he threat landscape is constantly evolving, driving dramatic shifts in business environments as well as the nature of attacks that they face. The trend of distributed workforces and working from home, in conjunction with the accelerated move to the cloud, has seen organisations look for better ways to improve productivity and efficiency, and has created a highly interconnected, global and digital supply chain. However, targeted attacks on supply chains have littered the headlines in recent years and are only growing in frequency and sophistication. This creates a ripple effect within business ecosystems, as these attacks have the potential to affect hundreds of businesses without discrimination. This is why supply chain cybersecurity has become crucial for all industries, no sector is an exception, and has seen cybersecurity become a business issue, rather than an IT one.
Covered in this article
New threats, new challenges
The IT security shift to security operations
Adaptive cybersecurity
Collective threat intelligence
Continuously improving
New threats, new challenges
The COVID-19 pandemic which fuelled this shift to home and remote working, destroyed any last vestige of the traditional organisational perimeter, and today, employees, partners, applications, devices, and data can be found anywhere. It’s unsurprising then, that although these interconnected yet dispersed systems have helped businesses survive these unprecedented times, they have also brought with them a slew of new security challenges. Many companies are battling to even map the reach of their networks, never mind securing the wide range of systems and devices that are connecting to them. IT sprawl in a world of ‘bring-your-own-everything’ has created massive gaps in security solutions, and bad actors are sitting up and taking notice. The widely publicised Solar Winds attack that happened nearly two years ago, is a clear testament to this. It impacted victims ranging from top-tier technology vendors and public sector giants, to small and medium-sized businesses (SMBs).
The common maxim today, is that security is a catch-up game, with determined adversaries always one step ahead. However, advancements from top vendors, such as Sophos, aided by artificial intelligence (AI) and machine learning (ML) are helping to successfully combat known adversarial tactics, techniques, and procedures (TTPs) that help to bring down known criminal groups, such as ransomware gangs, as well as new advanced threats previously unseen in the wild. However, the closing of so many gaps and the ability to stop threat actors at every step, is seeing attackers change their tactics to evade the security nets undetected, and the best way to do that is to mimic employee behaviour, by using company tools, local devices, expected traffic patterns and even legitimate credentials.
The IT security shift to security operations
These changes in tactics have seen organisations have to relook at their cybersecurity measures and develop countermeasures that are effective against intelligent and advanced adversaries. Initially, this requires a mindset change from security management to security operations. The days of implementing a solution and letting it run are over. As attackers move to more hands-on techniques, security teams need to do the same in order to identify any anomalous behaviours and root out malefactors as early in the attack chain as possible, to limit any possible damage, such as systems and data being locked down due to the scourge of ransomware.
However, even the most stealthy bad actor will leave a trail, no matter how fragile, and security teams need to find those breadcrumbs, and follow them to halt the attack as soon as it begins. With the proper tools and solutions, these issues can be proactively detected and remediated before a threat actor is able to damage the business. And because organisations are now so interconnected, cybersecurity needs to follow suit, and security teams must move away from unintegrated security point solutions to a truly adaptive security system that automatically prevents as many threats as possible, while still allowing security teams to search for and identify any suspicious behaviours or events that might signal a breach is in progress.
Business environments and attacks have evolved side by side since the early days, so the only real future for business and cybersecurity is a system that facilitates a unique feedback loop so it can continually learn and improve. In this way, any new information and events discovered by the security team can be automated, which enhances prevention and lowers the number of new attacks that manage to gain a foothold onto the network. In a similar way, as automation software gets better and better, security teams can identify anomalous behaviours and events even more rapidly, again, drastically lessening the number of security incidents.
Adaptive cybersecurity
The good news is that this system already exists. Cybersecurity giant Sophos debuted its Adaptive Cybersecurity Ecosystem (ACE) aimed at addressing the new reality that businesses in every industry have to face. It harnesses the power of automation and analysts to enable an evolution from security management to true security operations.
Automation enables anomalous or suspicious behaviours and events to be analysed much more quickly, while concurrently, human analysts can use their skills and expertise to correlate multiple suspicious signals and get to the bottom of what they mean.
Sophos ACE, understanding that cybersecurity is a business problem, was designed with protecting the interconnectedness of our businesses and online worlds in mind. It protects systems and data irrespective of where they reside, and continually learns and betters itself to ensure it can protect any future shifts in technology and attacks patterns.
Collective threat intelligence
Sophos ACE starts with threat intelligence from Sophos X-Ops, which links together SophosLabs, Sophos SecOps and Sophos AI and leverages the predictive, real-time, real-world, and deeply researched threat intelligence from each group, which, in turn, collaborate to deliver stronger, more innovative protection, detection and response capabilities. These real-time intelligence abilities are continually ensuring the next-gen technologies in the company’s world-leading software and hardware offerings are getting better and better. One, single integrated data lake takes information from a wide range of Sophos solutions as well as its threat intelligence sources and uses real-time analysis to arm defenders with the tools they need to stop breaches from happening by proactively finding the suspicious signals among all the noise.
Sophos ACE is a broad system that was designed to enhance prevention, detection, and response. It protects today’s new world of interconnected business systems and defends against the continually evolving cybersecurity threat landscape that now uses not only automation but human hacking too. ACE makes use of automation as well as the top analysts, and the collective input of its vast range of products, partners, customers, and developers to build protection that never stops improving, a virtuous cycle to combat the vicious cycle of cybercrime. Sophos ACE is always learning and advancing and enables businesses of all sizes to scale as they need to, starting from the ground up.
