Security breaches are a fact of life, and the philosophy of cybersecurity today is such that organizations shouldn’t wonder whether they might get hacked, but rather assume they already have been. This blunt realism is necessary in an age where threats are advanced and persistent and every vulnerability is exploited.

But one observer of the security scene asks whether, in focusing on detection of and response to threats, the security community is forgetting about the power of prevention. Most major security breaches are detected long after they occur, when the damage has already been done. But when an attack is prevented, it does no damage and exacts no costs beyond the preventive measures themselves. The savings are invisible but enormous.

Falling Off the Cyber Kill Chain

As Anup Ghosh wrote on Infosec Island, the limitation of detection as a basis for cybersecurity is that it so often happens only long after the fact. FireEye’s “M-Trends 2015: A View from the Front Lines” calculated that the median time of the detection of security breaches is 205 days. Yet, as Verizon’s “2015 Data Breach Investigations Report” found, 60 percent of breaches allowed the attackers to compromise the victim within minutes.

Ghosh characterizes this problem as “falling off the end of the cyber kill chain” — the sequence of events that attackers go through in penetrating a system and attaining their objectives. All too often, threats are detected by third parties. For example, credit card operations often discover retail breaches before the victimized retailers do.

Prevention, or the Attacks That Never Happen

These security breaches can be costly: For a breach of 10 million records, the average cost ranges from around $2 million to $5 million but can soar above $74 million, according to Ghosh. And because the cost from a breach tends to be proportionate to the time before detection, the detection itself needs to be rapid to be effective. In contrast, the cost fallout from a breach that is prevented or blocked at the point of initial intrusion is precisely zero.

Thus, says Ghosh, “We should not lose sight that $1 spent on prevention is worth $1 million in post-breach incident response. And, furthermore, as we evaluate detection and response technologies, we should be looking for real-time detection solutions — think machine time, rather than human time.” This capability, in turn, calls for resources like “good sensors, analysis algorithms and an architecture that work in real time containing, identifying and controlling threats.”

So while firms need to recognize that advanced threats are ongoing and work under the assumption that they have already been hacked, this is no reason to ignore preventive measures that can stop many attacks before they begin.

Take a proactive response to today’s advanced persistent threats! Read the white paper to learn how