Trending Articles
Trending Topics
Trending
This article is part of our Opinions section, where we invite industry professionals to share their views on the most pressing technology questions of our time.
For all the investment many enterprises are putting into cybersecurity tools, they’re not always safer for it.
The cybersecurity industry isn’t worlds apart from the TSA. If you’ve been to a US airport in the past decade, you’re well aware of many of the measures used: explosive trace detection, X-ray machines, CT scanners, metal detectors, body scanners, random searches of luggage – oh, and dogs. Some of these make us safer but others are a lot more performative.
By the same token, cybersecurity has innovated a lot in the last decade, dousing organisations with new software, tools and protocols to defend infrastructure against malicious actors. And yet, like the TSA at the airport, many cybersecurity tools have been used in ways that make us feel safer, even if they don’t actually make us safer.
For companies to get better at defending infrastructure, they have to understand the difference between security theatre and genuine security.
Consider this paradox today: how can so many high-profile breaches happen when there are so many cybersecurity tools spamming engineers with alerts and notifications?
Auto-detection capabilities are commonly touted today in the marketing for many modern cybersecurity tools. That’s not inherently ‘bad’. If those tools are discovering tons of vulnerabilities or exploits, then they’re technically doing their job. But how organisations implement these tools is just as important.
Evidently, there are some problems with how the tools are being used by some companies, because most practitioners in Security Operations Centers claim to be getting overwhelmed with ‘useless alerts’. From a security vendor’s perspective, they’ve done what they were supposed to do: they’ve alerted companies of the dangers. But when there are thousands of dangers, it’s tricky for an organisation to say they’re actively prioritising the right threats.
What makes all of this even trickier is that the attack surface has widened by almost 80% in the last two years for many organisations. It’s not uncommon anymore for companies to use several security tools to mitigate this, but the number of tools at their disposal doesn’t seem to be reducing the number of breaches happening. It’s almost challenging to find a high-profile vendor that has not been affected by a breach in some way.
Of course, actioning those alerts feels good a lot of the time. Having hundreds – or thousands – alerts to sift through can sometimes instil a sense of progress. It’s easy to feel productive about actioning so many notifications but ask yourself this: if you dug up a ditch in search of a landmine that you know probably exists in your backyard, but you found a mouse trap instead, how productive is that? You can make similar arguments about compliance. You can fulfil endless compliance requirements without necessarily securing infrastructure.
The point here is that too much of cybersecurity today focuses on security-theatre talk instead of measures that genuinely improve security: reducing the blast radius, ditching standing privileges and static credentials, enforcing cryptographic identity, switching to short-lived certificates and privileges, etc.
Measures like these would be infinitely more helpful than assessing a mountain of vulnerability alerts. Do you know which alert to look at first? Not every threat is the same. Software vulnerabilities, for example, are only a small fraction of cyberattacks, while the rest are made up of attacks involving the human element, such as identity-based attacks. Case in point, Microsoft logged over 600 million identity attacks in its 2024 fiscal year, and almost every single one of those was a password attack.
All it takes is for one human being to make a single mistake involving a password, a browser cookie or an API key. They misplace the credential, and suddenly a door has been swung right open. And that’s the key here. The biggest cybersecurity threat doesn’t look like an advanced Rubik’s Cube. It’s the house door someone forgot to lock, the key someone left on the bus, or the password someone scribbled on a sticky note. They’re easily avoidable problems, but a thousand alerts in your monitoring tool won’t necessarily make this distinction for you.
Real security – the kind that doesn’t just feel safer – is about basing employees’ identities on real-world attributes, where identity is the sum of a user’s biometrics, the hardware identity of their machine and a PIN code. That’s the identity problem, but as a disgruntled Disney employee recently demonstrated, the access privileges granted to a user, and for how long, matter just as much. Security teams should dispense with the concept of persistent, long-term access to networks via standing privileges. Short-lived certificates and ephemeral privileges must be the modus operandi. That way, even if an identity is stolen, you know it has access to fewer things and for less time.
By all means, use observability tools, but be mindful of observability for the sake of it. The tools are often great, but if you’re not using the tool in a way that reduces your engineering team’s stress levels, it’s time to rethink things. Ticking away those vulnerability alerts is less important than reducing your attack surface area first.
