Beyond compliance: Protecting data with automated security playbooks
Connecting state and local government leaders
Security playbooks powered by intelligent automation can mitigate the fallout from breaches while meeting important compliance standards.
Why is it that the number of textbook-compliant agencies suffering from massive data and information breaches seems to grow on a weekly basis? Agencies that have spent millions of dollars and thousands of staff hours to implement compliant security programs are still failing to protect the information in their systems.
For too long, the resources required to dot the i’s and cross the t’s to ensure passing compliance scores have had to compete with security operations and monitoring efforts. In many cases, agencies can conduct either compliance or security operations, but few possess the resources to complete the requirements of both. The result? Compliance does not equal security when faced with a determined attacker.
Automated playbooks bridge the gap
It’s time to change the compliance equation in the security environment. Initiatives such as the Continuous Diagnostics and Mitigation (CDM) program are changing how the government monitors its networks and applications. But monitoring alone can only tell an analyst what is happening – it doesn’t give agencies the ability to remediate incidents as soon as they are detected.
Security playbooks powered by intelligent automation can effectively apply continuous remediation while seamlessly maintaining important compliance standards. Like an NFL playbook, the security playbook contains tested routines that can be quickly repeated with minimal customization or manual intervention. They can be designed to meet both security and compliance requirements using automated workflows so that resource-constrained organizations can stretch their budgets for maximum efficiency and effectiveness.
Well-planned automation strategies that incorporate security playbooks help agencies fight security threats when skilled workers are in short supply and manual processes form the backbone of security protocols. Such tools level the playing field by allowing organizations to respond to threats in the same way they are frequently attacked – using automated processes. Many attackers use preset digital tools to make their attacks both unpredictable and relentless. Agencies should fight fire with fire by using playbooks as part of an automated threat response framework.
With cyberattacks, the faster the response, the better the outcome. A security program reliant upon personnel for analytics and decision making can counter attacks effectively using coordinated and comprehensive defensive strategies with tools like security playbooks that incorporate automated and semi-automated courses of action.
Implementing a successful playbook
To determine what can and should be automated, agencies should begin with an analysis of data security requirements and existing information security and privacy workflows, looking for opportunities to shift repetitive and simple data management tasks away from people and into software. But agencies need more than automation alone – they also need a way to orchestrate responses to specific attack types. Playbooks can help with that too.
Every attack has the potential to be unique, so responses must be tailored to fit the circumstances. The security playbook outlines the “plays” that can be orchestrated on the fly or combined for specific threat-response scenarios. By merging all the probable combinations of workflows, tools and processes, such a playbook ensures that responses can change and adapt in real time to mirror and ultimately thwart attacks.
By outlining the responses to diverse security scenarios, the playbook goes well beyond workflows to allow analysts to engage the security apparatus directly with executable control. For example, if an agency has a user with malware on a machine connected to a VPN, it can implement a play to receive automated alerts and options that allow it to isolate and remediate the malware issue at machine speed. One federal agency found that automating the infected VPN process reduced response times from 48 minutes to less than one minute, which resulted in less risk to the agency’s data and a significant boost to the bottom line.
Using a security playbook coupled with smart automation doesn’t just drive better responses to breaches and threats, it also helps agencies stay compliant. After all, what is compliance but a series of regularly occurring, repeatable steps? Like any other workflow, compliance measures can be baked into any security playbook, providing the data and network security necessary to an agency’s overall cyber health. Switching the security mindset from a compliance focus to a threat-response focus can lead to better outcomes for both.