{"id":2991,"date":"2019-01-07T11:11:55","date_gmt":"2019-01-07T16:11:55","guid":{"rendered":"http:\/\/chrisgrundemann.com\/?p=2991"},"modified":"2021-07-08T11:10:19","modified_gmt":"2021-07-08T15:10:19","slug":"making-sense-cybersecurity","status":"publish","type":"post","link":"https:\/\/chrisgrundemann.com\/index.php\/2019\/making-sense-cybersecurity\/","title":{"rendered":"Making Sense of Cybersecurity"},"content":{"rendered":"\n

I have spent the past 18-24 months deep inside the rabbit hole that is Enterprise InfoSec (Information Security). Cybersecurity<\/a> has always been a part of my work as an infrastructure engineer and architect. This singular focus was new though. In order to help my company, colleagues, and clients truly see the world of the 21st century through the lens of security, I had to both narrow and broaden my own perspective. Narrow in the sense that security became my paramount goal. Broad in the sense that security goes far beyond firewalls, networks, infrastructure, and even technology. <\/p>\n\n\n\n

Now, as I pull my head up from that work, it’s time to share what I’ve found with a wider audience and community. Yep – that’s YOU.<\/p>\n\n\n\n

Beyond the Firewall<\/h2>\n\n\n\n

First up is essentially a white paper covering the history and significance of cybersecurity (InfoSec). It also provides some high-level deployment advice. I call it a “Pillar Paper” because we define security as the first of four “pillars” of IT infrastructure. The others being networking, compute\/storage, and WiFi\/mobility. More on those in the future!<\/p>\n\n\n\n

Staying focused on security, here are a few snippets from the Security Pillar Paper<\/a>:<\/p>\n\n\n\n

Security is likely top of mind already for any organization. Not only are attacks becoming more common, the potential damage caused by each threat is reaching catastrophic levels. A perimeter firewall and an A\/V suite are no longer sufficient to protect your organization\u2019s growing assets from the rising number of attack vectors. A sophisticated and comprehensive approach to security that touches every piece of IT infrastructure and every layer of business process is required to avoid potentially crippling loss of time, money, and data.<\/p>

…<\/p>

Organizations need comprehensive security strategies that are closely aligned with business goals. Security must reach far beyond the firewall. Every element in your organization needs to play a key role in securing the entire IT infrastructure. People, processes, and technology must work together to maximize effectiveness and constantly evolve.<\/p>

…<\/p>

Security is needed now more than ever. Our dependence on information systems is at an all-time high, and so is the onslaught of malicious activity. The cyber arms race is on, whether we like it or not, and our only choice is to stay ahead of the game by taking security beyond the firewall so that our operations can flourish and our organizations can stay out of the headlines.<\/p><\/blockquote>\n\n\n\n

Obviously this drives home the tagline “beyond the firewall.” But what does that mean? How can you take the advice in this paper and apply it in the real world?<\/p>\n\n\n\n

Security Reference Model<\/h2>\n\n\n\n

Effective cybersecurity transcends technology into the organizational, legal, and human realms. Despite that, technology is still required. Specifically the hardware, software, and services that make up your IT security infrastructure. That’s the sweet spot between “beyond the firewall” and “beyond technology” altogether.<\/p>\n\n\n\n

This area is also increasingly crowded with a seemingly unstoppable wave of new products and new vendors. We want “defense in depth” not “defense in duplication” but how can we be sure? There is so much marketing buzz around so many emerging areas. It’s hard to keep it all straight.<\/p>\n\n\n\n

We created a reference model of IT infrastructure security<\/a> to combat this and to help us answer a few fundamental questions:<\/p>\n\n\n\n

\"Security<\/figure>\n\n\n\n

Cool chart, Chris, but what does it all mean?<\/em><\/p>\n\n\n\n

More on the Model<\/h2>\n\n\n\n

I’ve done my best to answer that in a 6-part series over on the Orange Matter<\/a> blog. For you, it probably makes the most sense to start with the last post, where I “describe how this model fits within the broader ecosystem of cybersecurity countermeasures and provide some advice on how to put it all into practice:”<\/p>\n\n\n\n

https:\/\/orangematter.solarwinds.com\/you-are-here-a-reference-model-for-it-infrastructure-security\/ <\/a><\/p><\/blockquote>\n\n\n\n

To understand the gap that this model fills I summarized some other useful cybersecurity models and frameworks in the first post of the series:<\/p>\n\n\n\n

https:\/\/orangematter.solarwinds.com\/you-are-here-making-sense-of-modern-infosec\/<\/a><\/p>

<\/p><\/blockquote>\n\n\n\n

From there you can deep dive into each of the four domains and their categories in the remaining four posts:<\/p>\n\n\n\n

Perimeter<\/a> \u2013 Network Security, Email Security, Web Security, DDoS Protection, Data Loss Prevention, and Ecosystem Risk Management
Endpoint & Application<\/a> \u2013 EPP \/ EDR, Patch & Vulnerability Management, Encryption, Secure Application Delivery, Mobile Device Management, and Cloud Governance
Identity & Access<\/a> \u2013 SSO (IAM), Privileged Account Management, Multi-Factor Authentication, CASB, Secure Access (VPN), and Network Access Control
Visibility & Control<\/a> \u2013 Automation & Orchestration, SIEM, UBA \/ UEBA, Device Management, Policy Management, and Threat Intelligence
<\/p><\/blockquote>\n\n\n\n

In short, this security reference model provides a framework for answering three critical questions: <\/p>\n\n\n\n