Cybersecurity & Networking

  • Old friend and Cybereason CSO Sam Curry and I got together (virtually) to chat about all things SOAPA. In part 2 of our video, we focus on:

    • This newish thing called XDR. My colleague Dave Gruber and I are all over XDR as analysts, so I asked Sam for his thoughts. Sam thinks of XDR as taking EDR to the next level. He even broke down the acronym stating that the X signified telemetry independence. The “D” in XDR is somewhat overstated, Sam is really focused on the importance of the R, response, as security is about blocking (not finding) the bad guys. In the end, XDR should be a force multiplier for the cybersecurity staff.
    • What about analytics? In my eyes, vendors with the best security analytics win. Sam agrees but mentions that analytics must be complemented with what he calls, “judicious automation” that is continuously monitored and improved.
    • The Cybereason ASOC concept. Cybereason has a vision of what it calls the autonomous SOC, so I asked Sam to provide some detail. Sam describes a “task focused” architecture that widens the security analytics lens, simplifies SOC analyst duties, and automates actions. Sam reinforces the fact that it’s all about the tasks, not the tools.
    • The future of SOAPA. I ask all my guests their view on where SOAPA is going. Sam sees SOAPA as a technology platform that facilitates cybersecurity goals and mission. Since cyber-adversaries are always innovating, SOAPA will never commodify and continue to evolve moving forward.

    Many thanks to Sam and Cybereason for participating in the SOAPA video series, I always feel like I learned something when the two of us get together. More SOAPA videos soon.

  • When employees were sent home to work due to COVID-19, cybersecurity teams had to adjust their defenses accordingly. This was especially true due to a massive increase in coronavirus-related cyber-threats. In this environment, security awareness training is especially important, but too many training programs are a mere formality, conducted purely to satisfy a corporate governance or regulatory compliance requirement. ESG research illustrates that comprehensive security training is worthwhile as organizations with thorough training programs were more responsive to COVID-19 cyber-threats and had greater employee productivity. As such, CISOs should eschew “checkbox” training and persuade HR and executives to embrace more thorough security awareness training programs with demonstrable benefits and ROI.

    (more…)

  • Large organizations built their security infrastructure organically over time, adding new tools as countermeasures to emerging threats. Unfortunately, this created a messy situation where security must be monitored and managed on a tool-by-tool basis. CISOs have had enough—ESG research indicates that they are consolidating vendors and integrating tools into more cohesive technology architectures. These strategic changes will impact the way security technologies are purchased and sold in the future, which will have a downstream impact on the entire security technology industry.

    (more…)

  • Toward Cybersecurity Platforms

    For years, organizations anchored their security technology infrastructure with best-of-breed point tools, but this strategy is no longer adequate. Why? The lack of integration strains resources and leads to operational overhead. ESG research indicates that many organizations are now willing to replace these point tools with integrated cybersecurity technology platforms from a single vendor. This transition will impact enterprise cybersecurity technology purchasing and operations while simultaneously altering the security technology market.

    (more…)

  • Fundamental changes to network architectures, primarily due to the adoption of cloud services and the implementation of mobility, have rendered traditional approaches to defending the perimeter—to the extent that it exists—and brokering secure access to corporate resources insufficient. As such, network security controls are being reevaluated, with organizations increasingly looking to cloud-delivered solutions that provide centralized management and distributed enforcement, integrate with SD-WAN architectures, and enable secure access to cloud services.

    (more…)

  • Cybersecurity Vendor Consolidation Efforts

    Too many large organizations still anchor security to an army of disconnected point tools and rely on the cybersecurity staff to piece everything together. This strategy is ineffective, inefficient, and increases cyber-risk. CISOs have had enough as many are actively integrating cybersecurity technologies and consolidating the number of vendors with whom they do business. As this trend progresses, large organizations will buy a lot more of their cybersecurity technologies from a handful of vendors, which will tilt the market toward an emerging breed of enterprise-class cybersecurity vendors offering the right products, services, and partner ecosystems.

    (more…)

  • I’ve known Cybereason CSO, Sam Curry for years, so it was a pleasure to lure him to Enterprise Strategy Group’s virtual studio for a SOAPA video. In part 1 of our 2-part series, Sam and I discuss:

    • Why EDR? Sam describes how, unlike SIEM, EDR is designed for one specific purpose – finding the bad guys. The best EDR solutions identify signals in all the noise, alert humans about malicious activities, and make it easy for them to take action.
    • EDR as part of SOAPA. While EDR monitors endpoints, SOAPA brings in telemetry from other sources, analyzes the data, and makes the data actionable. So, SOAPA takes the best aspects of EDR and supplements them.
    • EDR for “low and slow” attack detection. One of the knocks on EDR is that it looks at cybersecurity incidents on an endpoint-by endpoint basis, thus missing APTs that slowly follow a kill chain attack pattern. Sam disputes this assertion, proclaiming that a good EDR system acts as a behavioral tracker and system of record that uses advanced analytics to stitch attacks together as they progress. The keys are data quality, analytics, and making the data intuitive and actionable.
    • SOAPA integration. SOAPA covers a lot of security technology domains so I ask Sam how Cybereason customers start building an architecture. Demonstrating his role as a CSO, Sam turns this question around to a business goal, insisting that users should focus on the results they want to achieve and then work backward to technology integration. Sam reminds the audience that the goals are coordinating humans and improving processes, not technology integration alone.

    I really think that Sam Curry could address cybersecurity issues in his sleep. Stay tuned for Part 2 of our SOAPA video.

  • Trends in Cloud Security: Putting the C in XDR

    cloud-securityCloud security as has reached a tipping point by virtue of the fact that both SaaS and internally developed cloud-native applications now perform business-critical functions. In turn, cloud security can no longer be a siloed discipline in which separate teams employ separate controls to secure separate environments. Fortunately, cloud security is starting to be mainstreamed – security teams are getting more involved in scrums and sprints, and many CIO’s are creating and funding cross-functional cloud centers of excellence (CCoE). The maturation of cloud security programs, however, needs to include bringing cloud observability into the security operations center. It’s time to put the C in XDR. 

    (more…)

  • Growing numbers of organizations are adopting modern application platforms, distributing and securing them across data centers and multiple public cloud environments. ESG conducted research to determine how those changes have impacted application delivery controller (ADC) deployments. The results indicate that organizations are expecting ADCs to evolve with emerging application and cloud technologies and deliver new capabilities that enable them to more efficiently manage, optimize, and secure their distributed environments.

    (more…)

  • Application Delivery Controller Trends

    ESG’s Master Survey Results provide the complete output of syndicated research surveys in graphical format. In addition to the data, these documents provide background information on the survey, including respondent profiles at an individual and organizational level. It is important to note that these documents do not contain analysis of the data.

    This Master Survey Results presentation focuses on application delivery controller (ADC) trends, especially as organizations balance hybrid cloud and application development strategies.

    (more…)

  • With the edge adding to the complexity of IT, organizations need a simple, cost-effective solution to extract valuable insights from immense amounts of data and, at the same time, protect the business. Aruba’s recently announced AI-powered, unified edge services platform (ESP for short) incorporates intelligence and security, helping improve agility and network visibility, boosting security at the edge, and enhancing the user experience.

    (more…)

  • In late 2019 and early 2020, the Enterprise Strategy Group and the Information Systems Security Association (ISSA) conducted the fourth annual research project focused on the lives and experiences of cybersecurity professionals. This year’s report is based on data from a survey of 327 cybersecurity professionals and ISSA members. Ninety-two percent of survey respondents resided in North America, 4% came from Europe, 3% from Asia, and 1% from Central/South America.