Today it takes an average of 252 days for an organization to identify and contain a breach across hybrid cloud environments, while ransomware attacks occur every 11 seconds. This proves that traditional security can no longer keep up with our modern world. As most big businesses move to be multicloud, SaaS-heavy hybrid cloud users, enterprises must raise cyber awareness to protect a dramatically expanded security attack surface.
Security is no longer an afterthought and must be embedded in everything we do. In the increased complex hybrid cloud environment, how do we secure end-to-end and obtain a holistic security posture that is adequate to support business functions? It’s time to think of security at the enterprise level as industries shift to a new, Security First archetype: Transformative Security Programs.
Modernize security: Quality, velocity, affordability
80% or more of executives struggle to engage information security and operations disciplines early enough to prevent rework or security incidents. To incorporate a Security First mindset, companies should consider policy compliance, security regulations and asset protection before they design their cloud strategy. In an effort to prevent costly reworks, companies should also address complexities early on in the strategy and design phase, rather than waiting to deal with security later.
A modernized security operation and management system should avoid the antiquated approach of security as a stand-alone function. Instead, run it as a true integral business entity and invest accordingly to drive cyber resiliency and the quality, velocity and affordability needed to protect digital assets. With a Security First approach, not only will your vulnerabilities be subsidized through secure architecture design and early, modern security testing, but your enterprise can also leverage automation, artificial intelligence (AI) and machine learning (ML) to shorten MTTR and supplement cyber talent shortages.
Hybrid cloud mastery demands a whole-team approach to security
With 82% of security breaches caused by human error, a modern security program should include situational awareness with a single pane of glass and advanced cyber training such as simulated cybersecurity attack and response exercises. These training designs incorporate the intensity of countering attacks with fun factors to best educate and relate security to your team’s day-to-day activities. Modern security awareness and education encourages people to exercise critical thinking and promote good cyber behavior for normal operations as well as disrupted, under-attack operations.
Though improving cybersecurity and reducing security risks are critical for the successful execution of digital initiatives in cloud portfolios, they’re not always directly linked in execution. Rather than merely running a security modernization program in parallel with a cloud adoption program, aim to explicitly integrate roadmaps and embed security into the hybrid cloud journey—with enterprise security and hybrid cloud security playing on the same team.
As an example, no matter who is leading a data fabric initiative, designing and implementing a secure data fabric requires the engagement of the whole team. Engaging the whole team means security becomes an explicitly shared responsibility, and this approach is easier and more effective when it’s grounded in a broader Security First and Security Always culture.
3 steps for overcoming the security challenge to hybrid cloud mastery
Step 1: Harmonize the security posture across the estate
Think holistically. Security posture is the sum of security policies, capabilities, and procedures across the various components of a hybrid cloud estate. When we push the “start” button and ask the specific cloud or components to interoperate in a productive way, the lack of harmony among security postures can expose serious problems. Harmonizing the security posture across the entire hybrid cloud builds a fabric of protection that helps keep “bad guys” from entering through the weakest link. Enterprise security management from the top down allows enterprises to achieve consistency.
Step 2: Create visibility through a single pane of glass
If hackers really want to attack you, they will touch your network at different app ports, and generate a lot of network activity. If your data is siloed, you might not notice this surge and could miss a leading indicator of a potential security attack.
Enclaves of data (apps, network, security) should be fused into a data lake to allow accurate security insights across the entire cloud estate. Your enterprise can impose AI or machine learning capabilities into the data lake, and IT Ops data and AI Ops data can be tools for making better business decisions. This aggregated visibility capability, known as a “single pane of glass,” helps enable detection, assessment and resolution of security anomalies with high velocity.
Remember, in a hybrid cloud ecosystem, security is more than just the security function: it’s central to your business. You need the rights to harvest these data through good terms and conditions with your cloud provider.
Step 3: Leverage AI to predict vulnerabilities
The single pane of glass is more powerful if we can also make better, faster sense of what we’re seeing. AI, machine learning and automation can ingest high volumes of complex security data, enabling near-real-time threat detection and prediction. AI tools can be “trained” to detect cyberattack patterns that have preceded incidents in the past. When those patterns recur, AI can trigger alerts or even provide actions for self-healing well before a human operator could detect and act upon a potential incident.
With security talent challenges and 3.5 million available security jobs, leveraging advanced tech automation and AI machine learning allows enterprises to find new ways to put security first with skill and velocity.
It’s time to embrace the transformational power of security to keep up with the demands of the modern world. To master hybrid cloud, you need to develop a unified security program that steers business initiatives, optimizes security resources and transforms your operating culture to be Security First.
Source: ibm.com
Posts
0 comments:
Post a Comment