From an attacker’s standpoint, it’s a target-rich environment. They can attempt direct assaults on the target’s infrastructure, exploit vulnerabilities in their web applications, or go after the credentials of individual employees.

As defenders, we need to determine who might want to attack us, the types of attack vectors those adversaries have used in the past, and which of our attack vectors might be attractive. The idea of “thinking like an attacker” is not new. It’s a simplified way of describing threat modeling.

It’s not enough to assume a perimeter defense will keep the bad guys out. We need to start with the assumption that some adversaries will be successful in some of their attempts to bypass our defenses and deploy a layered defense at the network and endpoints to thwart those who do bypass initial layers. Common weak points include mobile devices and laptops that connect to the Internet when off of the corporate network and social engineering attacks such as phishing. The attack can target employees or members of your supply chain (e.g., an HVAC vendor’s credentials were stolen in the Target incident).

Many companies discuss the “kill chain” approach to data protection. Essentially, this means deploying defenses at each stage of an attack (planning, code introduction, command and control, expansion/lateral movement, target identification, exfiltration). This approach acknowledges that some attacks will succeed initially, but that we can “kill” the attack at any stage to prevent data loss.

Let’s take a simple example: the case of an attacker who is targeting a company’s design information. This information may be stored in many places, but the “mother lode” will be in the data stores used by the design software (or a version control system, in the case of source code). These devices are undoubtedly in secure areas, and network defenses are monitoring external traffic.

The attacker has a few options, but his first goal is to gain extended access to the systems, ideally with valid and privileged credentials. This will provide him with greater freedom to operate and explore the target. If he is successful, we have the worst-case scenario: an attacker with authentic credentials and access to the information they wish to steal.

The alternatives for data exfiltration are numerous, including:

• Copying files to external devices
• Copying files to a cloud server
• Emailing files to external accounts
• Taking screenshots of files, and exfiltrating the resulting image file (without a CAD or similar file extension)
• Printing the files, locally or on a remote printer

The only way to protect data in this scenario is to control what actions can be taken with the data. Access control doesn’t help, as the credentials are authentic. Privileged user management can help, but is typically used to control administrative rights, not what can be done with data. Instead, we need to apply use privileges directly to the data.

Data-centric security allows organizations to control the actions taken with data, by any user. Even privileged users with root access can be prevented from accessing data, while still being allowed to administer devices and databases. By looking at each requested action in context – accounting for the data, the user, and the action (e.g., printing, on unapproved printers) – organizations can protect sensitive information without hampering legitimate business behavior.

Understanding attack vectors is part of threat modeling; we need to understand who might be an adversary and their likely approaches. At a practical level, it doesn’t matter if the attacker is a malicious insider, or an outsider with stolen credentials, both require the same protections. Threat modeling helps us set policies that protect the data from malicious (or inadvertent) actions.

As they say, It’s not a matter of “if” you will be attacked, but “when”. Deterring attackers from breaching your systems is certainly a goal, but stopping them before they can complete their mission is a requirement. This is only possible if you are tracking the movement and use of the data itself.