While hybrid IT has increased the flexibility available to businesses, it has also altered the meaning of securing an organisation since important workloads can be based on-premises while others are run in the cloud, with edge infrastructure and Internet-of-Thing (IoT) devices linking up operations in offices, factories, mines and remote sites.
Complexity creates the opportunity
The issue isn’t that any of these technologies individually are insecure; rather, it is that they generate a greater number of connections which have to be understood, managed and monitored by security teams.
The widespread nature of this operational setup is now offering attackers a tempting target. The edge devices, relay boxes and other infrastructure located between different environments can act as a means of initial access, especially since these are managed separately from the organisation’s main IT environment. An attacker does not always need to succeed in breaching the most heavily protected system; it may be sufficient simply to find a less obvious way of gaining access.
This puts security teams in an uncomfortable position since introducing yet another security product to deal with each new risk can actually increase the complexity they are attempting to manage.
Having more dashboards results in more alerts; the use of more platforms leads to more integrations, and an increased number of tools can also cause responsibility to become fragmented so that there is no single overview of what is happening in the environment.
Finding the gap between systems
A recent case we experienced illustrates this problem. An organisation which ran operations at a number of sites contacted us following the detection of odd network activity on a production system. At first, it was thought that one of its main servers had been breached. But when the environment was thoroughly mapped from end to end, the cause of the problem was found to lie with an edge device that connected the site equipment to a cloud-based application.
The device wasn’t seen as especially important and for that reason had been handled outside the organisation’s main security procedures and had thus become a blind spot.
Instead of just adding another security product to keep an eye on the device, we redesigned the connection. The device was transferred to a segmented network, access was placed under central identity controls, and its activity was included in the organisation’s current monitoring environment. The several overlapping security tools were also combined so that the security team could manage the environment using fewer platforms.
The immediate vulnerability has been dealt with, but the greater improvement was structural in nature since the organisation has now gained a clearer understanding of how its various environments were connected to one another.
Security needs to be viewed as one environment
This is the area in which organisations should direct their attention. Security in hybrid environments does not mean treating on-premises infrastructure, cloud platforms, edge devices and IoT systems as separate security projects; rather, they should be seen as making up one operating environment.
It is important to have a centralised system for managing identities and access; this is especially relevant in cases where users and devices use a number of different systems. If one device is compromised, network segmentation can prevent the attacker from spreading too far. Furthermore, consolidated monitoring then provides security teams with a more useful overview of activity in the environment.
Simplifying the security stack
IT consultants can serve a practical role in this situation since they are in a position to evaluate the entire architecture rather than concentrating on a single technology or security product. The aim is to spot unnecessary duplication, eliminate the gaps between different environments and make it easier for the internal teams to manage the security controls.
This in turn affects the way we discuss security investment. Instead of asking simply, “What other tools do we need?”, the right question should be, “In what areas does our environment remain hard to see, control or manage?”
For organisations which have infrastructure that is becoming more and more distributed, this distinction has become important. A security team cannot effectively protect something that it is unable to clearly map out, and it cannot efficiently keep an eye on an environment in which each component follows a different set of controls.
The most useful thing that organisations dealing with hybrid complexity can do next is to draw a map showing all the connections between their on-premises, cloud, edge and IoT environments before buying yet another security tool; such a task usually shows that the main security gap is not the absence of a particular product but rather a lack of visibility and consistency with respect to the infrastructure that is already in place.
Share