Intel’s Young: Security pros should get off the defensive and ‘go hunting’ for threats

The concept of “going on offense” is becoming more discussed among security professionals. Interest in this concept is driven by the idea that it’s far easier and and cost-effective to take a proactive approach to cybersecurity than it is to simply react.

The fact is, with the growing number of big attacks against U.S. companies, security pros need to think differently, as Intel Security Group’s SVP Christopher Young pointed out.

“We cannot confuse hard work with success, because the reality is that we are being outplayed by the competition,” Young told the audience at the RSA security conference in San Francisco Tuesday.

Young suggests that security organizations need to start looking at the less obvious data points to understand the actions and strategies of bad actors.

Young used the example of Oakland Athletics general manager Billy Beane, who was played by Brad Pitt in the movie Moneyball (based on the bestselling book by Michael Lewis). Beane was the first to use a data system called sabermetrics to improve the play of a professional baseball team. Beane also looked at different data points — not just RBIs and home runs — but “average runners on base” for insights on how to win games.

In fact, Young brought Beane himself out on the stage at RSA to talk about the art of using nontraditional data to achieve results.

Young said security pros need to think differently about the data points that help predict and fight cyberattacks.

He said that instead of endlessly tracking down alerts, security people need to find the data that betrays the profile of attacks being planned in the present.

“I suggest that we stop chasing down all of the alerts we get,” Young said. “I’m going to take 2 percent of my people and I’m going to go hunting for the attacks that threaten my organization.”

Young didn’t go into specifics about what types of data points security pros should be looking at; he simply suggested that someone in every security organization should be stepping back and looking for new connections between specific data points and specific attacks.

Some in the venture capital community are coming around to this way of thinking, too. At a recent VC roundtable in Mountain View, California, a good part of the conversation revolved around finding and investing in startups that are using new data to go on the attack against the attackers.