Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

6/21/2019
10:00 AM
Tim Brown
Tim Brown
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Patrolling the New Cybersecurity Perimeter

Remote work and other developments demand a shift to managing people rather than devices.

The consumerization of IT has eroded the traditional line between "work" and "play." Propelled by the bring-your-own-device (BYOD) era, our personal devices are commonly used for work.

This is especially true as more companies embrace the flexibility of working remotely, and as new devices and networks are used for work purposes. Personal smartphones are loaded with business email accounts, and personal computers and laptops used for remote work have business software, email, and documentation that may contain confidential information.

To top it all off, we aren't just using work devices in the office. We're using them on airplanes, at client offices, in coffee shops, and at home. All this means that the idea that protecting a perimeter is outdated. Instead, as "the workplace" becomes impossible to define as a physical location, technology professionals and IT teams must shift from managing devices to managing people, in order to stay one step ahead of such a rapidly evolving reality.

Protect the Crown Jewels
One easy way to begin implementing this new risk management strategy is to follow the Pareto principle (also known as the 80/20 rule), where companies treat 80% of the people one way while treating the riskier 20% of users with a higher level of security. Access should only be allowed via corporate devices, where multifactor authentication is mandatory, behavioral analytics is applied, and full auditing must be carried out regularly.

For example, the head of HR will be able to access data on all employees within an organization — and accessing this information from an untrusted, insecure device presents a huge risk. In this scenario, an organization's IT team will want to ensure that the device is controlled and that it hasn't been compromised.

Essentially if a person within an organization has the keys to the kingdom, it's crucial to make sure that his or her device isn't dirty, the network isn't compromised, and activity is completely monitored. There then needs to be a division between most of the staff and the VIPs, and between most data and the "crown jewels" (in other words, the most important and most sensitive parts of a business that would be most appealing to an attacker).

Zero Trust: Suspect Everyone
At the same time, by doing away with a perimeter-based security model, where those inside the perimeter are trusted, organizations now need to implement a new model that better matches the vulnerabilities inherent to today's mobile workforce. We must suspect everyone — we can't afford not to.

A Zero Trust policy assumes untrusted actors exist both inside and outside the network and, as a result, every user access request must be authorized. When implemented correctly, Zero Trust networks can improve security while also increasing productivity. What's key to true Zero Trust environments are adaptive controls that are contextually aware. Without context, we always need to put the strongest possible security in place; with context, we can adapt the level of security based on risk.

For example, there should only be a prompt for additional credentials when a user comes from an unknown machine, an unknown location, or when performing a sensitive function. Businesses need to understand their user's behavior, and if things are normal, allow for minimal authentication — if things have changed or the risk is greater, add additional checks.

Still, Zero Trust is a work in progress. Until it's mainstream, password management products that offer complete privileged management systems to password vaults will help to reduce the complexity of users remembering multiple passwords while encouraging stronger password use.

What Comes Next: Cyberhygiene
We know the modern workplace is no longer in one fixed location. At the same time, the nature of cyberattacks are shifting because of how efficiently cybercriminals get paid. From a hacker's perspective, fewer steps equals faster profitability — and all too often, organizations with remote work policies are ripe for attack. 

There are more devices to compromise, which means more machines that will likely be unpatched and not secure. Identities may be implemented in a weak fashion and allowed too much access. Similarly, the rise of collaboration tools such as Slack presents new opportunities to infiltrate networks and take advantage of liabilities. These types of accounts often do not get terminated — so when that user eventually leaves a company, their account remains active and open to infiltration or exploitation by cybercriminals. The more software there is, and the more people experiment with new ways of working, the greater the attack surface will be.

For these reasons, implementing basis cyber hygiene within your organization is critical as the workplace continues to evolve and become increasingly distributed. To meet the basic tenets of good cyber hygiene, organizations should always:

  • Understand the IT environment: Produce a comprehensive understanding of IT environments to uncover hidden data risks and help explain key elements to business leaders.
  • Educate business and IT leaders: Tell them about the risks to their data and implications of a breach — including showing data risk in financial terms.
  • Implement threat monitoring and detection: Deploy the right IT security management tools to detect and respond to potential threats.
  • Use data to show the value of IT efforts: Use data to understand an IT environment, get useful insights, solve problems faster, and demonstrate value.
  • Establish a solid security process: Ensure your organization is completing routine security updates such as managing and patching machines, ensuring a backup is in place, etc.

To stay ahead of this rapidly changing workplace paradigm, technology and security professionals alike should combine good cyberhygiene best practices in concert with additional strategies like Zero Trust and the 80/20 rule. Ultimately, employees need to be the new "endpoints," with the risk they pose to the organization assessed rather than simply determining them as safe depending on whether they are inside or outside a perimeter.

Related Content:

Tim Brown is the VP of Security for SolarWinds, with responsibility spanning internal IT security, product security, and security strategy. As a former Dell Fellow, CTO, chief product officer, chief architect, distinguished engineer, and director of security strategy, Tim ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
6/24/2019 | 3:08:12 PM
SECURITY can be learned by anyone
Case study: last year my wife, daughter and her daughter, 3 year old Cariana, came to visit my workplace.  They were given visitor badges and enjoyed the cafeteria ( Cariana loved pizza ) and met my colleagues.  Then it was time to leave and in the lobby little 3 year old Cariana said THESE HAVE TO BE RETURNED and gathered up their visitor badges and walked them TO THE SECURITY DESK on her own.  Amazing.  They wanted to adopt her on the spot.  Lesson: 3 year old got the concept of perimeter security BETTER than half the employees get it. 
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Lessons from the NSA: Know Your Assets
Robert Lemos, Contributing Writer,  12/12/2019
4 Tips to Run Fast in the Face of Digital Transformation
Shane Buckley, President & Chief Operating Officer, Gigamon,  12/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19807
PUBLISHED: 2019-12-15
In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The timeri variable was originally intended to be for a newly created timer instance, but was used for ...
CVE-2014-8650
PUBLISHED: 2019-12-15
python-requests-Kerberos through 0.5 does not handle mutual authentication
CVE-2014-3536
PUBLISHED: 2019-12-15
CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration
CVE-2014-3643
PUBLISHED: 2019-12-15
jersey: XXE via parameter entities not disabled by the jersey SAX parser
CVE-2014-3652
PUBLISHED: 2019-12-15
JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.