Field feedback:
CIOs, CISOs, or executives often ask us what best practices to implement to protect themselves efficiently and quickly.
My first answer to them is to identify risks and set up a streamlined security governance framework (CISO, DPO, ISSP) tailored to how the organization operates.
Within ITrust for the past 14 years, we have had time to form an expert opinion on best practices and correlate them with those identified by ANSSI, ENISA, or SANS. We have strong convictions, and we wanted to substantiate them with a mini-study based on recognized independent frameworks.
The study is straightforward. We analyzed each attack technique used by hackers, malware, insiders, and malicious actors, and evaluated whether the attack method was detected and blocked by different technologies: Does an antivirus detect privilege escalation? Does a firewall detect a C&C used by Emotet? etc.
For greater realism, we examined two comprehensive studies conducted by RedCanary and Darkreading that assess the attack techniques most frequently leveraged in recent 2020 attacks.
These findings are then aligned with our field experience. We identified the attack techniques that ITrust encounters across its clients or network during the most critical incidents or those with the greatest business impact.
We reviewed this synthesis with our engineering teams and drew a clear conclusion.
Here is the MITRE matrix used, along with the coverage rate according to technology types.
We conducted the same analysis for Antivirus, Firewall, and SIM technologies…
For each type of protection technology, we mapped its coverage percentage across the various MITRE attack techniques. In the subsequent columns, we identified their coverage based on their ability to detect the top 10 and top 3 techniques most commonly leveraged today by attackers and malware. Finally, the last column highlights their coverage rate against the most critical threats (APTs, ransomware, etc.) evaluated by ITrust's Red Team and Threat Hunting experts.
Here is the executive summary:
Notice the non-existent coverage rate of firewalls and antiviruses (although they remain essential for addressing baseline risks. We reiterate: firewalls and antiviruses are mandatory basic defenses!).
An EDR alone delivers a noteworthy detection rate, but will rarely suffice to thwart advanced attacks on its own.
The highest coverage rate is achieved with a SOC powered by SIEM, UEBA, and TH. Adding an EDR increases the detection rate by 10% based on the RedCanary study.
Field feedback and data analysis also show that an anti-phishing/anti-spam solution is highly complementary. It is not displayed in this table.
A "traditional" correlation SIEM lacking UEBA, artificial intelligence, and Threat Hunting fails to protect against high-impact attacks.
MITRE Matrix Rankings by ITrust
What are the key takeaways?
Traditional tools—antiviruses and firewalls—are no longer sufficient to ensure protection: they defend against only 2% of modern attacks.
A SOC (Security Operations Center) equipped with a SIEM and UEBA delivers the highest detection efficacy against current threats and, more broadly, achieves the best overall coverage rate.
Augmenting a UEBA-powered SOC with an EDR and an anti-phishing solution is highly effective. Augmenting a SOC with a continuous vulnerability scanner has now become indispensable.
Based on the field experience of ITrust engineers, the recommended approach for any organization to protect itself effectively is as follows:
– A streamlined risk assessment (simplified EBIOS approach)
– A tailored ISSP (Information Systems Security Policy), periodically reviewed and continuously enhanced through a quality cycle
– A dedicated CISO (Chief Information Security Officer)
– A managed SOC featuring SIEM, UEBA, and TH, combined with continuous vulnerability scanning and an anti-phishing solution.
This forms a comprehensive defense package capable of protecting an organization at an exceptionally high level (estimated at 100%. However, 100% is a misleading metric since zero risk never exists in cybersecurity; 99% would be more accurate).
It is advisable to routinely conduct penetration testing, carry out security awareness training, segment the information system in accordance with the performed risk assessment, leverage European cybersecurity tools, and host sensitive data with European cloud providers utilizing European software and tooling. Monitoring the dark web or cybersecurity vulnerability intelligence and engaging a CERT are valuable measures that effectively complement your defense posture.
Beware of common industry pitfalls: a SIM is not a SIEM; a next-generation antivirus is not an EDR (it merely matches known patterns, unlike an EDR); an XDR is not a SOC…
Exercise caution with cyber insurance policies: they frequently fail to cover many incident scenarios and remain relatively immature today. They will be worth reassessing in two years.
Note that 70% of current SOCs fail to detect emerging threats, not only due to the factors outlined above, but also because of a lack of proper monitoring, escalation, and inter-team communication processes. According to ITrust experts, robust processes account for 50% of security success.
As a reference point, a standard cybersecurity budget typically represents 7% to 13% of the total IT budget (depending on the organization's profile and industry sector). Below this threshold, it is impossible to guarantee any dependable level of security.
In summary, it doesn't get any more straightforward or effective. We would like to thank the ITrust engineering teams and our clients for this valuable field feedback.
Some of the insights presented in this article are factual and corroborated by independent studies; others reflect the professional interpretations and expert assessments of our consultants, which we welcome discussing. Please note that we strongly urge every organization to deploy an antivirus and a firewall as a strict baseline, and to conduct a risk assessment to identify the critical assets and operations that require protection. The goal is not to protect everything, but to make high-value assets resilient and hard to access.
The ultimate objective is to compel malicious actors to target less protected entities where the effort required is substantially lower.
