Building Resilience against Adversarial Cyber Activities
Cybersecurity goes far beyond compliance. We focus on security controls that support our business's mission instead of creating unnecessary overhead. In many situations, controls are recommended but not practicable for organizations. One example is a legacy application that fulfills a special backend use case. When implementing Zero Trust in our network and trying to bring multi-factor authentication to all our services, we must make thoughtful decisions and balance the risks and effort for specific measures. It is more practical to implement compensating controls such as segmentation, access control lists, and monitoring than to spend heavily enforcing MFA across all applications.
Consider a layered approach
When organizations choose the proper security controls, they should always take a layered approach. It's all about the risks involved in an organization's data and intellectual property. Concentrating only on security and neglecting privacy is a similar mistake. In high-risk environments, a single breach can be a disaster, while in less critical environments, detecting and blocking a breach quickly is acceptable. It all comes down to the risks involved and the context in which our applications support our mission. Organizations must carefully review the selected compensating control. If it provides sufficient protection or we can afford a lower level of security, a compensating control is adequate.
Implications of a layered security approach
Organizations have several advantages when they select compensating controls, including practicality, ease of implementation, and lower maintenance effort. In our initial example, implementing MFA for a legacy application might require a major software change that could take months. By contrast, setting up ACLs and improving access-log monitoring for these applications might take only a few days, which is a significant saving for the organization.
On the other hand, there are also disadvantages, such as higher risk, because compensating controls may provide a lower level of protection. Using ACLs as compensating controls for MFA could mean we experience unauthorized access due to password-handling issues, but we identify it quickly and block it. In the worst case, adversaries use their unauthorized access briefly to exfiltrate information from our environment. In this scenario, we could also use segmentation as a layered approach to limit the attack surface and further protect our data.
Building resilience against adversarial cyber activities
We need a layered security approach to build resilience against adversarial cyber attacks. In our ever-changing, dynamic world, we constantly face new technologies and improved adversary strategies. A security control that works today may be useless tomorrow. A successful cybersecurity strategy includes risk analysis, threat modeling, intelligence gathering, and continuous review and improvement of the entire layered security approach.
Which concepts to apply to your organization
Before applying cybersecurity approaches to our systems, we must clarify the risks involved, the use cases, the context in which our internal and external users use our applications, and the legal requirements. If our applications provide services to partners in the health industry, we may need to follow additional regulations and frameworks because of domain-specific requirements. The technology landscape also plays a crucial role because SaaS-based, on-premises, or legacy systems come with very specific risks. Another consideration is threat intelligence to keep ourselves updated on emerging threats. Industry frameworks like NIST could serve as a strong reference for our security architecture design. Cybersecurity is continuous because risks, application contexts, and technology environments keep changing.
By embedding cyber concepts into our organization's processes, such as risk management, software development, and operations, including a feedback loop, we are on track to build a strong security posture.
Reference
NIST Secure Software Development Framework
Comments