Cyber Security Crisis: An Origin Story

The 2020s are quickly being defined as a decade of globalism driven by digital connectivity, technological innovation and the questioning of socioeconomic norms that have persisted since the early 20th century. If the 1970s gave rise to the “me” generation, the 2020s can only be described as the “now” generation. Information at unprecedented scale is available at our fingertips – anywhere, anytime, in nearly any format. This has changed the expectations of the average consumer and the military-industrial complex alike. We communicate online, we work online, we wage war online.

In this new digitally connected age, data has become the world’s most valuable resource. Data means power. Those that hold it have the edge. This applies to individuals, businesses and governments alike. With data at such a premium, it’s no wonder a market for data theft has flourished – after all, it’s human nature. For every good deed, a bad deed lays in wait. 

The hacker represents the modern day boogie man – lurking out in the digital ether, unseen…but we know he’s there. It’s a delicate balance, especially at the corporate level. Companies play digital defense because they possess the data, whether it be financial, legal, personal or otherwise. Hackers innovate, finding new ways into corporate networks, devices and applications. This continuum has in turn created the cyber security market, where vendors strive to make a quick buck by plugging the latest hole in corporate infrastructure. But it’s been a losing battle thus far because security solutions that come to market are reactionary to problems their customers are already facing. The black hats have the element of surprise, and companies typically don’t know what hit them until it’s too late. 

This new digital dystopia is here to stay. And while it might make you want to shield your eyes like an episode of Black Mirror, the outlook for data protection and cyber security is not as bleak as it may seem. The first step to resolution (or general improvement), is to acknowledge that a cyber security crisis exists, and to identify our current challenges and shortcomings in order to pave a path forward.

Today, corporate networks are expanding and evolving in true Darwinistic fashion thanks to architectural advancements, new networking protocol standards, device proliferation, hybrid work policies…you could write a dissertation on this topic alone. The point is: the corporate network now extends to wherever authorized devices can connect to gain access to company resources.

More, More, More: Exacerbating the Cyber Security Crisis

All of this proprietary, confidential or merely sensitive data being accessed across these parts of the network is no longer safe behind your castle walls. The physical headquarters still exists, but it’s basically just a “fat” branch like any other satellite office or employee working from home. 

This complexity has driven cyber risks and costs to dangerous new heights. The number of significant cyberattacks globally is increasing and includes devastating ransomware attacks that are breaching even the most secure networks. But are we really surprised? Cyber defense (and offense) is the national security priority for every developed country on Earth. We’ll never know the global investment made into clandestine black hat innovation for the sole purpose of destabilizing the digital footprints of nations perceived to be threats. We may not want to. Ignorance here really can be bliss.

The Bad News

There were on average 270 attacks per company over the year, a 31% increase over 2020. Third-party risk continues to dominate: successful breaches to the organization through the supply chain have increased from 44% to 61%. (Accenture)

As they’ve adopted these new extortion approaches, ransomware gangs have become greedier. The average ransom demand was $5.3 million. That’s up 518% from the 2020 average of $847,000. (Palo Alto)

32% of organizations say security is not part of the cloud discussion from the outset and they’re trying to catch up. Reasons preventing take-up of the cloud revolve around security issues: about one-third of all respondents say poor governance and compliance is a problem, that cloud security is too complex and that they do not have the internal skills to structure a proper cloud security framework. (Accenture)

The Good News

82% of IT executives say their budgets have increased in the last year. IT security budgets are now up to 15% of all IT spending, 5 percentage points higher than reported in 2020. (Accenture)

49% of IT executives said their top security priority is the protection of sensitive data. (IDG)

The global median dwell time – the duration between the start of a security intrusion and when it’s identified – has dropped to below a month for the first time, standing at 24 days in 2021. That means incidents are being identified twice as quickly as they were year-over-year. (ZDNet)

Cyber security is a market plagued by acronyms, especially on the networking side. This doesn’t simplify matters. The real problem is that the security technology landscape, like its lingo, is too complex. How can anyone with their back against the wall make sense of the options presented to them in the Cyberscape? The reality is that we need to get back to basics. What businesses large and small need to be asking is: what’s essential to maintain business continuity safely and securely? 

Don’t let the Cyberscape fool you. When it all boils down, cyber security can be fundamentally bucketed into three areas:

1. Network Security
2. Endpoint Security
3. Application Security

While security software vendors have made the subcategorization of these areas into a cottage industry, this overarching security trilogy is pretty straightforward. In essence, companies should seek to secure their networks, the devices in use across those networks, and the business applications in use across those devices.

Network Security

Simply put, network security is a set of rules and configurations designed to protect computer networks and the data in transit across them via software and hardware. Organizations large and small require a degree of network security to protect it from the proliferation of cyber threats we covered earlier.

Network security typically consists of three different controls: physical, technical and administrative. Physical security controls are designed to prevent unauthorized personnel from gaining physical access to network components such as routers, wiring closets and so on. 

Technical security controls protect data that is stored on the network or which is in transit across, into or out of the network. Protection is twofold: it needs to protect data and systems from unauthorized personnel, and it also needs to protect against malicious activities from employees, contractors and guests on the network. 

Administrative security controls consist of security policies and processes that control user behavior, including how users are authenticated, their level of access and also how the IT department can implement changes to the infrastructure.

Endpoint Security

Endpoint security is the practice of protecting enterprise networks against threats originating from on-premises or remote devices. An endpoint is any device that provides an entry point to corporate assets and applications and represents a potential cyber security vulnerability. Examples include desktops, laptops, servers, workstations, smartphones and tablets.

Historically, most organizations have relied on tools such as firewalls, VPNs, and antivirus programs to safeguard sensitive information, prevent unauthorized access to critical applications and IT systems, and protect against malicious software and other vulnerabilities. 

As we’ve touched on, however, companies are increasingly adopting mobile applications and cloud services that erode the once well-defined enterprise network perimeter. Many enterprises are now taking a defense-in-depth approach to endpoint protection, instituting a wider range of security controls to protect against a broader array of threats.

Application Security

Application security is the discipline of processes, tools and practices aiming to protect applications from threats – both internal and external to an organization. Cyber threat actors exploit vulnerabilities in enterprise applications to capture data, intellectual property, and more – often with impunity. Application security can help organizations protect all kinds of applications (such as legacy, desktop, web, mobile, etc.) used by corporate stakeholders including customers, business partners and employees.

Most successful breaches target vulnerabilities that reside in the application layer, such as the recent log4j vulnerability. As a result, IT teams must be extra vigilant about application security. To further compound the problem, the number and complexity of applications is growing, as is the number of devices and device types running them.

Even a decade ago, the operations, systems and digital footprints of most medium to large companies had become overwhelmingly complex. Over the last ten years, these digital corporate footprints have expanded to reach and capture growth from previously untapped corners of the world. More recently, the business imperatives of the COVID-19 pandemic spurred faster adoption of enterprise software solutions – particularly Software-as-a-Service (SaaS) – that pushed data beyond the organization’s physical perimeter. This has all added significant pressure to already lean IT teams.

The truth is that lean IT teams have to reassess and realign their priorities. This means leveraging technical security essentials in a way that eases the burden on them. In practice, the first step is to begin adopting network security solutions that accommodate today’s most common networking hardware; provide out-of-the-box integrations with critical security tools such as InTune, MFA, and popular SIEM solutions; and work in conjunction with firewalls and endpoint security solutions.

Securing Networks is Only Getting Harder

Events like the recently exploited Log4j vulnerability continue to keep IT security teams on their toes. Little can be done to plan for, let alone prevent, such wide-reaching software flaws – hundreds of Cisco, VMWare, IBM and Oracle products were affected in this instance, including more than 120 different configurations of Cisco Identity Services Engine (ISE). The unfortunate reality is that these events ultimately mean lost weekends patching systems, as well as assessing the damage done to the network and the devices. In many cases, it means bringing in more skilled professionals to investigate, diagnose, and implement – a costly endeavour you likely would not have budgeted for. Other on-going IT priorities are also inevitably pushed to the side with mitigation underway.

Such exploits and subsequent critical system fixes are particularly hard felt by the mid-market. This segment is often considered the backbone of the economy, yet they’re underserved when it comes to having purpose-built network security essentials, including network access control technologies. 

Lean IT Should Maximize Value

For resource-strapped IT teams, these unpredictable security incidents can seem insurmountable, especially when the onus is on the customer to patch their own software. Constant fire drills lead to stress, burnout and turnover – something many organizations simply can’t afford. Instead of helping alleviate stress on lean IT teams, traditional on-premise network security vendors make the problem worse. Their solutions require extensive, ongoing integration and maintenance. Complicating matters further, specialized point solutions don’t mesh easily to provide a holistic view of the network. 

This then brings us to the question of value. Wouldn’t it be more valuable to bring in IT security essentials that can reduce this stress and anxiety by eliminating the need for heavy systems maintenance? Wouldn’t it be valuable to free up that time spent putting out fires and use it to modernize your IT security stack? In practice, this means adopting and deploying network security solutions that deliver the essential functionality and capabilities we laid out earlier. It also means turning to SaaS for security. And for network security, it means choosing the right cloud-native NAC.