<http://schema.org/articleBody>
"On Tuesday, Amit Yoran delivers his first keynote address as president of RSA\u2014the security subsidiary of business technology giant EMC \n\t\t\t\t\n\t\t\t\t\t\n\t\t\t\t\t\tEMC\n\t\t\t\t\t\t\n\t\t\t\t\t\n\t\t\t\t\n\t\t\t, best known for its passkey-generating fobs\u2014at this year\u2019s RSA Conference, the largest enterprise security confab in the world.\n(If you\u2019re unfamiliar with the conference, here\u2019s Fortune\u2019s breakdown in the latest issue of the magazine. You\u2019ll notice we pulled a featured quote from his address.)\nYoran sat down on a call with Fortune ahead of his speech to provide a sneak peak at the issues he\u2019ll be discussing on stage. What\u2019s his number one? Well, the headline may have given it away\u2026\n\u201CThe security industry is failing,\u201D Yoran tells Fortune, taking a pause before delivering a knockout blow. \u201CIt has failed.\u201D\n\n\t\t\t\t\n\t\t\t\n\t\t\t\nIndeed, it\u2019s hard to argue otherwise. Last year there were 738 data breaches, according to the Identity Theft Resource Center, which represents a more than 25% increase over the year prior. Those figures don\u2019t exactly indicate a success.\n\u201CIf I could come up with a theme for this year\u2019s conference it would be: No More of the Same,\u201D Yoran says. In fact, the theme of this year\u2019s conference is\u2014as though pulled from another presidential campaign playbook\u2014Change. (Admittedly, a less colorful theme than that of that of the \u201995 summit: Egyptian Scarab Seals.) \u201CLet\u2019s do things differently; let\u2019s think differently; let\u2019s act differently. Because what the security industry has been doing has not worked.\u201D\nYoran, who has served in various security functions within the private and public sector for more than two decades, has seen monumental shifts in the way security pros protect\u2014and their adversaries infiltrate\u2014corporate networks. Now he\u2019s fed up, it seems. Companies have failed to adapt to today\u2019s assiduous threats, he says.\n\u201CIf we don\u2019t succeed and turn the current paradigm around, I think there is a catastrophic situation for technology in general,\u201D Yoran says. \u201CWe have to win. There is no alternative.\u201D\nTopping Yoran\u2019s list of gripes is what he believes to be a lack of understanding. Today organizations will spot a breach and rush to clean it up before truly understanding the extent of the compromise, he says. They end up blinding themselves to the incident, not having \u201Cscoped\u201D it properly.\n\n\t\t\t\t\n\t\t\t\n\t\t\t\nYoran\u2019s keynote address is aptly titled \u201CEscaping Security\u2019s Dark Ages,\u201D and he extends the analogy in conversation with Fortune. \u201CWe need to stop thinking of taller castle walls and deeper moats,\u201D he says. Complex passageways and nifty windows won\u2019t work either\u2014no matter how high one builds or how deep one digs, attackers will still get through. \u201CAt the end of the day, even if you use next generation protective measures, focused adversaries with the resources, with the time, with the skill, and that have a defined objective of breaking into your organization are still going to get in,\u201D he says.\nNot to alarm anyone, but they\u2019re probably already inside, he adds.\nSo should we all just roll over and accept defeat? Yoran answers with an emphatic No. Even while corporate IT teams face the digital equivalent of barbarian raids and bubonic plagues, Yoran is convinced that the halcyon days are not all past. \u201CWe sit at the doorway of the age of technology enlightenment,\u201D he says.\nClearly knowing his audience, Yoran supplies his guidance in the form of \u201C5 things to know\u201D\u2014a favorite Fortune format. Here they are:\n1.) Know your environment.\nFirst is what I would characterize as true visibility: Understanding what\u2019s really happening in your environment. Don\u2019t rely on logs from IDSs [intrusion detection systems] or firewalls. You\u2019ve got to really understand. Unless you have full packet visibility into end points with a sophisticated compromise assessment capability technology, unless you have visibility into the cloud-based environments that you operate in, you cant begin to pretend you know what\u2019s going on. I would say that is a fundamentally non-negotiable building block for security today.\n2.) Know your users.\nSecond is this sort of realization or understanding that in a perimeter-less world, you have fewer anchor points at which to apply good security. Key among those are identity and data. As attacks move from zero day exploits and pieces of malware to orchestrated campaigns, at some point in that attack lifecycle it\u2019s all about compromising privileged access accounts. Compromising an end user account increases the access levels that\u2014and the information that\u2014the adversary can access. Organizations need to do a better job of authentication.\n3.) Know your adversaries.\nThird is external threat intelligence. There are phenomenal sources of threat intelligence today that have phenomenal insight into very specific threat actors. If you don\u2019t understand the threat environment, if you don\u2019t understand your adversaries, if you don\u2019t understand who is coming after you or what they\u2019re coming after\u2014what their TTPs are, or tools techniques and procedures\u2014your operating in an island instead of looking at the weather forecast. You\u2019ve got to understand what\u2019s happening in the broader environment to give yourself a leg up, or even a fighting chance.\n4.) Know your priorities.\nThe fourth point would be to understand what matters to your business. You can\u2019t protect everything at all costs at all times. What matters most? What\u2019s mission critical? What is required for your regulatory reporting requirements? What is required to accomplish your organizational objectives? What keeps you in business? What drives shareholder value? You\u2019ve got to understand these things so you can prioritize your limited security resources to the things that are going to be most impactful to your organization. It\u2019s an absolutely critical part of managing digital risk today. Because digital risk is business risk. It\u2019s a fundamental building block that most organizations don\u2019t do or don\u2019t do well.\n5.) Know your weaknesses.\nPoint five is to stop believing that your adversary protections work. They work, they block things\u2014but they fail, too, on a regular and consistent basis. Stuff gets through. We see malware today specifically designed and programmed to evade sandbox detection, because that\u2019s an increasingly common methodology people use to protect themselves. I\u2019m not saying don\u2019t adopt aggressive forward-leaning protective methods. Of course, do that. But don\u2019t lull yourself into a false sense of security by believing the marketing or hype.\u2014that just because you\u2019ve done X, Y, Z, you can sleep well at night. The truth is the adversary is getting in no matter how high the walls you build are. Or they\u2019re already in. And you\u2019ve got to be able to think about the world that way.\n\u201CThat\u2019s the difference,\u201D Yoran concludes, \u201Cbetween becoming a leading security program and disaster.\u201D"^^<http://www.w3.org/2001/XMLSchema#string>
<http://fortune.com/2015/04/21/rsa-conference-amit-yoran-keynote/>