The future of cybersecurity

The future of cybersecurity

John-Paul Sikking, head of security at Cisco, says the GDP of some nations, including New Zealand, seems paltry compared to the cost of cybercrime. Enterprises – and their leaders all the way to the boardroom – need to be asking tough questions, and make everyone accountable for cybersecurity.

Read more: The new marketing strategy? Spend big on perfecting your mobile and online channels

Figures from the annual bear this out. Ever year, Cisco asks a selection of global organisations from the Fortune 500 to monitor their internet traffic for known malware.

He says 100 per cent of those organisations that were monitored, reported having some level of compromise already, they were testing positive for malware.

“Every one of those large Fortune 500 companies have traffic going to known malware or command and control sites, which is scary.”

Moreover, the report finds the gap is widening from when an attack occurs and when the organisation actually detects the compromise.

Read more: Tait Communications deploys radio network for Alliant Energy in the US

It has always been days to weeks to detect a compromise, but this continues to trend from weeks to months, he states. This is in line with current software patching data, where many applications remain unpatched for months and years. The average patch cycle for organisations is around 55 days, whereas the attackers take an average of six days to release exploit code for a new vulnerability.

He says Cisco sees around 1.5 million intrusions – every single day – into its network and systems.

To combat these attacks, he says the internal security team assigns 50 per cent of its members to focus on the top 5 per cent of threats, the “nasty stuff, advanced malware and persistent threats”.

He says the rest go after the day to day activities like antivirus and patching, and of simply “keeping the lights on”.

Read more: Gartner: Are security analytics key to breach detection - or just hype?

Sikking underscores the need to engage security early on in any project.

“Security is a people, people, people; process and technology issue,” he states.

It is important to add context to your security decisions, he states. “Who and what is on your network? Who is talking to whom? What time of day? What network are they on? What are they talking about? Is it a valid business application?”

Related: CISO to CIO: David Kennedy of Orion Health</b>

Read more: P2P currency exchange startups disrupting the finance sector

“Organisations need to understand how communication flows across their networks, how files are propagated across the network and if they happen to be malicious, who has the potential to be infected.”

Sikking calls this “understanding the trajectory of data through the network”.

“By combining all the contextual information as well as event based data, we can see how an infection has entered the network, basically who was ‘patient zero’ and then pivot on that information to understand who could be infected next,” he states.

Virtual patching of these vulnerabilities is providing a window of opportunity for the organisation to correct the root cause and vulnerabilities that expose the network and systems.

Read more: How to meet the CIO’s availability challenge in four steps

By combining all the contextual information as well as event based data, we can see how an infection has entered the network, basically who was ‘patient zero’ and then pivot on that information to understand who could be infected next.

“Ultimately this is all about blocking the unknowns” he states. “As an industry we have been pretty good at blocking the known stuff, like viruses and worms.”

But how do we go and discover these unknowns threats? “The only way to do that is to move into behavioural analysis.”

Read more: The new CIO categories: Improver, influencer, transformer, inspirer

“We must augment the traditional antivirus and malware tools to understand malicious behaviours, looking at the point in the ‘attack chain’ where malware goes to contact the command and control servers or start to exfiltrate data.

‘Although this is a long way down the attack chain, the malware authors are very adept at bypassing our traditional protection mechanisms like firewalls and antivirus.”


Leveraging platfoms is the only way to be able to maintain any advantage over the attackers, he states.

Read more: Transpower taps UXC Red Rock to support its national grid services

“The first platform is to use the entire network as a sensor,” he states. “Use that to understand what is going on in your network so you can leverage the network as an enforcement point.”

The second platform is globalised information sharing of threat intelligence. “Organisations can’t do this alone anymore,” he states. “They need real-time updates of current threats and be able to dynamically change their posture to mitigate the threat impact.”

Sikking turns to the five principles in the Cisco Security Manifesto as a guide:

First is that security must be considered a growth engine for the business. “It should never be a roadblock or hassle that undermines user productivity and hinders innovation.”

Read more: Career watch: A strategic planning scenario for the CIO role

Second, that security must work with existing architecture and be usable. Organisations should not have to change the way they do business to accommodate new security technologies.

Third is that security must be transparent and informative. Users need to know how they can do what they want to do safely instead of bypassing security as they do their jobs.

Fourth is that security must enable visibility and appropriate action. “We have to have visibility in our network – so they can see traffic and also assets that make up the network.”

Fifth, security must be viewed as a people problem. “Cyber criminals are exploiting people’s trust,” he states. “We need security to be transparent to the user, but when we do need to interject, we need to be informative.”

Read more: CIO Upfront: Why accounting for IT is as important as calling IT to account

For instance, a user who tried to access a phishing attack using a fake Paypal email will be told: “You were blocked going to that site because it has been compromised and is now serving malware.”

He says organisations are doing pretty well on managing the processes and technology side. “We still have a long way to go and we must never forget how people factor into our transformation.”

He points out the latest Cisco Security Capabilities Benchmark Study finds 91 per cent of organisations have an executive with direct responsibility for security.

But he states the security leadership in networked organisations need to ascend higher - to the boardroom.

Read more: CIO to CEO: Stephen Crombie takes top role at Education Payroll Limited

Boards need to start asking tough questions about security controls, including how quickly the enterprise can detect and remediate any compromise.

CIOs need to be prepared to answer these questions from the board including: “What else should we know?”

Cisco, Unisys and Datacom are the sponsors of the 2015 CIO100 events in Wellington and Auckland.
Cisco, Unisys and Datacom are the sponsors of the 2015 CIO100 events in Wellington and Auckland.

Read more: NZ Police opens ICT Agile Development Centre

Follow Divina Paredes on Twitter: @divinap

Follow CIO New Zealand on Twitter:@cio_nz

Sign up for CIO newsletters for regular updates on CIO news, views and events.

Join the CIO New Zealand group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags strategyCISOCSOciscoanalyticsData CenterBoardcustomer focususer experienceCIO100CIOS and the boardJohn-Paul Sikkinguser focuscyberanalytics

More about CiscoCisco SecurityDatacomOrionOrion Health

Show Comments