You probably won\u2019t believe it. The new approach to enterprise security is tectonic; traditional virus protection software is not required. You can stop doing your daily enterprise updates of new virus definitions. The premise that antivirus software is useful in the identification and removal of unauthorized software is flawed. Now introducing the new paradigm of prevention-based incident response.\nPast, present and future paradigms\nA new paradigm shift is changing the prevailing security frameworks. First, let\u2019s uncover the underbelly of a paradigm.\nThomas Kuhn\u2019s famous book, The Structure of Scientific Revolutions, changed scientific thinking and introduced the concept of a \u201cparadigm shift.\u201d He shared his view that \u201cMen whose research is based on shared paradigms are committed to the same rules and standards.\u201d Whether we\u2019re speaking of concrete scientific achievements, emerging theories or traditional paradigms, old beliefs can slow progress. \u00a0What is particularly of interest is Kuhn\u2019s viewpoint that a shift can\u2019t occur using full communication, forced logic or neutral experience. Rather, this uprooting must occur all at once. In other words, you can\u2019t be "half in" when it comes to adoption.\nPast, present and future belief systems rest on a bedrock of paradigms: Beliefs that are internalized by the practitioners who study their effects. Several paradigms were entrenched societal belief systems \u2014 until they were changed. We are familiar with many of the past paradigms:\n\nThe Earth is flat.\nThe speed of sound may not be exceeded.\nThe poles of the Earth are stable.\nIt is not possible to split an atom.\nSteel is solid.\nConsciousness is inside our brain.\n\nIt\u2019s often more intriguing to pontificate about modern quantum physics and unified field theory and the design of future paradigms:\n\nThere are universes inside of universes.\nEverything is a \u201cFractal.\u201d\nEverything that is happening is the past.\n\nIn this modern world, we wrestle with existing paradigms that are accepted, if not overtly then by limited attempts to prove the alternative. Expanded value requires expanding thinking. The\u00a0U.S. Office of Personnel Management (OPM) data breach presents a transferable case relevant to every CIO responsible for organizational security. A practical case that presents a lesson and has a clear solution.\nHow the government jeopardized our national security for more than a generation\nThomas Pace, a principal consultant at Cylance, delivered a presentation titled \u201cDissecting the OPM Breach\u201d at the East IT Leader Forum (#EASTIT), which kicked off in sunny Miami in mid-November and was hosted by Ross Abbott, CEO of SINC USA.\nPace led an amazing presentation on the advanced persistent threat (APT) case study on the Office of Personnel Management data breach full report. APT is a type of threat actor, an \u201cadvanced persistent threat.\u201d An APT utilizes network-based attacks to gain unauthorized access to exfiltrate data.\nThe OPM data breach resulted in personnel records (4.2 million), background checks (21.5 million) and fingerprint records (5.6 million) being exfiltrated from OPM undetected. OPM had traditional antivirus software running. It didn\u2019t help.\nThis threat went undetected until 2015 (not a typo). Records from current, former and prospective federal employees were compromised from a system called Standard Form 86 or \u201cSF-86.\u201d The template for the SF-86 form is 127 pages, and most applications require additional pages. This system contained detailed lists of federal and military personnel going back 30 years. To emphasize the significant harm to national security, Pace provided one example. He noted that special operatives were not listed in the database. Imagine that there were 15 personnel stationed at a foreign embassy. Twelve are listed in the database, who are the other three? It would not take long to identify the special operatives with this information.\nThe OPM data breach leaked our country\u2019s most sensitive information, including the identity of anyone employed in a \u201cnational security sensitive position.\u201d The data exfiltration encompassed a wide range of personnel at all federal agencies, from employees to contractors. The magnitude of this breach was massive.\n\nThe lesson: New tactics are required to thwart security threats \u2014 the old antivirus paradigm is no longer effective.\n\nA new security paradigm\nPrevention-based incident response uses artificial intelligence to identify threats, dispelling the foundational belief that antivirus software is required.\nAre you thinking, \u201cWell that just can\u2019t be?\u201d I\u2019d kindly draw your attention to the past paradigms that were staples of belief \u2014 until they weren\u2019t. I didn\u2019t say it would be easy. Changing your core belief system is difficult.\nEnterprises primarily use antivirus software and run quick scans on endpoints daily if not hourly. Each of us has been on the receiving end of these \u201cquick scans\u201d that are supposed to run at 3 a.m. but somehow kick off during that critical meeting at 9 a.m.\nCylancePROTECT is a product that focuses on the prevention of attacks before they ever cause harm. CylancePROTECT predicts, prevents and protects enterprise endpoints from known and unknown threats by using artificial intelligence, removing the requirement for traditional signature updates.\nCylance takes a mathematical approach to identify malware, using machine learning techniques instead of reactive signatures, blocking threats in real time.\nPart of the allure of being a CIO is that as leaders we learn new concepts daily and have the good fortune to share exceptional ideas with our organizations. This paradigm shift is one of those exceptional ideas. It\u2019s worth your attention.\nOPM, true believers in the new paradigm\nA DLL file was ultimately found masked as a McAfee antivirus executable (OPM doesn\u2019t use McAfee antivirus software). For over two years, OPM was infected with malware while data was exfiltrated from OPM databases. How does OPM plug this breach? How many endpoints points are affected? Think for a moment, how long would it take your organization to respond and address every endpoint in your infrastructure \u2014 days, months, years?\nCylance was engaged to evaluate 10,000 endpoints and discovered 2,000 pieces of malware and contained the entire breach in 10 days. The result was nothing short of spectacular. The analysis was conducted within 48 hours, and the entire formal report was delivered in one week.\nAfter the Cylance analysis was completed, a law enforcement entity performed a detailed incident response that spanned three months; they found nothing additional.\n\nThe solution: Embrace prevention-based incident-response approaches that utilize artificial intelligence to identify known and unknown threats \u2014 threats with no published signatures.\n\nPrevention-based incident response is a new security paradigm that utilizes artificial intelligence and machine learning to predict threats, prevent attacks and protect enterprise environments. A new security paradigm has arrived.