There is no doubt that today’s cybersecurity arena is dynamic, fast and under constant evolution — indeed, it is seemingly impossible to keep up with. Every day, some breach or another is announced, the next world-ending vulnerability is discovered or the latest big data analytics solution is released that is going to solve everything. It is certainly exciting, but it also increases the risk of not being able to see the forest for the trees.

One thing I’ve found myself doing and talking about with customers and others in the industry is drawing parallels between cybersecurity and the more mature and well-understood area of physical security. It obviously isn’t completely analogous; for example, someone can’t physically steal from hundreds of individuals from the privacy of their own home or exploit a newly revealed physical weakness in a matter of minutes on a massive scale.

That said, there are undoubtedly some very interesting parallels between the way we approach “real-life” security and equivalent practices in the cyberworld. The following are some typical behaviors that are intrinsic in how we secure ourselves physically:

We Ensure We Protect Our Valuables First and Foremost

In the office and at home, most of us tend to leave internal doors unlocked and/or enable easy access because we trust the people who are there. However, we typically do not leave valuable jewelry on display, the car keys sitting on the windowsill or a stack of cash on the office desk overnight. We know where our valuables are, and we go to some effort to hide them, lock them down, check on them regularly and generally make sure only those who need them can access them. We know that is what criminals are most likely to be after, so we ensure they are as safe as possible.

We Watch Closely and Are More Careful Around People We Don’t Trust

When we are surrounded by people we trust and know well, we tend to be less cautious. We don’t mind leaving our phone and wallet on the table; we talk openly and don’t scrutinize every word in every conversation; we relax and spend less of our efforts on staying secure and apply them to other areas of life. However, when in the presence of strangers or people we have good reason not to trust, we are far more careful. We don’t leave items of value on display, and we are far more aware of conversation so that we don’t reveal anything that can be used against us or important information that would compromise those valuable things.

When We Have Something Valuable, We Are Worried About Recording Access

Most companies and — increasingly — private individuals that recognize a risk to their valuables will deploy systems to track access to their property, such as CCTV, keycards and phone-tracking apps. Most don’t sit and look at this data all day; instead, they record it and then store it so that should an incident occur, it’s possible to look back and see exactly what happened. For example, we can know who entered, when, how, what they took and whether they left anything behind. Most importantly, we can learn how to stop any breach from happening again in the future.

It Is Second Nature

For the vast majority of people, physical security is second nature. We lock front doors, we hide our valuables, we don’t leave doors on the “latch,” we close and lock windows and we are immediately more vigilant around people we don’t know and trust. It is bred into us at an early age.

I think these relate well to the following key approaches to cybersecurity:

Focus Protection and Detection on the Most Valuable Assets

Just like in the physical world, cybercriminals aren’t interested in the equivalent of low-value items in our gardens, halls, etc. They are after our crown jewels, such as customer data, account details and intellectual property. Crown jewel access should obviously be restricted only to those who need it, but access to these artifacts should also be specifically monitored for anything outside of “normal” behavior or what business policies dictate.

There are always activities going on in areas of our networks that we would prefer not to happen, such as click-happy users and dubious application downloads. However, we need to focus our limited resources on what really matters and not put onerous and expensive security processes in place where the risk doesn’t warrant it and where it will not have too much of an impact on day-to-day business processes and life. It should not distract from the really significant security incidents that could affect the business.

Watch for Communications Between Crown Jewels and Untrusted Assets

Use network “trust” zones and complement these with external threat intelligence and internal incident detection to understand whom we trust and whom we don’t trust. Then, we should monitor who is communicating with them. This doesn’t mean we should generate a security incident when they do; instead, we should be more cautious and vigilant. For example, we need to worry a lot more about vulnerabilities on assets if they are talking to untrustworthy actors as opposed to the ones we trust. If assets and users are regularly talking to dubious actors, then those should top our watch list. This should also highlight users who might need additional security training. Very importantly, if any of our crown jewels are communicated with by anything untrusted or unnecessary, we should be concerned and react quickly.

Record Everything

We should be worried about being compromised. Threats are pervasive. The Internet communication vector means they will always have an attack surface, so we must, at a minimum, record everything. We need to ensure our security systems are going to give us the visibility we need when a security incident occurs — and it will occur. We need to record logs, net flows and packet capture data so that when we need it, we have fast and easy access to understand what happened. The last thing we want when an incident occurs is to not be able to tell our stakeholders what happened and how we will prevent it from happening again. It is crucial that we can tell them this quickly and confidently.

Cybersecurity Education

Cybersecurity needs to become second nature to everyone, not just a few people. Everyone should know what is secure, what isn’t and what needs to be. Just like being aware of real-life burglars, everyone needs to think like a cybercriminal. Just like we are inherently cautious of strangers offering services at our front door, we need to be equally wary of emails and social connections. Instilling this culture will take time, but it can be helped through constant reminders and targeted training of those in high-value positions and those who are a bit loose with their URL clicking, Web browsing and third-party application downloads and use.

We could go on and draw more parallels between cybersecurity and other areas that deal with defense. For example, another favorite analogy of mine is our body’s immune system, as described by Ginni Rometty. I find that this approach can really give a different perspective and help us clearly see that forest in one of the most challenging, dynamic and all-consuming business and personal issues today.

More from Intelligence & Analytics

Hive0051’s large scale malicious operations enabled by synchronized multi-channel DNS fluxing

12 min read - For the last year and a half, IBM X-Force has actively monitored the evolution of Hive0051’s malware capabilities. This Russian threat actor has accelerated its development efforts to support expanding operations since the onset of the Ukraine conflict. Recent analysis identified three key changes to capabilities: an improved multi-channel approach to DNS fluxing, obfuscated multi-stage scripts, and the use of fileless PowerShell variants of the Gamma malware. As of October 2023, IBM X-Force has also observed a significant increase in…

Email campaigns leverage updated DBatLoader to deliver RATs, stealers

11 min read - IBM X-Force has identified new capabilities in DBatLoader malware samples delivered in recent email campaigns, signaling a heightened risk of infection from commodity malware families associated with DBatLoader activity. X-Force has observed nearly two dozen email campaigns since late June leveraging the updated DBatLoader loader to deliver payloads such as Remcos, Warzone, Formbook, and AgentTesla. DBatLoader malware has been used since 2020 by cybercriminals to install commodity malware remote access Trojans (RATs) and infostealers, primarily via malicious spam (malspam). DBatLoader…

New Hive0117 phishing campaign imitates conscription summons to deliver DarkWatchman malware

8 min read - IBM X-Force uncovered a new phishing campaign likely conducted by Hive0117 delivering the fileless malware DarkWatchman, directed at individuals associated with major energy, finance, transport, and software security industries based in Russia, Kazakhstan, Latvia, and Estonia. DarkWatchman malware is capable of keylogging, collecting system information, and deploying secondary payloads. Imitating official correspondence from the Russian government in phishing emails aligns with previous Hive0117 campaigns delivering DarkWatchman malware, and shows a possible significant effort to induce a sense of urgency as…

X-Force releases detection & response framework for managed file transfer software

5 min read - How AI can help defenders scale detection guidance for enterprise software tools If we look back at mass exploitation events that shook the security industry like Log4j, Atlassian, and Microsoft Exchange when these solutions were actively being exploited by attackers, the exploits may have been associated with a different CVE, but the detection and response guidance being released by the various security vendors had many similarities (e.g., Log4shell vs. Log4j2 vs. MOVEit vs. Spring4Shell vs. Microsoft Exchange vs. ProxyShell vs.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today