Is the inability to baseline systems crippling cybersecurity progress and oversight?

Having limited insight into an organization’s security posture debilitates decision-making at every level. Currently, government leaders must rely on what is available -- namely, audit results -- - to decide how to prioritize their defenses. Without the ability to actively measure and prioritize risk, defenders at an operational level don’t know where to focus. At an executive level, appropriations and policy decisions are delayed.

Baselining is an under-appreciated and not-well-implemented security control that enables more mature security organizations to achieve a higher level of security. Why are so few agencies doing it?

In many cases, an agency's security program is developed around and within numerous constraints posed by legacy systems, organizational processes and the near-term pressures of achieving compliance. But these considerations, as important as they are, can cloud thinking when, in reality, a sound, holistic security strategy is needed as the starting point. Once such a strategy is developed, then policies can be written and technology investments made in support of that strategy.

The challenge in cybersecurity is figuring out how to defend against an adversaries that provides very few “knowns” about who they are, how they operate, how long they have been conducting operations and how many of the same exist within the environment. Equally challenging, cyber defenses (unlike traditional warfare or physical security) can’t keep the enemy on the other side of a border or boundary.

Baselining establishes “knowns” about ourselves, so that we can quickly recognize when something is out of place, both in a static and a dynamic sense. Baselining becomes a critical and foundational security capability that helps defenders know what to focus on by alerting them to critical, unauthorized, potentially malicious changes on likely-targeted systems. It shifts the dynamic from just guessing where the attackers may be or just trying to harden systems in a tactical sense, to actually operationalizing enterprise risk management.

Most agencies recognize that baselining is an important control at the program level (e.g., the scoring of sub-agencies in audit reports) but aren’t effectively baselining at the critical asset level (e.g., high-value servers, databases, workstations) where a compromise would have a detrimental effect on the confidentiality, integrity or availability of protected data or the safety and reliability of IT or operational technology control systems. What is hindering them?

For starters, authentication, asset discovery, vulnerability scanning, network firewalls, malware defenses and other more basic controls command attention every day. Most security organizations are so consumed with these programs that they don’t have the time or the bandwidth to focus on baselining at the critical asset level. At the same time, many security leaders are distracted by emerging technologies, focusing on promising solutions at the expense of sound security strategy.

Baselining provides a single source of truth to understanding the security, compliance and operational state of an asset by highlighting deviations from business-as-usual activity and known secure conditions.

In order to baseline effectively, agencies must do the following:

1. Identify and inventory all critical assets -- those systems (and components) that are essential to operations, process or hold classified/sensitive data or are subject to additional requirements.
2. Perform static baselining of those assets by making sure they are hardened using a predetermined secure configuration benchmark such as the Defense Information Systems Agency's Security Technical Implementation Guides or the Center for Internet Security
3. Perform dynamic baselining of those assets by defining business-as-usual activities, including normal authorized access, typical activities and approved changes. It helps to have a baselining tool that can create rules based on expected behaviors and then issue alerts when anything occurs outside those parameters.
4. Establish a process to receive deviation alerts that may indicate malicious compromise, changes by an authorized user or unintended deviation from a previously established compliant state. It helps to have a platform that can capture every change or deviation, while reducing the noise to a manageable volume by auto-reconciling with expected changes such as approved patches and change tickets.
5. Establish a process to quickly recover to a previous good state by remediating problems or performing forensic analysis to understand what happened, who did it, and how the changes impacted organization’s security posture. In many cases, critical assets may drift away from static baselines due to routine, approved activity.

Agencies are spending more time and money each year to implement security controls and strengthen operations without the same overall improvement in security posture. A pivot toward holistic security strategy, with baselining critical assets as a key component, will help ensure that organizational inertia, legacy systems or the allure of unproven new technologies do not detract from real cybersecurity.