If you have a hammer, every problem looks like a nail. Cybersecurity has a similar issue: every problem can appear as an isolated situation requiring a point solution. Yet this approach devalues cybersecurity investments considerably and leaves a lot of money on the table in terms of unused features, redundant overlaps, and taking valuable time from security teams.
“This has been one of the main issues in cybersecurity for years,“ says Lior Arbel, co-founder of SAAS provider, Encore. “I've been in the cybersecurity market for 25 years and things haven't changed. Organisations are buying new point solutions or replacing existing ones, only to find themselves in a similar situation. They don't make sure that the solutions are integrated correctly, and they can't identify the gaps in coverage, leaving a door for an attacker to access.”
Why does diligently adding security products reward companies with even more security headaches? The fundamental problem stems from modern cybercrime.
Security in a complex world
It's primarily a myth that cybercriminals deploy exotic and never-before-seen tools for their attacks. The exceptions are nation states and highly specialised groups, whereas the rest rely on known exploits and poor security hygiene. For example, prevalent malware such as Emotet, Trickbot and Lokibot are more than six years old, yet still rank in the top 10 most used by cyber criminals. This legacy demonstrates that companies are not necessarily more secure for all their security investments – and complexity is to blame.
“Focusing on point solutions for specific problems creates layers of complexity,” says Arbel. “You feel more secure, but you actually create more work for your security teams with little benefit. If you don't have consolidated reporting, you must check each system individually in its own reporting language and without a direct link of how it fits into the rest of your environment. Additionally, in larger organisations there are also silos within cybersecurity where each team works almost in isolation. Such silos help an attacker to penetrate networks and systems without being detected.”
Complexity also creates overlaps and redundancies. Security systems perform best when they integrate with other tools. An emphasis on point deployments results in valuable features left unused.
Arbel explains that the security market's evolution makes these issues more common. “Such problems couldn't be solved 10 years ago because it was a different world for security. The idea of integrated security framed around a strategic plan has been a big step forward for the industry, and there would be growing pains. Companies should accept that overlaps and redundancies exist, then look for ways to fix those problems.”
“It's even a badge of honour,” he continues. “I'll go as far as to say that if you have a complexity problem, you're paying attention to security. But now you need to consolidate and amplify those investments.”
Can we fix modern security?
When you look at one piece of a puzzle, can you extrapolate what the whole puzzle will be? That's very unlikely, yet this is what organisations have been doing for years with cybersecurity reporting.
“Different products often talk in their own reporting language, showing only what they identify in isolation from other solutions. Additionally, systems can't report on what they are not aware of. So, if there is a gap of coverage, the system will not report on issues from systems it is not aware exist. We also find that some implementations are so stuck on complying with service-level agreements that they neglect complementing the larger security strategy. On paper things look just fine, but in reality, systems and teams aren't talking to each other.”
Such issues compound reporting demands. Companies often pay a lot to compile and consolidate reporting data manually. This process can take days or even weeks, by which time much of the information is outdated and useless. Unless you can comprehensively and constantly audit an environment, you are wasting your effort.
Digital security companies frequently encounter this complexity conundrum. They cannot do their work if they don't understand the nuances of their customers' environments, prompting some to develop new tools that agnostically audit digital security estates.
“The trick is to bypass the individual reporting tools and instead use software that discovers and queries security services directly. We developed such a tool for our internal teams, but our customers soon started asking about using it for their operations.”
Cybersecurity is expensive and an ongoing cost. There is no avoiding that reality. But when security teams can audit their environment – removing redundancies, consolidating licences and plugging gaps that could make all that spend moot – then cybersecurity becomes cybersafe value.
“Don't ignore complexity issues in your security,” says Arbel. “It's a real money hole and drastically reduces the worth of what you've spent. Real-time reporting that operates independently from the standards and features of different products makes an enormous impact on maturing security estates. Your teams won't rush out to justify and buy new point solutions every time they spot a gap. They can take a more strategic approach, use what's already available, and even save money while keeping the business safe from hackers and data thieves.”
Find out more at www.encore.io
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version