Why Companies Must Adopt the ‘Assume Mentality’ When It Comes to Breaches

By Christopher Hines, Product Marketing Manager, Bitglass

Recently Target announced that the credit card data breach that they suffered back in 2013 ended up costing them $162M. Now, I know some may argue that to a company like Target, that number is a drop in the bucket, and you’re right. But there is a lesson to be learned from this. Companies must realize that no security infrastructure is 100% fool proof, not the multi-billion dollar corporations, not the mom and pop shops in your local neighborhood, not the start-ups in Silicon Valley. But why?

This is the question that millions of people (maybe even yourself) are trying to wrap their heads around. Yes, your company has a dedicated security team, and has invested in security infrastructure, using technologies like SIEM solutions and products that provide “visibility.” Yet your SSN and employee information still ends up in the hands of cyber criminals!

If there is only one thing that you take away from this blog, understand this. Having security in place doesn’t mean you are somehow bulletproof and exempt from breaches. There’s no hacker guide that says “Leave X company alone. They’ve got cool security.” The increased number of cloud applications like Box, Office 365 and Salesforce, coupled with the rise in BYOD at work has allowed more data to flow outside the corporate firewall. Data is now EVERYWHERE, not just your company’s corporate network. Your IT security team must first realize this, accept it and then solve for it. Not the easiest thing to do.

Hackers Use The Goat Paths

When King Leonidas and the 300 Spartans took on the Persian army at the Hot Gates, they believed that they could hold their ground due to the mountain’s impenetrable walls. What they failed to consider was that an old goat path that Greek shepherds often used to cut through the mountains could also be found and used by the Persian army. The Persians found the goat path and were able to surround the 300 Spartans, and defeat them. Why the random story?

Since companies want to benefit from the cloud’s flexibility and the productivity of BYOD, they have to also build ways of allowing their employees to reach their corporate data (goat paths). This simultanously gives hackers a bigger attack surface to work with. In the past they relied mostly on malware since data was kept inside corporate networks. Now, since data has moved outside, they can also use techniques like Phishing attacks to steal employee credentials, and then use them to access company data. Since employees often have more access to sensitive data than they actually need, companies end up placing their data at risk.

This means that the same goat paths that company employees use to access sensitive company data can now also be used by hackers. All they need is employee credentials.

Security teams must keep these goat paths in mind.

Adopt the “Assume Mentality”

Companies must now assume that a breach is on its way and that’s its only a matter of time until they experience one. Instead of denying its possibility make sure you prepare your IT security teammates, as well as your employees, for the inevitable.

Start building a security infrastructure designed with the goal of limiting the damage of a breach once it occurs instead of getting your hopes up on preventing them altogether.

Breaches are not preventable. But they are discoverable. Learn about Breach Discovery, a new solution that will help you limit the damage of breaches.