Conventional security is not effective, or enough, said Art Coviello, chairman of RSA, delivering the first keynote of this year's RSA Conference Europe, taking place at the Hilton London Metropole.
This has been a year of headline-grabbing IT security attacks, according to Coviello, like the attacks that took place against the Australian government in March, Sony in April, and RSA itself.
"These attacks are just the tip of the iceberg in an escalating threat environment."
He said companies can recover if they adapt and become more agile. "To change the dynamic of this environment, we have to radically change our thinking about security.
"Too often, companies tend to manage risk by looking inward. To understand what's at risk, we need to anticipate who could attack and how and why."
Coviello explained the three types of hackers. The first group wants publicity, and to embarrass companies. They are known as hacktivists, and could circumvent an organisation's IT security or simply have a person on the inside.
Another group is the financially motivated cyber criminal. The group can buy their malware at online auctions, and try to get in and out of a system as quickly as possible. "For them, it's about speed and volume."
The third is the nation state. They are often the forces behind advanced persistent threats, and stealth is very important to them. They often gain information through social engineering, and sometimes prepare for months in anticipation of an attack.
"They're difficult to detect, because often they compromise one organisation to target another." The difference with nation states is their large resources, and their efficiency. Unlike cyber criminals, they want to stay in a company's system.
"The implication is that all organisations are under a state of persistent, dynamic and intelligent threat. The security dogmas of the past are no longer adequate," Coviello said.
"If you have information that has material value, you must recognise the vulnerabilities that are apparent."
He said new security systems must be agile to deal with evolving threats, and needs advanced continuous monitoring techniques. "Controls that rely on predictive analytics need to be deployed more pervasively," he concluded.
Share
