Why integrity matters in 2020

Like any other year, the start of 2020 saw an abundance of cybersecurity predictions and year-in-review articles, most of which offered insights and inspiration for the year on how to “do security better,” usually by combining the old (perimeter and network defenses) and new (zero trust, artificial intelligence and machine learning). The start of a new decade is also a good time to step back and reexamine foundational principles that often don’t get the emphasis they deserve. “Integrity” of the Confidentiality - Integrity – Availability, the security model otherwise known as the CIA triad, is one of those principles.

Integrity focuses on protecting data and systems from modification or deletion by unauthorized parties and ensuring that damage can be repaired or reversed. Over the last 10 years, the industry’s perspective has shifted from keeping out bad actors to assuming they are in the environment. With this shift, government’s approach to security should have also shifted -- to focus on and prioritize integrity.

In the coming decade, agencies must refocus on “integrity” as a critical operating principle. Why? Because the same security incidents that succeeded a decade ago continue to wreak havoc at every cyber maturity level, proving that perimeter-based security and network defenses routinely fail and that  “new” solutions often do not live up to their early promises.

Even private-sector firms that are at the greatest risk -- and also have the most resources to invest in their cyber maturity -- are experiencing incident déjà vu. According to a 2019 Bitglass Report, large financial services firms such as American Express, SunTrust Bank and Lincoln Financial Group have suffered recurring breaches over the past 10 years.

In a recent updating of its VERIS schema to include event chain data, the 2019 Verizon Data Breach Investigation Report highlights the significant role that integrity plays as both an early compromise in the attack chain, as well as the final attribute compromised. Assuming a bad actor has gained network access, it is important to limit the damage -- during the actor’s first steps. Integrity management is about having the confidence in one’s ability to see critical assets, to make decisions that assure system integrity and to enable operations that identify, protect, detect, respond and recover. It is about taking effective actions immediately once the bad actor is in.

Organizations can best assure integrity by implementing the first six of the CIS controls, the bedrock of any good cybersecurity strategy. The practices used to achieve these controls are asset management, vulnerability management, configuration management, log and/or event management and file integrity monitoring. One might assume that given the consistency in both the nature and effectiveness of incidents and breaches reported since 2010, organizations have not been taking the necessary measures and deploying the tools to manage integrity. However, for the most part, that assumption is false. In most cases, organizations have the tools in place to manage integrity -- they are just not managing integrity well. Thus, they keep struggling with the same security challenges.

Year after year, known vulnerabilities with known solutions are exploited, configurations are left in an exposed weakened state and insufficient staffing prevents a thorough analysis of the “noise” on the network to prioritize critical actions.

What does it mean to do integrity management well and what can be done to start radically changing the security outcomes in 2020 and beyond? Organizations must emphasize foundational integrity and effectively deploy integrity management. They can start by considering the following:

• It’s one thing to maintain an active asset inventory, but agencies must centralize security and compliance visibility across the enterprise, from industrial spaces to data centers to cloud environments.
• Although agencies are likely scanning for vulnerabilities, they must also estimate and score the risk of vulnerabilities using three key attributes -- risk class, skill level and vulnerability age -- enabling them to prioritize and focus remediation efforts on the highest risk hosts and the highest scoring vulner­abilities and ultimately achieving the greatest possible risk reduction with available resources.
• Even with established secure configurations for each piece of hardware and version of software, organizations must continuously monitor, assess and compare those configurations to established guidelines. After all, one small configuration change of a critical asset that takes place due to routine drift can dramatically increase a system’s vulnerability.
• Besides monitoring for changes to files and file attributes, agencies should be able to tell the difference between good and bad ones, between business-as-usual changes and ones that mean trouble.
• Ad hoc system integrity checks are fine, but agencies must deploy effective baselining to enable detection of unauthorized or potentially malicious changes.

Organizations whose chief information security officers are following these practices are doing integrity well and are demonstrating maturity in their security strategy. With more organizations operating at a higher level of maturity, we will start to see fewer year-in-reviews reports that characterize security progress as “similar to last year.” Rather, we will read about a reduction of incidents and a strong move toward cybersecurity maturity and reduced risk -- which is why integrity matters in 2020.