Cyber Defense eMagazine December 2019

107
It’s Time for A Tough Conversation About Trust
By Gary Golomb, co-founder and chief scientist, Awake Security
The lay reader may think computer and network security is mostly about controlling for malware, rogue
code, exploits, ransomware, nation state attacks, and the like. In reality, computer and network security
are mostly about controlling for trust – whether between software processes, or people in business
processes.
Because adversaries are successful when you trust them, they often masquerade as – and even use –
the services you trust most. This means you can no longer blindly trust many of the things you used to.
For example, employees using personal devices for email, or storing sensitive data on cloud applications
like Google Docs that everyone has access to, may have once seemed like convenient ways to get things
done. But these negligent actions are serious threats that can negatively impact business. These types
of workers may not mean to put organizations at risk, but their lack of awareness or poor security
judgement can still cause major harm.
Negligence aside, the reality is collusive and malicious threats are almost always waiting to strike within
the enterprise. Attackers have evolved to primarily use existing tools and processes, in addition to stolen
credentials, to compromise networks. In most cases, the majority of the usage appears business justified,
allowing an attacker to “hide in plain sight” and “live off the land” without detection. These evolutions have
been very difficult for traditional security technologies to identify and remediate.
The platforms these types of attackers use to deliver exploits, control their victims, and exfiltrate sensitive
data are the very same platforms you probably use every day for business purposes: Gmail, Google