With every purchase of new technology or software, age-old concerns around the availability of supporting skills crop up. There are always questions about sufficient, certified internal skills or recruiting new talent, outsourcing services, or paying premium vendor professional services rates to get the deployment done as quickly and effectively as possible.
The latter is basically the only option if you wish to safely adopt new technologies in any business with confidence. Of course, there is also the consideration of the level of after-sales support to be employed and at what cost.
This is a much bigger issue than the consideration it receives, according to OWASP CICD-SEC-7, “an insecure system configuration risk stems from flaws in the security settings, configuration, and hardening of the different systems across the pipeline, often resulting in low-hanging fruits for attackers seeking to expand their foothold in the environment.”
Because businesses are under constant pressure to innovate, update and expand, system administrators and engineers are not afforded the time necessary to research security and vendor best practices, let alone the time needed to adapt and configure these practices to meet unique commercial requirements and IT-flow processes. This can lead to hastily deployed production software that introduces brand new security vulnerabilities directly into the enterprise.
Most vendors supply free best practice guides and high-level training via different means including shadowing deployment, but this takes time and a minimum level of existing knowledge to complete and most certainly does not ensure quality or secure rollout. With security products in particular, remediation of misconfigurations and security flaws takes a lot longer and often requires a total rebuild of the solution to negate these defects. In some cases, the solution might not function as expected at all, and identifying the underlying cause can be both a time-consuming and costly exercise that will eventually involve either vendor support or professional services.
Vendor professional services
Consider that when you employ vendor professional services, you are smashing the responsibility ball back into the vendor’s court with the goal of getting the deployment completed quickly, securely, and effectively with clear timelines and expected outcomes. Although it might seem expensive at first, bear in mind that it will only be done once for a vendor to fulfil their end of the professional services agreement on professional services.
Make no mistake, the vendor will include everyone necessary to get it done right in the shortest time possible. A misconfiguration or insecure deployment can cost you significantly more. Use of vendor-supplied default configurations or default login usernames and passwords is a recipe for disaster, and they usually remain insecure and easily exploitable.
Many software and hardware products come out of the box with overly permissive factory-default configurations intended to make the products user-friendly and reduce the troubleshooting time for customer service. However, leaving these factory default configurations enabled after installation may allow attackers to exploit them. Network devices are also often similarly pre-configured with the aim of simplifying deployment. Default credentials may be physically labelled on the device or even readily available on the internet. Keeping these default settings creates opportunities for malicious activity, including gaining unauthorised access to information and installing malicious software. Network defenders should also be aware that the same considerations apply to extra software options, which may come with preconfigured default settings.
Cyberthreat actors routinely exploit poor security configurations, either misconfigured or left unsecured; weak controls and other poor cyber hygiene practices to gain initial access, or as part of other tactics, to compromise a victim’s system.
In conclusion, if you are adopting new technology in your enterprise, always consider vendor professional services for the initial deployment unless you have certified and experienced in-house skills. This negates the risk of insecure deployment, over extended deployment periods and creates an opportunity for your engineers to shadow on the deployment and learn hands-on. It will most likely cost you less in the end, the experience will be a lot richer and will also lead to a healthier vendor relationship on a technical level.
Find out more at iOCO, +27 11 607 8100, [email protected], https://ioco.tech/
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version