Patience: The Great CyberCrime Equalizer

If we don’t have a solid notion of what is normal in our environments, it’s highly unlikely that we will notice the new threat once it arrives.

Richard Bejtlich of Tao Security recently wrote about the astonishingly asymmetric nature of digital security. By asymmetric, he was referring to how much more effort it takes to defend against a threat than to offensively launch one. At its core this thinking is fairly intuitive – it’s far easier for me to break something than to engineer a solution to ensure that same object never gets broken. This is simply entropy at work. However in a real sense, that is one of the core challenges of information security. To drive home his point, Beijtlich estimated that for every one line of offensive or malicious code, security engineers write 100,000 lines of defensive code. 100,000 to one definitely counts as asymmetric in my book.

However, the LulzSec arrests last week reminded me that patience has the potential to be the great equalizer, at least in some cases. When the news broke that the FBI had caught Sabu, one of the alleged leaders of LulzSec, and used him for months to infiltrate the organization, I couldn’t help but picture Ray Liotta in Goodfellas. And to be clear, I don’t draw that parallel in an effort to equate LulzSec with the mob. Instead what I found striking were the parallels in their eventual undoing. For all of the technological and ideological differences, the law enforcement approach was remarkably the same. Patience, methodical investigation, wait for a strategic person to make a mistake and use that person to roll up as much of the organization as possible.

In many cases, patience is the best cure for an asymmetric problem and I see similar trends in information security. We can no longer rely on the simplistic approach of see an exploit, block an exploit. Of course, we need to be able to detect and block direct threats, but to see and block more advanced threats, we have to continually widen our vision. We must establish context for all of our security events so that we can actually connect the dots between applications, malware, exploits and users. When we see something that is bad, it isn’t enough to simply block it – we need to know all that the threat touches, both inside and outside our networks.

We also need to establish a long-term view of our network, users and assets. If we don’t have a solid notion of what is normal in our environments, it’s highly unlikely that we will notice the new threat once it arrives.

All of these things require vigilance and dedication to the job of security. This is precisely why security teams are becoming more important by the day. No security product will provide a silver bullet on its own. Ultimately, we are in an asymmetric struggle, and our patience and intelligence are the best assets we can depend on.