimately, the answer is both.
While it’s important to understand the differences of reactive vs. proactive security, and which one helps in different areas of building cyber resilience, neither is inherently better than the other. Both are needed for a holistic approach.
Because it’s important to think about any security breach or incident as something that will happen, rather than wonder “if” it will happen, taking the approach of both proactively mitigating risks as well as responding properly to those incidents is the only way to ensure that you have the best safeguards possible in place.
Source of Article
