Fortifying Security: Prioritizing Facts Over Assumptions in Cyber Defense

Historically, navigating the open ocean posed a significant challenge for mariners. While determining latitude was straightforward using celestial bodies, finding longitude was fraught with uncertainty. A navigator's guess could lead to disastrous consequences, such as the British fleet's tragic loss in 1707, prompting Parliament to reward £20,000 to anyone who could solve the longitude dilemma.

The Real Complexity of Longitude

Longitude isn't inherently a nautical issue; it's fundamentally a problem of timekeeping. The Earth rotates at a rate of 15 degrees per hour, meaning that if you can establish your exact time at a known location like Greenwich, you can pinpoint your east-west position by comparing it to your local noon. At its core, the problem hinges on transporting a single verified fact—time—across the ocean without losing accuracy.

The esteemed method for determining longitude was the lunar distance approach. This involved measuring the angle between the moon and various stars to compute time using printed tables. While it was intellectually sophisticated, it encompassed a level of inference that was less reliable than desired.

John Harrison's Approach

Enter John Harrison, a self-taught carpenter whose method diverged from conventional guessing. Instead of attempting to deduce time more cleverly, he built a marine chronometer capable of maintaining accurate time aboard a ship, regardless of its movements and environmental conditions. This meant that navigators could finally rely on a tangible measurement rather than probabilities.

In 1761, Harrison's fourth timepiece was tested on a voyage to Jamaica, returning with an impressive loss of only five seconds after 81 days at sea, translating to a mere nautical mile of error. This shift from educated guesses to carrying an absolute fact changed everything.

Modern Cybersecurity as a Similar Dilemma

Today’s cybersecurity landscape mirrors the longitude crisis. Both attackers and defenders wield similar models, with the competition boiling down to the quality of information fed to these systems. Historically, the cybersecurity field has improved its interpretative capabilities—anomaly score enhancements, and better models to recognize malicious behavior. Yet, without solid data, these improvements remain vulnerable.

On the flip side, attackers exploit an organization's publicly available profile, crafting lures grounded in stale insights. They rely on outdated or incomplete intel, making educated guesses about employee roles and their various authority levels.

Conversely, defenders have the advantage of proprietary, current facts—like the identity of approvers for financial transactions, the correct domains owned by the company, and the identity of legitimate vendors. Even though breaches still occur, the core strength lies in the defender's ability to access verified information.

Take, for instance, a fraudulent wire transfer request crafted with impeccable grammar and an authentic tone. While it might pass anomaly detection, one critical fact, such as confirming the approver of record, can render it void. A secure system that maintains accurate ground truth can flag discrepancies without needing to question the email's surface-level legitimacy.

The Challenge of Maintaining Ground Truth

However, establishing a solid ground truth is only part of the equation; maintaining its integrity is equally daunting. Organizational changes—like shifts in authority or the inclusion of new vendors—can lead to gaps in this essential data. A neglected fact can deteriorate into a false certainty that can mislead teams.

The challenge resembles keeping every ship's chronometer accurately calibrated for navigation. Failing to do so can lead to disaster. Implementing systems to regularly update critical information ensures these facts remain reliable and grounded.

While no security system can guarantee against being deceived, a robust reliance on factual data can greatly enhance defenses—reducing the frequency of successful breaches and establishing a trail of accountability. Embracing and sustaining this truth is paramount for an organization.

For centuries, skilled navigators have traveled across oceans, often relying on educated guesses. Today, attackers are similarly piecing together information from the outside, constructing plausible narratives of your environment.

With the potential consequences of incorrect assumptions being severe, the real question is whether your organization is still relying on educated guesses or actively carrying factual data. To fortify your defenses, identify the most critical truth you can verify—like who holds actual authority over financial transactions in your company—and build from there.