Protecting the digital workplace with an integrated security strategy

COVID-19 propelled the world of IT years into the future. Organizations considering long-term digital transformation plans were abruptly forced to accelerate their timeline, so employees could work remotely amid shelter-in-place orders.

While this shift in operations has positively impacted the business world in many ways, it has also introduced new security challenges that IT security teams are still struggling with today. For example:

• The massively distributed and mobile workforce has made the “digital office of the future” a reality today. There has been a dramatic rise in the use of email platforms, notably Microsoft Office 365, which is now used by more than 250 million monthly active users.
• There has also been a significant increase in the use of collaboration tools – such as Microsoft Teams, Slack and Zoom – as well as a corresponding increase in the amount of sensitive information exchanged over these channels (information once exchanged in the office is now done digitally).
• As a result of the changing business world, cybercriminals have pivoted their attack strategies to target these cloud services and remote employees.

Complicating matters, the cost, complexity and skills shortage challenges IT security teams were facing pre-pandemic haven’t gone away. Rather, they’ve been inflamed by the expanded attack surface created by the overnight transition to a mostly digital workplace.

Is it possible to secure this new digital world, when IT security teams are still struggling to protect the old one? The answer is yes, but it won’t be through buying more security tools. It will be through getting more value out of the tools in place by integrating them, so they can readily share information while reducing management overhead.

Learning from the past

Historically, organizations have taken a siloed approach to defending against cyber threats. A new threat pops up, and the IT security team invests in and purchases a new point solution to address it. While point solutions might serve as a quick, easy, check-the-box fix, they present an array of long-term business and security challenges.

For starters, buying a new product for every new threat is costly. And, investing in so many tools creates a complex infrastructure that most organizations don’t have the time, resources or budget to manage. (Believe it or not, the average enterprise has 75 security solutions in its ecosystem.) Last, but certainly not least, point solutions make it difficult, if not impossible, for IT security teams to have the cross-enterprise visibility required to detect and remediate threats, because threat data is so compartmentalized within each tool.

Here’s the good news: as security controls move to the cloud, we have a unique opportunity to break free from this legacy approach and rethink how security and related IT and security controls are implemented, integrated and automated in this new environment.

Integrating the security ecosystem

Like the old saying, “two minds are better than one,” integrating threat intelligence from all of your security tools will make them smarter and more effective at overcoming the challenges of the digital workplace, and at detecting and responding to threats. Here’s the tricky part: while adding technologies to your infrastructure is easy, getting them to work together is not. The key to achieving security integration of this nature is to adopt an open and pervasive API security strategy.

APIs automate data integration and exchange across security tools, including SIEM (Security Information and Event Management), SOAR (Security Orchestration, Automation and Response), endpoint security and ITSM (IT Service Management System) solutions. API platforms, in combination with an integrated security strategy, dramatically improve security infrastructure effectiveness while also providing consolidated management capabilities – both requirements for securing the digital workplace. The key benefits to this approach to security include:

• Gain visibility into your entire security ecosystem – Threat intelligence is shared and centralized, giving you greater insight into your entire security ecosystem that results in faster and more efficient threat prevention, detection, investigation and response.
• Automate repetitive tasks – No organization wants to waste their people’s productivity on slow, repetitive or manual threat detection and response tasks, such as combing through endless product reports for potential threats. Automating these processes via open API integrations can not only improve the efficiency of your IT security team, but it also can enhance the efficacy of the security tools themselves.
• Streamline infrastructure – Integrating your security tools helps to consolidate infrastructure management, which reduces complexity and frees IT security teams to focus on strategic initiatives, such as threat prevention, detection and response.
• Expedite threat detection and response – Many open API platforms can generate reports on your comprehensive security ecosystem in minutes, drastically reducing the time it takes for security professionals to make important decisions about potential threats, when compared to the “one tool at a time” approach.
• Defend against multi-vector attacks – APIs give you the cross-tool visibility required to detect and defend against multi-vector attacks, where cybercriminals are attacking multiple points of entry. Without this threat intelligence integration, data is so compartmentalized within each tool that you might not know about an attack of this nature until it’s too late.
• Build a customized cyber resilience strategy – With security integration and APIs, you can leverage the collective power of the best solutions from a variety of vendors to build a cyber defense program that matches your specific risk environment.

It takes a team

At this point, you might be thinking that it seems easier to rely on one vendor for all of your security needs, than to worry about integrating multiple solutions. But, the “one throat to choke” strategy has its own tradeoffs – specifically, lack of focus and innovation, because they’re about selling a basket of goods rather than the best of a specific good. And, the goods in the basket are often acquired and not integrated, which defeats the whole purpose of working with a single multi-product vendor.

Security integrations with an open API security strategy enables best-of-breed security, coupled with the desired benefits that come from an integrated infrastructure. It’s the most effective way to reduce the burden on overstretched IT security teams, get more value from your security investments and more adequately manage the risks inherent in both the old and new enterprise IT landscape.

Staying one step ahead of the bad guys requires collaboration – not only among security vendors and tools, but among teams. And an integrated security strategy will empower you to knock down the existing silos between business departments to build a powerful team that works smarter, responds faster and remains agile in the face of change – even a change as profound as the overnight arrival of the digital workplace.

from Help Net Security https://ift.tt/2PmXS8Y

Related Items