How to limit the damage from hackers

When thousands of security professionals and exhibitors gather each year in San Francisco for the annual RSA Conference, the mood typically is one of hope and promise. Keynotes, session tracks and vendor pitches traditionally promote the ideal that, while today’s adversaries are worthy, cunning and deep- pocketed, they can be kept at bay with the right combination of people, policies and processes.

But just days before this year’s installment was set to open in February, hackers infiltrated the network of HBGary Federal to expose the sometimes-embarrassing email communications of the security services firm and its sister company, HBGary. The incident certainly placed a damper on the proceedings in the City by the Bay.

“I think people except basic companies to which security is not core to be more vulnerable,” says Josh Corman, a research director at the 451 Group. “But I think that was a smack to the head to say security companies are potentially as prone to attack. It got very real, very quickly.”

The news didn’t get any cheerier after the conference closed, with revelations that at least two other high-profile security firms, RSA and Comodo, sustained precision attacks that, at the very least, demonstrated the ease by which criminals can claim proprietary information that doesn’t belong to them.

Which all begs the question: Is today’s security model fundamentally broken? Some experts believe it is.

But the more pressing question may be: Should organisations housing valuable assets accept the inevitable – that their systems will be successfully penetrated, if they haven’t already – and instead face their fate by focusing efforts around limiting the damage and forcing the attacker to expend more resources than they would like?

It is a difficult question to answer “no” to, especially considering recent developments (including email marketing firm Epsilon’s massive breach), and going back

to last year’s stealthy “Aurora” compromises, in which Google and a number of other Fortune 100s were successfully penetrated by what has come to be known as the advanced persistent threat.