Thinking like a hacker is key to strengthening resilience

If you've worked in cybersecurity for as long as I have, then you'll know there are a couple of things you can count on. First, the threats that are out there never stop evolving. And second, sooner or later, you're going to be in the bullseye.

What makes life so much harder today is that AI and other automated tools have dramatically narrowed the gap between vulnerability discovery and the time it takes to exploit them.

And when this can now be measured in minutes – seconds, even – you know you have a problem. This fundamental change in the way adversaries operate means we no longer have the luxury of time to understand an attack, assess the risk and decide what to do next.

Which means we have to be better prepared and have resiliency for whatever is thrown at us.

Visibility is key

For me, that starts with accepting a simple reality: you cannot defend what you cannot see. And it’s why visibility is one of the most important capabilities an organization can develop.

After all, if you understand what exists within your environment – how those systems interact and what normal looks like – then you're in a much stronger position to identify unusual behavior before it develops into something more serious.

Observability, on the other hand, takes that visibility to the next level. It provides the context security teams need to make informed decisions quickly, especially when time is working against them.

In other words, visibility tells you what is happening, while observability helps you understand why it's happening.

And that’s crucial. Today's organizations operate across on-premises infrastructure, cloud environments, networks, and an increasing number of connected technologies.

As those environments become more distributed, understanding what's happening across them becomes significantly harder.

Without that visibility, it's difficult to understand where your risks are, how systems interact, or where an attacker may be able to exploit a weakness.

Think like a hacker

Which leads me neatly onto my next point. Throughout my career, including my time working in offensive cyber operations in the intelligence community, I've found that the most effective way to understand risk is to think like the adversary.

I start by asking how someone would attack an organization and then work backwards to identify and close gaps.

That’s because attackers don't see organizations in the way that you or I might do. They’re always on the hunt for a toehold in. They look for weaknesses in people, processes and technologies.

They look for the easiest route first to achieve their objective. And then they exploit that weakness.

And it’s an approach I would urge all security leaders to adopt if they want to stay one step ahead.

That means continuously asking where an attacker would start, how they would move through the organization and what controls would slow them down or stop them altogether.

But for this to work, it also requires organizations to design resilience into the way they operate. And that’s something we’ve embedded across our organization.

For instance, we have internal and external teams that conduct continuous product, enterprise, spear-phishing and physical penetration testing.

For us, it's about educating the team across the business to ensure they remain vigilant. But it’s also about inoculating people so that when they see something suspicious online, they have that instinct that something might be wrong and they report it.

We also want to make it easy for people to report events so we can analyze them quickly and better understand the targeting.

Secure by design

We’ve also invested heavily in Secure by Design to ensure that all the products we deliver to customers are as secure as humanly possible. In practice, it means being able to trace every piece of code back to its source and verify its integrity throughout the development process.

It's similar to maintaining a chain of custody for evidence. We want to know exactly where software components come from, how they're verified and how they're protected throughout the entire build process.

More broadly, Secure by Design is increasingly being adopted across our industry as organizations recognize the importance of software integrity, traceability and transparency throughout the development lifecycle.

This is important because, as I said at the beginning, there are two certainties in cybersecurity: threats will continue to evolve, and organizations will continue to be targeted. Businesses across the world must adapt quickly to the grim reality that a cybersecurity incident isn’t a matter of if, but a matter of when. And AI is supercharging the pace at which all this is happening and broadening the blast radius of any attack.

That’s why you need to understand your environment well enough to reduce unnecessary risk, detect malicious activity quickly and limit the blast radius when something does happen. Pair that with a clearly defined and tested plan for recovery and that's what robust cyber resilience looks like in practice.

We've featured the best endpoint protection software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit