Cyber Defense vs Cyber Security – Part 1
Cyber security and cyber defense sound a lot alike. Some people even prefer to call the latter cyber security defense. However, they’re not the same. I recently had the chance to respond to a LinkedIn post from Larry Cole about terminology for Cyber Security vs Cyber Defense. The conversation with Larry really hits home regarding what we are all doing with technology and services: defending what we consider valuable. I think we have all been wrong in calling it Cyber Security. It’s time to start saying Cyber Defense and act accordingly.
In this article, we’ll cover the cyber defense definition and how it interacts with cyber security. Let’s consider the impact of the distributed encryption attacks like WannaCry, Petya, NotPetya and all the other variants. They have been using encryption offensively to attack what we consider valuable: the information that we use and technology to create, distribute, and enrich ourselves in both a corporate or personal way.
What Is Cyber Security Defense?
Cyber security defense combines the concepts of cyber security and cyber defense into one whole moving machine. Cyber defense is the strategy used to protect networks or systems and the information they contain. This is usually done with network detection and response, firewalls, key management, and more. The goal of cyber defense is to guard networks, identify potential problems and report incidents inside the networks. Cyber security consists of the solutions that help ward off threats.
What Is the Difference Between Cyber Security and Cyber Defense?
Protecting networks from attackers is an ongoing contest. Every network has vulnerabilities that could be exploited, and cyber security defense has to find and close those security flaws before an attacker can take advantage.
Before we go too much further, let’s clarify some definitions for “Security” and “Defense” so we can use that to drive the rest of this post. For fun, let’s also throw in one more word: “Attack.”
- Security: The state of being free from danger or threat.
- Defense: The action of defending from or resisting attack.
- Attack: An aggressive and violent action against a person or place.
If we apply “Cyber” to either definition, we start seeing how a word changes perspective and objectives. When looking at the meanings of cyber security vs cyber defense, cyber security speaks to solutions that make you free from danger or threat. Cyber defense speaks to solutions that actively resist attack. In other words, we can define the term ‘cyber defense’ as a proactive solution to prevent, guard against, and respond to cyber threats and attacks. Cyber defense and cyber security are both important for keeping an organization’s data safe. No need to pit them against each other; cyber defense and cyber security should be combined to provide overall cyber security defense.
Understanding the Dangers of Cyber Attacks
Everyone knows that cyber attacks aren’t a good thing. The ramifications of stolen data are often immense: identity theft, stolen banking information, privacy breaches, and more. It’s important that cyber security defense addresses vulnerabilities with active resistance.
Before we dive into what active resistance means, let’s look at recent ransomware attacks. Considering how WannaCry, Petya, and NotPetya were deployed, each package had objectives whether financial or otherwise. In terms of the NSA tools released by the Shadow Brokers, they were delivery systems as defined by The Register here.
These tools were developed by the NSA to deliver exploits in SMB1, SMB2, RDP, IMAP payloads that attack systems to destroy, disrupt, or disable targeted systems. WannaCry, Peyta, and NotPetya’s use of encryption as an attack against businesses and individuals are not particularly sophisticated despite being effective. This is made self-evident by the challenges the attackers had in coordinating the release of key material for those who opted to pay the ransom. In the case of NotPetya, it looks like the payment behavior isn’t even a working feature – they need better QA\QC. So what we have is the equivalent of a North Korean warhead on an American Missile.
Even with the less-than-stellar attack payloads, these weapons took advantage of systems without cyber defense solutions in place. They orchestrated an attack that took advantage of how we work – by exploiting flaws in earlier versions of communications protocols like SMB1. This presents a challenge to anti-virus, firewalls, and other technologies that focus on observation and restriction. The cyber security challenge in light of the above creates a scenario where technology’s requirement to deliver “freedom from threat” correlates with “inability to work”. If we can’t work, what’s the point?
Why is Cyber Defense Necessary for Organizations?
Without a cyber defense strategy, networks are left undefended from data breach campaigns. Cyber defense is necessary for businesses and organizations to protect confidential business and consumer data. This data can be dangerous in the wrong hands and cyberattacks can end up costing your business a great sum of money. For example, without cyber defense, hackers could access your customer’s private information. This could lead to a decrease in customers, less trust in your brand, and even potential legal issues. Cyber defense is important for all industries, including government organizations, telecoms & ISPs, healthcare, financial & banking institutions, industrial and smart metering organizations, the automotive industry, and more.
Applying Cyber Defense
But there is hope! The concept of Cyber Defense — Cyber Active Resistance, can be applied with the same construct as the delivery systems used by the recent spike in ransomware attacks. Just like on the battlefield, Cyber Defense is an act in coordination and resistance. The differences are what technology is used and how the technologies are coordinated to respond to a threat. Just as soldiers have the means to coordinate artillery, machine guns, and grenade launchers to respond to an attack, we need the capacity to coordinate the myriad of cyber security technologies such as firewalls, systems management, identity management, and encryption management to address cyber threats as they occur.
At Fornetix, when we talk about VaultCore’s ability to provide key orchestration, we mean coordinated, actively controlled key management. We learned that if you use standard protocols (KMIP, PKCS11,CEF, etc) and deploy them to actively interact with other systems beyond the “Want Key / Have Key” paradigm of encryption key management, you create solutions where you can use encryption key management to actively resist — DEFEND — against an attack by allowing the technology to interact, coordinate, and respond to other systems. Demonstrating that existing security technology can be coordinated like NSA capabilities, Racktop’s Secure Data Protection Platform, VMware vSphere, Seagate’s ClusterStor CL220 and even tactical radios can use orchestrated encryption key management for coordinated active resistance of attackers.
Cyber Defense extends to coordination of patching strategy, leveraging analytics and machine learning, and even how we assert our identity. Each security technology plays its part and becomes an asset to coordinate to respond to Cyber Attacks as they occur. Coordinated, orchestrated defense lets us work with confidence, knowing that the enemy at the gates will be answered.
Ladies and Gentlemen: Cyber Security is dead, long live Cyber Defense.
Click here to continue reading in Part Two of the Cyber Defense blog series.
