Offensive vs Defensive Cyber Security

In the wake of the COVID-19 pandemic, organizations have been forced to rapidly adapt in order to maintain operations. For many, this has meant adopting a much more powerful IT infrastructure that enables efficient connectivity that also supports remote workforces.  While this allows businesses to stay afloat, it also creates a bigger opportunity for cyber criminals.  

These malicious actors are now targeting organizations that are not adequately prepared for cyber attacks that seek to exploit the weaknesses in their systems. This is disturbing especially now that studies have shown that criminals could be developing to the tune of about 300,000 attack programs per day.

To counter such threats, most businesses tend to prioritize defensive cyber security strategies and often forget about offensive cyber security. Others actually confuse the two, and what this means is that their security posture is vulnerable.

It's critical that security players entrusted with protecting their organizations actually do comprehend the clear difference between offensive vs. defensive cyber security, and why it’s now advisable to use both.

What is defensive cyber security?

Defensive cybersecurity is all about preventing attacks. It's akin to surrounding your home with a high wall that thieves will find hard to go over. So you do all that is possible within your means, including training employees and upgrading the systems constantly. You then sit back and hope that any form of attack will be blocked. 

This approach focuses on actively guarding your systems against any attack. It's more or less a ‘blind’ strategy where you do everything you can to constantly safeguard the network. You don't know the enemy's plans, not even whether the enemy is within or without. Common defensive measures include firewalls, antivirus programs, encryption, VPNs, and strong passwords. 

Benefits of defensive cyber security

• Improves business continuity and resilience — Defensive cyber security measures can help organizations to continue operating after a security breach or attack, minimizing the cost of downtime and disruptions.
• Reduces regulatory and compliance risks — Organizations can mitigate the risks of regulatory penalties and fines by implementing effective defensive cyber security measures that align with regulatory requirements.
• Enhances brand protection and reputation — A robust cyber security defense can help to protect the organization's brand and reputation by mitigating the risks of data breaches and negative publicity.
• Increases employee productivity — Defensive cyber security measures contribute to employee productivity by reducing the risk of employee exposure to cyber threats.
• Decreases insurance costs — Many insurers offer discounts to organizations that have implemented plausible defensive cyber security measures. As a result, implementing such measures can lead to significant savings on insurance premiums.

What is offensive cyber security?

Offensive cyber security is a branch of cyber security, just like the defensive approach. This strategy focuses on proactively attacking networks to exploit vulnerabilities and gather intelligence. The offensive approach seeks to identify the vulnerabilities or avenues that attackers can potentially use. The security team will test the network and generate insights that give the true picture of the organization's security status against cyber attacks. The most common offensive technique that companies use within their internal networks is penetration testing. 

Also read: What is the cost of penetration testing?

There is also another emerging angle of offensive cyber security that entails seeking out the enemy and disabling their plans before they accomplish their attack mission.  

This latter technique of offensive approach where you go after the attacker is commonly referred to as attacking the attacker. Here, cybersecurity services companies or the internal security teams begin by using tricks like deception and subversion to gather information about identified or potential attackers. Once the security teams have sufficient information, they advance to the next levels that could entail methods like denial of service and fake exploits. This method  is worth implementing albeit gradually as it’s become increasingly important as a tool for both nation states and organizations to gain an edge over attackers. Imagine if you were able to discover the plans of cyber criminals and disable them before they harm your organization. Remember this is not about seeking to harm the would be attacker, which is actually illegal. It’s simply an attempt to collapse the attackers’ plans or trick them into revealing their identities. Always consult your legal teams when deploying this method.

Benefits of offensive cyber security

• Attackers get the message: Offensive strategies make it clear that you are prepared and willing to fight back. The attackers get the message that you will deal ruthlessly with any planned attacks on your systems.
• Intelligence gathering: Gathering intelligence about your adversary and their methods is a step closer to stopping them. You're in a much better position to understand an attacker's tools, techniques, and procedures. You can see things from their perspective and learn how they operate.
• Discourages future attacks: You're essentially showing your attacker that you're not an easy target. You're not just sitting back and waiting for them to harm your organization.
• Information sharing with authorities: Your organization can share information with law enforcement and the intelligence community in a way that is mutually beneficial. When these entities have access to this kind of intel, they can better protect against attacks on the larger ecosystem that includes your business partners and customers.

The clear difference between offensive vs defensive cyber security

To best understand the difference between offensive vs. defensive cyber security, we simply focus on the meaning of the words offend and defense. To offend means attack, while defend means guard. So then, offensive strategies are purely about attacking your systems as well as those of the enemies where you can. By 'attacking' your systems, you can discover hidden loopholes that the enemy can exploit. By attacking the enemy's systems, you ‘bring them down’ and disorient their plans. Governments around the world use immense resources to track down and thwart planned attacks both online and offline. When they do this to target cyber criminals, then this is part of offensive cyber security.

Offensive vs defensive cyber security: Which approach companies deploy?

Companies should deploy both defensive and offensive strategies. Defensive strategies will protect the company’s networks against the most common risks. Offensive strategies will scatter advanced attacks that can easily bypass even your strongest defenses. 

From a big picture perspective, offensive outcomes can be used to strengthen the defensive strategy. Let's say you perform an attack on the company's systems and unearth alarming vulnerabilities that criminals can easily exploit. The insights from this offense can be used to expand your defenses so that they cover the newly exposed weaknesses. 

Think about it this way: if you only have a defensive strategy, you're always going to be playing catch-up. You're always going to be reacting to the latest threat. This will give the cyber criminals the opportunity to move miles ahead of you,  so much so that soon your defenses will not block the latest and most advanced attacks. But if you have an offensive strategy too, you can be proactive in anticipating threats and taking steps to mitigate them before they cause damage.

Recommended reading: How to assess your company’s cyber security posture

Conclusion

You probably know that cybersecurity threats are becoming more and more sophisticated. What was once considered a problem for large businesses is now a concern for businesses of all sizes including new ones. Unfortunately, the defensive approach that previously enjoyed ‘monopoly’ status is no longer sufficient. It’s now a question of how to deploy both defensive and offensive rather than which among the two is appropriate.