Security Experts:

Connect with us

Hi, what are you looking for?



Patience: The Great CyberCrime Equalizer

If we don’t have a solid notion of what is normal in our environments, it’s highly unlikely that we will notice the new threat once it arrives.

If we don’t have a solid notion of what is normal in our environments, it’s highly unlikely that we will notice the new threat once it arrives.

Richard Bejtlich of Tao Security recently wrote about the astonishingly asymmetric nature of digital security. By asymmetric, he was referring to how much more effort it takes to defend against a threat than to offensively launch one. At its core this thinking is fairly intuitive – it’s far easier for me to break something than to engineer a solution to ensure that same object never gets broken. This is simply entropy at work. However in a real sense, that is one of the core challenges of information security. To drive home his point, Beijtlich estimated that for every one line of offensive or malicious code, security engineers write 100,000 lines of defensive code. 100,000 to one definitely counts as asymmetric in my book.

Cyber Crime However, the LulzSec arrests last week reminded me that patience has the potential to be the great equalizer, at least in some cases. When the news broke that the FBI had caught Sabu, one of the alleged leaders of LulzSec, and used him for months to infiltrate the organization, I couldn’t help but picture Ray Liotta in Goodfellas. And to be clear, I don’t draw that parallel in an effort to equate LulzSec with the mob. Instead what I found striking were the parallels in their eventual undoing. For all of the technological and ideological differences, the law enforcement approach was remarkably the same. Patience, methodical investigation, wait for a strategic person to make a mistake and use that person to roll up as much of the organization as possible.

In many cases, patience is the best cure for an asymmetric problem and I see similar trends in information security. We can no longer rely on the simplistic approach of see an exploit, block an exploit. Of course, we need to be able to detect and block direct threats, but to see and block more advanced threats, we have to continually widen our vision. We must establish context for all of our security events so that we can actually connect the dots between applications, malware, exploits and users. When we see something that is bad, it isn’t enough to simply block it – we need to know all that the threat touches, both inside and outside our networks.

We also need to establish a long-term view of our network, users and assets. If we don’t have a solid notion of what is normal in our environments, it’s highly unlikely that we will notice the new threat once it arrives.

All of these things require vigilance and dedication to the job of security. This is precisely why security teams are becoming more important by the day. No security product will provide a silver bullet on its own. Ultimately, we are in an asymmetric struggle, and our patience and intelligence are the best assets we can depend on.

Written By

Click to comment

Expert Insights

Related Content


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Network Security

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...


The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.