5 ways to improve cyber resilience against ransomware, supply chain attacks

Between 2019 and 2020, ransomware attacks rose by 62% worldwide and by 158% in North America alone. We all know what happened with the massive SolarWinds Sunburst hack this past year: Over 18,000 organizations downloaded an infected version of Orion software, though a much smaller number were compromised by follow-on activity on their systems. Additional vulnerabilities, unrelated to Sunburst attack, were found in the Serv-U FTP software. The sophistication and widespread impact of recent attacks have caused agencies and private organizations to scrutinize their cyber resilience across not only their own organizations but also their supply chains.

Now more than ever, data is under constant attack from advanced adversaries and threats evolving at a pace that traditional security approaches fail to protect. We’re gaining a fuller understanding of the long-term impact on our nation’s cyber posture and what needs to be done to prevent and mitigate future attacks of magnitude from happening.

While the federal government is taking steps in the right direction with the Biden administration’s Executive Order on Improving the Nation’s Cybersecurity and the recent ransomware initiatives, such as the cisa.gov/stopransomware hub, there is still much more to be done. The partnership between government and private-sector organizations will be critical to ensure the success of these initiatives for improved cyber resiliency across the nation.

After speaking with chief information security officers (CISOs) from across the public and private sectors, it’s become clear there are some common vital steps we can all take to protect sensitive data.

1. A renewed focus on database security

Perimeter-based security can no longer keep up with today's changing threat landscape as agencies adopt multicloud architectures, employees work remotely and data is further distributed throughout an organization. It’s time to shift the focus to protect our most valuable asset: data.

A data-centric, zero-trust approach will allow agencies to adopt a risk-based model of security with a “never trust, always verify” mindset that secures data wherever it resides. By improving visibility across on-premise and cloud databases, agencies can uncover vulnerabilities, limit user access to sensitive data and get alerts of suspicious activities.

The recent cybersecurity executive order urges agencies to implement a zero-trust architecture to align with the National Institute of Standards and Technology guidelines. It’s not a one-size-fits-all solution, but agencies should implement technology solutions that are purpose-built for data protection and continuous database monitoring to support a zero-trust, database security approach.

2. Assume a breach

Today, it’s not a matter of “if” but “when” agencies will come under attack.

Agencies should start by assuming a breach, then determine the next steps to lessen the impact -- such as implementing air gaps in the network or adding extra layers of authentication. They should also look to automate cyber monitoring and mitigation capabilities with proactive, managed threat detection and response services. Then, for an additional layer of protection, agencies should supplement this with manual testing by skilled security analysts.

3. Collaborate across private/public sector

Public-private partnerships with task forces and programs, such as the Cybersecurity and Infrastructure Security Agency’s Cyber Information Sharing and Collaboration Program are critical to improving the nation’s collective ability to detect, prevent, mitigate, respond to and recover from cybersecurity incidents. The Biden administration’s cybersecurity executive order further helps to improve the nation’s cybersecurity posture as it removes barriers to threat information sharing between the public and private sectors.

No single agency or organization can improve national cybersecurity alone, but by working together, government agencies and their managed security service providers (MSSPs) can enable stronger threat detection and ensure the right cybersecurity technologies are in place and used to their fullest capabilities.

4. Enable continuous monitoring, mitigation and testing

Advanced threats often remain hidden as they spread through networks in the background. In addition, the increasing number of devices connecting to a network -- paired with the ever-changing environments they operate in -- make it harder for agencies to detect and mitigate these threats. This is where it is important for agencies to ensure that access rights are constantly adjusted as employees’ roles and data locations change.

With the fast-evolving nature of today’s threat landscape, periodic vulnerability testing and threat hunting are no longer as effective as they once were. As such, in order to maintain full visibility and security, agencies need continuous monitoring, regular threat hunting and ongoing access rights reviews through managed security services.

Programs like the Continuous Diagnostics and Mitigation can also help agencies provide a dynamic approach to identifying and mitigating cyber risk. The use of these cybersecurity tools, integration services and dashboards listed on the CDM approved products list can help agencies improve their security posture for greater continuous protection from covert threats.

5. Train and retain cybersecurity experts

Currently, there is a global shortage of nearly 4 million cybersecurity employees. With high-profile incidents that require large workforces for response becoming the norm, ensuring adequate cybersecurity expertise is more critical than ever before. As agencies and industry recruit more professionals, they should increase resources and training for cybersecurity programs and partners. The proposed Federal Cybersecurity Workforce Expansion Act would establish an apprenticeship program based out of CISA and the Department of Veterans Affairs targeted toward veterans. Initiatives like this are what’s needed to ensure staff is in place to defend data against advanced adversaries. Going forward, agencies should continue to lean on partners, such as MSSPs to provide additional cyber support and complement their internal cybersecurity teams.

The recent mass cyberattacks have been moments of reckoning, and the continued uptick in attacks emphasizes the need for improved cyber practices across the board. I look forward to moving to a data-centric security approach, leveraging public-private partnerships, working to retain and maintain top cyber talent and looking to federal guidelines and policies to combat the growing threat of ransomware.

This article was changed Sept. 14 to clarify details of the SolarWinds attack.