The SOC Van Pelt Report: Almost Losing is Still a Warning

Several college football teams found that out the hard way over the weekend. Don’t let your security team make the same mistake. 

In sports, the same performance can be evaluated differently based solely on the final score. That’s kind of how it works. If you win a close game, you’re “battle-tested, " but if you lose that same close game, you’ve been exposed. The only difference is the scoreboard. And in the end, that’s really all that matters. Did you win, or did you lose? But barely winning should still be scrutinized as if it’s a loss. Treating any win like everything is fine is called near-miss bias. It worked out that time, so surely it will work out every time, right?

Nope. That’s not how it works. And this weekend, a lot of teams found out the hard way. 

Survived, Then Lost

The weekend of October 10^th, Georgia scraped by against Alabama with a 20-17 win. That propelled them to the #1 spot in the nation. A week later, Auburn broke their hearts with a walk off field goal on Georgia’s home field. And  that came just a week after #1 Texas lost to an unranked Oklahoma. If you take anything else away from this, maybe Miami should be a bit nervous about Pittsburgh this weekend.

Indiana’s near miss came against Nebraska. The defending national champions trailed 17-6 with just over twelve minutes left before two big-play touchdown passes to Nick Marsh pulled out a 20-17 win for their 22nd straight. That is less “dominant champion” and more “got away with one.” Seven days later, Ohio State beat the Hoosiers 19-15.

Notre Dame’s version is subtler. At North Carolina, the Irish won 37-26 after leading 37-20 and allowing a late touchdown. Not a heart-stopper, but the #3 team in the nation shouldn’t be letting a 2-2 team hang around. And then this weekend, BYU took the lead with 1:47 left and held on for its first win over the Irish since 2004. Notre Dame’s last pass fell incomplete on the final play, ending a 16-game winning streak against the Cougars. 

How Does This Tie in to Cybersecurity?

Say your team catches a threat actor inside your network.  An alert fires off. An analyst isolates the host. The threat actor doesn’t get anywhere. No data gets stolen. The ticket gets closed. Everybody heads out to lunch. 

If your response to that is, “The process worked”, then you need to evaluate your own near-miss bias. And maybe the process did work. But it should bother you a lot that someone got close to begin with. They got past your perimeter, your email filter and your endpoint protection, and sat there long enough to start poking around. 

Stopping lateral movement is the Georgia-beats-Alabama moment. Great, you survived. But you need to treat that like a full-on breach. 

How did they get in? How long were they there before anyone noticed? Did the control that stopped them work because it was designed to, or because an analyst happened to be staring at the right dashboard at the right time? What else is exposed through the same door? If the honest answer is “not sure, but we stopped it,” that is not a win. That is a 17-6 deficit you happened to come back from, and the hole is still there.

Near misses are the cheapest lessons in security. You paid an afternoon of overtime instead of a breach notification. Filing it under “success” wastes the discount. 

Georgia, Indiana and Notre Dame all got a free warning, and all three filed it under “we won.” The scoreboard eventually corrected the record. Attackers will do the same. So the next time your team stops an attack before it spreads, celebrate for about five minutes. Then pull up the film.