Security breaches are a fact of life, and the philosophy of cybersecurity today is such that organizations shouldn’t wonder whether they might get hacked, but rather assume they already have been. This blunt realism is necessary in an age where threats are advanced and persistent and every vulnerability is exploited.

But one observer of the security scene asks whether, in focusing on detection of and response to threats, the security community is forgetting about the power of prevention. Most major security breaches are detected long after they occur, when the damage has already been done. But when an attack is prevented, it does no damage and exacts no costs beyond the preventive measures themselves. The savings are invisible but enormous.

Falling Off the Cyber Kill Chain

As Anup Ghosh wrote on Infosec Island, the limitation of detection as a basis for cybersecurity is that it so often happens only long after the fact. FireEye’s “M-Trends 2015: A View from the Front Lines” calculated that the median time of the detection of security breaches is 205 days. Yet, as Verizon’s “2015 Data Breach Investigations Report” found, 60 percent of breaches allowed the attackers to compromise the victim within minutes.

Ghosh characterizes this problem as “falling off the end of the cyber kill chain” — the sequence of events that attackers go through in penetrating a system and attaining their objectives. All too often, threats are detected by third parties. For example, credit card operations often discover retail breaches before the victimized retailers do.

Prevention, or the Attacks That Never Happen

These security breaches can be costly: For a breach of 10 million records, the average cost ranges from around $2 million to $5 million but can soar above $74 million, according to Ghosh. And because the cost from a breach tends to be proportionate to the time before detection, the detection itself needs to be rapid to be effective. In contrast, the cost fallout from a breach that is prevented or blocked at the point of initial intrusion is precisely zero.

Thus, says Ghosh, “We should not lose sight that $1 spent on prevention is worth $1 million in post-breach incident response. And, furthermore, as we evaluate detection and response technologies, we should be looking for real-time detection solutions — think machine time, rather than human time.” This capability, in turn, calls for resources like “good sensors, analysis algorithms and an architecture that work in real time containing, identifying and controlling threats.”

So while firms need to recognize that advanced threats are ongoing and work under the assumption that they have already been hacked, this is no reason to ignore preventive measures that can stop many attacks before they begin.

Take a proactive response to today’s advanced persistent threats! Read the white paper to learn how

More from Data Protection

How secure are green data centers? Consider these 5 trends

4 min read - As organizations increasingly measure environmental impact towards their sustainability goals, many are focusing on their data centers.KPMG found that the majority of the top 100 companies measure and report on their sustainability efforts. Because data centers consume a large amount of energy, Gartner predicts that by 2027, three in four organizations will have implemented a data center sustainability program, which often includes implementing a green data center.“Responsibilities for sustainability are increasingly being passed down from CIOs to infrastructure and operations…

Why maintaining data cleanliness is essential to cybersecurity

3 min read - Data, in all its shapes and forms, is one of the most critical assets a business possesses. Not only does it provide organizations with critical information regarding their systems and processes, but it also fuels growth and enables better decision-making on all levels.However, like any other piece of company equipment, data can degrade over time and become less valuable if organizations aren’t careful. What’s even more dangerous is that neglecting data hygiene can expose organizations to a number of security…

Router reality check: 86% of default passwords have never been changed

4 min read - Misconfigurations remain a popular compromise point — and routers are leading the way.According to recent survey data, 86% of respondents have never changed their router admin password, and 52% have never adjusted any factory settings. This puts attackers in the perfect position to compromise enterprise networks. Why put the time and effort into creating phishing emails and stealing staff data when supposedly secure devices can be accessed using "admin" and "password" as credentials?It's time for a router reality check.Rising router risksRouters…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today