By browsing this site, you are agreeing to our cookie policy. More Information

Office of the Secretary of Defense Calls for Emphasis on Detection and Response

Security | Jul 1, 2015

Anthony Di Bello

This week, in response to the OPM breach, Chris Carpenter, the Security Director at the Office of the Secretary of Defense called for an emphasis on detection and response capabilities.

The reason, Carpenter noted, is that there is a clear window of opportunity within which to find attackers inside the network and cut off their access before they have a chance to exfiltrate data. This is backed up by the fact that the vast majority of breach disclosures note that the attackers had been inside for a period of time prior the data exfiltration.

We can’t prevent all breaches. Now what?

Carpenter explained:

     When we start operating from an assumption that breaches cannot always be prevented, we can put more emphasis on detection and response. This actually can save us time and money. 
 
     When a system is breached it takes time for the attackers to identify or reach the resources they are after on the network. During the time that it takes for them to learn the network and find what they are after, detection would still protect valuable information. 
 
     Even after the attackers identify the information they must exfiltrate it. This is another opportunity for detection. Early detection of compromise minimizes the amount of information lost, cost of repair and reputational damage. With that type of benefit, it should be easy to get the resource for detection systems, even in budget-constrained environments. It's not, though.


The number one thing organizations have to assume is that attackers may already be on their endpoints, undetected, looking for sensitive data to steal. That means that they’ve already bypassed security controls, which are typically at the gateway or are signature-based, and those controls are useless once the invaders are inside and user accounts have been compromised.

But there’s hope

What Carpenter is calling for is detection and response. And that's what we do at the endpoint--what Gartner calls endpoint detection and response (EDR). Every action leaves a breadcrumb that can be seen by EnCase® Endpoint Security with our unparalleled endpoint visibility. It’s a simple fact: there is no way for an attacker to compromise a system without leaving a trace either on the disk, in memory or in the registry.

Having comprehensive endpoint visibility is the only way to ensure you have the capability to root out an attacker, no matter how well they think they’ve hidden their tracks. EnCase Endpoint Security gives you the industry’s deepest and most complete endpoint visibility—even down below the operating system level. I invite you to take a look and share your own ideas in the Comments section below.

    Load more comments
    Thank you for the comment! Your comment must be approved first

    Leave a Comment

  • comment-avatar


  • You May Also Like

    Security

    EnForce Risk Manager: Redefining Data Privacy & Co...

    Have you ever asked yourself if your organization has control over its data?
    Feb 4
    Security

    Finding those Easter Eggs?

    We don't mean to egg you on... well, in fact, we do.
    Nov 3