Page 12 - Cyber Warnings

• Study how attackers think. Attackers don’t view your systems the way your
organization does, down departmental lines and areas of responsibility. They view your
systems as a means to an end: pathways to the assets they are seeking, regardless of
your org-chart.

Study security researchers’ articles and blog posts, bug bounty reports, and HOW-TOs
for hacking, and you can learn a lot about how attackers think. This is like getting a copy
of their playbook, and gives you a defensive advantage.

• Be better offensively than your attackers. An organization with more offensive skill
than the real attacking threat should be able to outwit their opponents. Such an
organization can run continual realistic attack simulations to improve defenses, and hone
intruder detection capability.

Invest in offensive capability. Being smarter than your opponent yields a major advantage in the
struggle to secure an organization. If you can secure against your own offensive capability, your
organization will fare well against external attackers.

CONCLUSION

Regardless of available resources, no organization on the planet is immune from the changing
security landscape; all must adapt. Every day, new software ships, new vulnerabilities are
found, and new attack vectors are discovered.

An organization should aim to become more secure every day, which is an attainable target
regardless of budget or manpower. Even if just getting started, your organization can be more
secure by the day’s end, and the cycle repeated tomorrow.

About the Author

Brad O’Hearne is a 25-year career software architect / developer,
application security expert, and independent security researcher. He
resides in Gilbert, AZ and enjoys cycling, soccer, reading, and spending
time with his family. He is available for consultation and can be contacted
at [email protected].

12 Cyber Warnings E-Magazine – July 2017 Edition
Copyright © Cyber Defense Magazine, All rights reserved worldwide