How to Understand Your Attacker’s Mindset

In this post we’ll try to develop an understanding of a typical attacker’s mindset and then show you how companies like yours can use this knowledge to enhance their security posture. Before we dive in, however, let’s ask a basic question: What is a cyber attacker?

A cyber attacker can be any entity — an individual, a group of individuals, a company, etc. — that tries to harm another entity via their cyber infrastructure. Attackers are often portrayed as ruthless entities that go to great lengths and use elaborate resources to attack state-of-the-art company defenses. Defending companies and individuals frequently view these entities as advanced attackers that challenge themselves by trying to break through fortified security controls by attacking them head on. That may be true in a few cases, but most attackers — especially the most seasoned (i.e., the smartest and most successful) — will try to find the path of least resistance and will also try to use the smallest number of resources when attacking. In other words, they use brains rather than brute force to achieve the biggest gain with the least effort. Let’s explore this in more detail below.
Read more “How to Understand Your Attacker’s Mindset”

5 Statistics That Prove Why Your Security Posture Can’t Be Purely Reactive

While reacting to alerts and incidents after they occur will always be a reality of the security professional’s job, a purely reactive security approach is simply not effective given the way that today’s technical infrastructures and the cyber ecosystem itself have become ever more complex. With organizations adopting new technologies — spreading sensitive data across different cloud servers, service providers, containers, and even various SaaS platforms — it’s essential that they begin to take a more proactive approach to security.

This means putting in place repeatable processes and automating as much of your infrastructure as possible, leaving behind time-consuming, inefficient, and costly ad hoc tactics. It also means integrating Security with Development and Operations from the outset, and prioritizing communication between teams to attain positive business outcomes.

Failing to establish a proactive security posture runs you the risk of becoming a statistic, as you’ll see below. Here are five figures that may provide you with just the motivation you need to get started. Read more “5 Statistics That Prove Why Your Security Posture Can’t Be Purely Reactive”

Threat Stack’s 2018 New Year’s Security Resolutions

Insights from
Chris Ford, VP of Product, and Pete Cheslock, Senior Director of Operations and Support

Instead of the “predictions” that are usually offered up at this time of year, we decided to focus on security resolutions. So rather than surveying a variety of issues that might (or might not) affect your security operations in the coming year, we want to talk about resolutions that, if you put them into play and follow through rigorously, will offer a sure way of strengthening your organization’s security habits and posture.

Security should never be thought of as a one-and-done proposition. It’s an ongoing, evolving process, and instead of “getting secure,” smart organizations focus on continuously improving their security postures. As with any other type of improvements you want to make, it can be helpful to take a moment to pause and consider your goals for the coming year. Instead of good intentions that don’t translate into action, make resolutions around the reality of today’s security landscape and the very real challenges that are likely to arise in your organization in 2018.

To help you do this, we sat down with two of our cloud security experts, Chris Ford, VP of Product, and Pete Cheslock, Senior Director of Operations and Support, to ask them what resolutions they recommend companies make regarding security in 2018. Here’s what they had to say. Read more “Threat Stack’s 2018 New Year’s Security Resolutions”