Each year, the RSA Conference brings together top information security experts to discuss critical cybersecurity issues. I hope you got the chance to attend! I found it both fun and enlightening, and I wanted to share my top four takeaways with you.
1. Cybersecurity remains a critical concern for organizations worldwide.
This year’s RSA Conference filled the North, South, and West buildings of the Moscone Center in San Francisco from April 16–20 with more than 42,000 attendees and over 700 speakers. In all, there were 17 keynote presentations across 550+ sessions, as well as a record number of exhibitors — more than 600 — on the expo floor. It’s clear that organizations around the world continue to be keenly focused on cybersecurity issues.
Highlights from the SecureAuth booth were sessions on identity security automation and how 2FA without intelligence is not enough, as well as the popular You’re being hacked right now! We can show you how session on penetration testing. We also had fun giveaways of an electric bike, wireless Bluetooth headphones, and hosted a packed-out cocktails-and-jazz event with our awesome partners Kudelski and LogRhythm.
2. However, the cybersecurity industry is in chaos.
Throughout the conference, one question kept rising to the fore: Why isn’t the current approach to cybersecurity working? As various sessions pointed out, cybersecurity investment is increasing year over year; for instance, Gartner predicts organizations worldwide will spend a staggering $96 billion on enterprise security in 2018, up 8% from 2017. Nevertheless, the number of breaches continues to grow at an alarming clip, and the time required to detect a breach is still far too high — 99 days, according to M-Trends 2017.
This state of chaos for the industry was highlighted in dramatic fashion on the last day of the conference, when it was reported that a mobile application built by a third party for the conference had important security issues — including hard-coded security keys and passwords that allowed a security engineer examining the app to extract the conference attendee list. The developer fixed the underlying issue within hours of the report, but attackers might well have already discovered the vulnerability themselves and used it to swipe sensitive data.
You know there’s a real-world issue when you go to a security conference and its mobile app leaks attendee data.
3. Time and time again, credentials are the root cause of breaches.
This security flaw illustrates a core truth: Credentials are often at the root of breaches. In fact, the 2018 Verizon DBIR reported that the use of stolen credentials is the #1 tactic used in breaches — just as it was in the 2017 DBIR, the 2016 DBIR, the 2015 DBIR, and the 2014 DBIR.
Didn’t someone once say that the definition of insanity is trying the same thing over and over again but expecting different results?
4. A new approach is sorely needed — and it’s already here.
To prevent the use of stolen credentials and reduce the number of breaches, we need a new strategy. Specifically, we need to replace siloed solutions with a modern, comprehensive approach in which solutions work together to protect the entire IT infrastructure.
In one of our sessions at the conference, SA+CS explained such an approach: identity security automation (ISA). ISA represents a profound inflection point in the war against cyber-criminals, state-sponsored attackers, and malicious insiders because identity is no longer separate from network and endpoint security; rather, each enriches the other to better protect people, organizations, and governments.
This intelligent intersection of identity and security is real today. Our ISA solution has two key components: identification and remediation. First, it empowers you to tear down your silos and share security information with them to quickly identify threats, including the misuse of valid credentials. Then it automates remediation actions, slashing attacker dwell time from 99 days to just milliseconds and enabling you to actually prevent breaches. That’s a quantum leap for cybersecurity.
If you’re seeking the strongest, most seamless approach to breach detection, response and prevention the world has ever known, I invite you to learn more about Identity Security Automation (ISA) and read the solution brief.
