Cybersecurity & Networking

Now that we are within a month of the RSA conference, the security diaspora must prepare itself for a cacophony of hyperbole around three industry initiatives: Secure Access Service Edge (SASE), eXtended Detection and Response (XDR), and zero trust.

Yup, all three areas are innovative and extremely promising, but a bit overwhelming as well. Look for more from me on SASE and zero trust in the coming weeks. For now, we’ll focus on XDR. (more…)

We all understand that zero trust is a complex initiative. There’s a wide array of use cases, supporting technologies, starting points, and strategy options. On the bright side, one of the keys to succeeding with zero trust remains something companies arguably have the most control over – collaboration across the organization. The less encouraging news? These cross-functional relationships could be better.

Recent Enterprise Strategy Group research has found that many organizations have paused or abandoned a zero-trust project at some point in the past. This includes those who are currently engaged in successful projects. The single biggest reason given was organizational issues in implementing the initiative, which was cited by half of respondents.

Among all of the organizations ESG surveyed (including those who had not paused or abandoned projects, some of the specific collaborative issues faced with regards to zero trust include:

• Communications issues related to collaborative tasks (32%). Simply opening the lines of communication across often siloed teams within and outside of the IT organization remains a challenge. Having executives buy in and craft an overarching strategy is something we often discuss. But without the day-to-day operational collaboration required to ensure that the entire business is moving in the same direction, zero trust becomes an uphill battle.
• Security teams slow to incorporate feedback (32%). There is still an “us versus them” dynamic at play to an extent as well. Non-security practitioners may feel that the security organization slows them down and ignores their concerns. Often times the reality is that security teams are redlined with keeping the wheels on, and zero trust can be described as changing the tires while the car is still moving.
• Lack of clarity about areas of responsibility (29%). Again, the executive role looms large here. Without specificity as to which teams are responsible for what parts of the process, the strategy can break down.
• Non-security teams move too quickly (29%). This is the other side of the “us versus them” coin, where security teams believe their non-security counterparts do not properly weigh cyber considerations and move on a whim. Again, the reality is often more complicated, and this can be at least partially attributed to….
• Different groups measured and compensated on conflicting goals (29%). Non-security teams are likely to be more directly responsible for business outcomes than their security counterparts. This is certainly starting to shift but remains early days. When the KPIs and goals these teams are judged on vary, priorities can deviate.

With these challenges in mind, what are organizations planning to do about it? First, the most common action organizations plan to take over the next 12-18 months to implement or optimize zero-trust strategies is improve collaboration across security operations, IT operations, and the lines of business, cited by nearly half (46%) of respondents. This held true even among those organizations who are further down the path of zero-trust adoption and rate themselves as successful in the implementation. In other words, even those who are seeing zero-trust benefits realize collaboration is critical to success, and there is always room for improvement.

Second, there is momentum towards formalizing these cross-functional working groups through zero-trust centers of excellence (CoE). While still very early, and only formally implemented by a handful of organizations to date, many are actively working towards a CoE, or have plans or interest in implanting one. We’ve seen this model work before with regards to cloud, and the broad applicability across different teams certainly rings true for zero trust as it did with cloud adoption.

Regardless of where organizations are on the zero-trust journey, the focus should be on collaboration. We’re seeing similar trends with regards to SASE, application security, risk management, and other areas. Before getting bogged down in the technology weeds, planning for how the teams involved will successfully work together should be the focus.

As the old security adage goes, “A well-managed network/system is a secure network/system, and this notion of network and system management is a cybersecurity foundation. Pick any framework (i.e., NIST Cybersecurity framework), international standard (i.e., ISO 27000), best practice (i.e., CIS 20 Critical Controls) or professional certification (i.e. CISSP), and much of the guidelines presented will be about security hygiene and posture management.

(more…)

The topic of network and security convergence has been front and center in the industry over the last year. The line between networking and security continues to blur, with collaboration increasing across traditionally siloed IT functions and technologies used by these teams continuing to inch closer together. One of the more notable initiatives is secure access service edge (SASE), and both enterprises and vendors alike are now embarking on their SASE journey.

(more…)

In my last blog post, I described how the market for eXtended Detection and Response (XDR) is evolving and how CISOs should approach this new and promising technology. It was good and useful information, if I do say so myself, but it didn’t directly address the question of why security professionals should care about XDR in the first place.

In my continuing video blog series on Modern Email Security, I have had the opportunity to talk with many of the leading innovators tackling some of the toughest challenges in email security. The email threat landscape has been quite volatile over the past year, with so many criminals leveraging the human fear associated with the pandemic to fool unsuspecting users into handing over credentials and sensitive data.

With the almost overnight migration from on-prem email solutions to cloud-delivered email, many of the early-stage email security companies have been focused on the opportunity to strengthen the native email security controls offered by the CSPs. These same companies are tackling some of the more sophisticated, multi-stage email attacks involving phishing and other impersonation techniques.

However, while a majority of organizations are now depending on cloud-delivered email as their preferred email solution, we can’t take our eye off of on-prem email deployments. The recent Microsoft Exchange Server attack highlights the number of organizations still depending on on-prem email solutions. In my most recent ESG email security research, 60% of organizations reported the use of both cloud-delivered and on-prem email, so while most are depending on cloud-delivered email as their primary email application, pockets of on-prem Exchange usage continue to have a long tail. This means that email security teams need to not only maintain both environments, but also need to ensure that both are capable of defending against the highly dynamic, email threat landscape.

I’ve been impressed with the progress that many of the email security vendors have been making in stopping attacks involving phishing, often leading to more sophisticated and targeted threats. However, I worry that the long tail Exchange users may be getting left behind. And given that socially engineered attacks often leverage phishing across multiple communication mechanisms (SMS, collaboration tools, social media apps, and more), email security is only part of the larger defense platform required. Maybe we need to consider on-prem email as simply another communication channel that needs to get figured into the broader solution?

Check out my modern email security video series to learn more about how the innovators are tackling this and many other important email security issues.