Eliminating network blind spots and preventing breaches

Each year a growing number of critical cyber incidents are discovered in government systems and networks. Most often, these incidents are reported only after significant damage has been done and critical, secret or personally identifiable data has been compromised or exfiltrated. In addition, there has been a significant rise in ransomware attacks, as evidenced by this year's highly public examples, WannaCry and NotPetya.

And as the number of attacks increases, so does their sophistication, making it difficult to ensure networks are properly secured while still providing availability to critical data and systems. It’s a challenging balance for government agencies, but protecting networks, systems, and information while continually providing essential services to the public is achievable.

But while this balance can be struck, it’s important to consider the myriad security threats facing government networks and to remember that they contain highly confidential, sensitive or proprietary information. As government organizations increasingly move to the cloud, their networks become more complicated and vulnerable with third-party connections and internet-of-things devices greatly increasing the attack surface. And now that the federal government is using drones for missions such as disaster relief, law enforcement, border security, military training and more, the threat vector and surface become much wider.

Agencies must find a way to monitor the entire environment, from endpoints and across physical network infrastructure to the cloud. This means spotting questionable or suspicious dynamic infrastructure changes, potential leak paths to the internet, unknown devices and shadow IT infrastructure.

After all, how can you secure something if you can’t see it?

That’s where cyber situational awareness is critical. Agencies must have a real-time, holistic view of known and unknown threats to the infrastructure as they emerge and change so they can identifyi threats and vulnerabilities and develop effective responses to an attack.

But today’s increasingly connected world is disrupting the traditional thinking about networks and how to properly secure systems. When we move to non-proprietary communication and network technologies and use more off-the-shelf commercial operating systems, we open them to additional cyber risk. These newly exposed risks can give malicious actors an entrance into the entire infrastructure.

Take the recent NotPetya cyberattack in the Ukraine that essentially paralyzed of the country’s computer systems. Attackers used a software vulnerability as their gateway to infect Ukrainian government computers with ransomware. The lack of endpoint and network visibility and context and the inability to understand attacker activity on the network shows how simple OS vulnerabilities can be have catastrophic consequences that can spread incredibly quickly through government networks.

Implementing cyber situational awareness

A real-time network situational awareness capability is critical to ensure the stability of government and critical infrastructure operations. It combines a deep assessment of the current network security operations to identify potential weak areas or vulnerabilities with a plan to detect and mitigate threats.

With cyber situational awareness, agencies can:

• Discover network segments and endpoints, unknown  rogue devices and shadow IT infrastructure.
• Identify potential leaky paths that attackers can use to explore the network for vulnerabilities and access sensitive data.
• Detect unauthorized communication attempts to external servers for the purposes of installing additional malicious software or attempting command and control of internal systems.
• Find misconfigurations or network segmentation problems that could create risk or become vulnerable to attack.
• Discover newly inserted, possibly rogue wireline or wireless infrastructure devices, firewalls, routers or other network functions (e.g., virtualized) acting as packet forwarders.
• Detect any data exfiltration from the network to malware servers.

Government cybersecurity thought leaders increasingly acknowledge that depending on perimeter defenses and endpoint-centric protections won’t cut it -- it hasn't so far. They assume that malicious actors will breach the perimeter. Instead of putting their heads in the sand hoping endpoint defenses will adequately protect the organization, sophisticated security teams are looking to detect malicious, anomalous behavior on the network infrastructure itself. They understand that real-time detection and proactive remediation will provide better results.

Citizens rely on and trust government agencies to protect the nation's infrastructure and mission-critical information. Once a threat accesses the network, it’s too late, the damage is done. Agencies that are using cyber situational awareness have real-time and accurate visibility needed to properly protect their networks and to keep our infrastructure safe.