What's the point to do ...

dbit wrote: »

Solutions can only enable you to aid in the protection of any environment , No one solution will do that , its a tricky thing to do but you must employ a platform of multiple solutions or and all in one effort - as per earlier no one solution can do that . You are reducing an attack surface and tying up loose ends and endpoints , culling avenues of attack and trying to reduce the over all visibility, as a weak sick animal lying out on the planes ready for the attack.

Kinet1c is spot on once you become a targeted attack you really have no chance whatsoever if you do not employ these solutions as with APT attacks the payload is new every day and not recognized by scanners and sandbox's , scanning for known pattern files and code sets is useless with targeted malware driven breaches as once they are under the skin its curtains for the defense side of things .

Why would you be a target ? maybe your a good platform to island hop from or you deal with the intended target and have some admin privileges on the true end targets systems . Your general security is observed as very low and full of holes - then really you are asking for it .

Heuristics monitoring , intrusion prevention , Virtual patching or actual patching , rigorous control of the DATA flow in, around, and out of the company is paramount without out it you are running around the streets naked with a jar of vaseline in your hands shouting "NEEEEXT!"

lol:pac:

If for a moment, you consider that in reality nothing is ever entirely secure, rather that there are levels of protection that are consistent with levels of resources that you apply to the complexity of your prevailing scenario then imho security is a question of risk management.

Your client should, as part of their corporate risk management identify information security or technology security as a corporate risk, conduct an analysis of its constituent parts (simple likelihood v impact score lines, and identification of remediation costs) and then make an informed business decision as to what to do along a continuum of "do nothing" if there is zero impact of your information security risk assessment, to "invest lots, build a team, 24x7 monitor, alerts, alerts, alerts, patch, harden, iso27x, etc..." if their business is critically relying on their information (and/or devices) being secure and where the remediation costs can be provided for. This is a delicate balance.

To build on the analogies above;

If there is nothing of value in your house then you won't mind the thief helping themselves to it. If there are items of significant value then you will deploy means consistent with that value in terms of protecting those items (locks, alarms, rottweiler, food for rottweiler!!, security guard, gun, electric fence, etc.., etc..).

If everything was unimportant then there would never be any need for information security to be applied. But the real world generally isn't like that. Something will be important to somebody, somewhere..... and hence need security to ensure it isn't compromised or made off with.