Rethinking IT Security Architecture: Experts Question Wisdom Of Current 'Layered' Cyberdefense Strategies
As attacks become more sophisticated and breaches abound, it's time for enterprises to change their cybersecurity thinking from the ground up, experts say
Layered security. Security integration. Defense in depth. For years now, cybersecurity professionals and vendors have been preaching sermons on the merits of an enterprise security strategy that mixes a variety of tools and technologies to create a complex barrier that hackers can't penetrate. "Layered security" has become as much a part of industry parlance as authentication or encryption.
There's just one problem: It isn't working.
More Security Insights
- Forrester Study: The Total Economic Impact of VMware View
- Securing Executives and Highly Sensitive Documents of Corporations Globally
While enterprises and government agencies have invested unprecedented resources in cybersecurity over the past few years, the incidence of new data threats and breaches remains at record highs. The most recent Verizon Data Breach Investigations Report (PDF) indicates that breaches involving hacking and malware were both up considerably last year, with hacking involved in 81 percent of incidents and malware involved in 69 percent. According to the Cost of a Data Breach Report, malicious attacks on enterprise data rose last year, and the cost of a breach is at an all-time high ($222 per lost record). According to figures posted this month by Panda Labs, more than 6 million new malware samples were detected in the third quarter alone, and more than a third of machines across the globe are already infected.
Is it time to hit the "reset" button on cybersecurity strategy? Should organizations challenge current thinking around security architecture -- and, particularly, the effectiveness of layered defense? Many experts think so.
"Organizations are implementing incremental improvements to their information security capabilities to provide short-term solutions -- without tackling the issues associated with the overall information security threat," says research and consulting firm Ernst & Young in its Global Information Security Survey 2012, published in October. "The need to develop a robust security architecture framework has never been greater."
However, 63 percent of organizations have no such framework in place, the study says. "For years, companies have been approaching security as a technical problem, usually by buying products to solve specific problems," says Jose Granado, principal and practice leader for IT security services at Ernst & Young and one of the authors of the new report. "There hasn't been much thought put to how those technologies will work together, or to the people and process sides of the equation."
While many large organizations have systems architects or network architects who help create the framework for the evolution of hardware and communications technology across the enterprise, most of E&Y's large clients do not have security architects, Granado says.
"There is a huge [difference] between organizations that have a security architect and those that don't," he comments. "When there is an architecture that's tied to the company's business goals, then there's a realization that security problems can't be solved in a silo." A well-defined architecture helps dictate how the various single-function security technologies will work together -- and makes it easier to find the weak spots in enterprise defenses, he says.
Vinnie Liu, partner and co-founder of Stach & Liu, a consulting firm that works with large enterprises on security architecture and tests companies' defense strategies, agrees that enterprises' historical focus on point solutions has prevented many organizations from developing a broader security strategy.
"The industry has been approaching the cybersecurity problem like the TSA has been approaching the air-security problem," Liu says. "First the bad guys brought guns on board, so they put in metal detectors. Then somebody put a bomb in his shoe, and now we all have to take our shoes off. Then they found liquid explosives, so now we can't bring on any liquids. It's one problem, one solution, with no real thought to the big picture."
If enterprises do have a broader defense strategy, then it's usually focused on "layering," in which the organization buys a variety of different point products, essentially creating an obstacle course that the attacker must navigate to get to the sensitive data, Liu observes. By implementing a patchwork of firewalls, antivirus software, intrusion prevention systems, and the like, the enterprise hopes to detect a wide variety of attacks and mitigate them before they can do much damage.
"The problem is that most of these tools are still signature-based, which means you're taking a known threat and blacklisting it. So what you're doing is essentially layering one technology with another layer of the same type of technology," Liu says. "It's sort of like putting on a coat, and then putting on another coat that covers the exact same parts of your body, and then wondering why you're still cold."
Stach & Liu recommends that rather than buying more point technology, organizations should perform a risk assessment that identifies the most sensitive areas of the business, the most likely threats, and a holistic defense strategy -- an architecture of technology and processes -- designed specifically to protect the business. The risk assessment, along with the definition of the business' specific security requirements, helps identify top priorities and most likely threats, as well as key goals -- such as compliance -- in order to develop a comprehensive, practical defense strategy.
"You need to define your [security] requirements, just as you would with any architecture," Liu says. "Most companies don't take this step, so when it comes to building out the architecture, they have a hard time. They're trying to defend against everything without really knowing what problems they're trying to solve."
Next Page: The most important piece of developing a security architecture.