Hackers aren’t getting any slower, and outdated infrastructures aren’t becoming more secure. To remain protected and fight back against malicious cyberattacks, we must rethink IT security as we know it. In this post, we’ll look at four aspects of cybersecurity that I believe we need to reevaluate.

What Next-Gen Security Looks Like

The crux of excellent cybersecurity is that it must constantly evolve to match the skills and strength of attackers. Cybercriminals are only getting faster and more powerful with time, so organizations’ cybersecurity systems need to do the same.

Traditionally, the problem with this has been that a team of IT professionals can’t implement meaningful changes fast enough to successfully deter hackers. And, even if they can, doing so will often take up an unnecessary amount of the company’s funds and resources. However, as the next generation of cybersecurity becomes a reality, such issues can become a thing of the past.

After all, hackers have created a high degree of automation in their tools, which allows them to attack multiple entities at the same time, carry out attacks at a rapid pace and, ultimately, drive more profit.

So, to adequately defend ourselves, we as companies must be able to respond at that same speed. In the next evolution of security, people will be able to use automated products to understand what new security measures are going to do and run scenarios to determine if those measures will negatively affect their business, all in the span of a few seconds rather than a few days.

In short, rapid automation is the future of cybersecurity.

Prevent, Don’t Pursue

With reports of devastating cyber-attacks surfacing on a regular basis, it can be tempting to believe that hackers are simply too fast, advanced and stealthy to be stopped. Because of this, some members of our industry think we should focus on finding attackers rather than preventing attacks in the first place.

However, doing so would be a critical mistake. That’s a loser’s strategy.

There are actions we should be taking, and technology we should be changing about our infrastructure that are probably less difficult than trying to find the adversary after they’ve broken in. It’s time to think about re-platforming certain parts of our environment to be more secure, so we don’t have to give up.

Effective cybersecurity isn’t about hunting down attackers. It’s about stopping them from infiltrating at all. To do that, we must reinforce our infrastructure from the inside out.

Secure by Design

Of all the many important aspects of your data center, from storage capacity to speed, security is arguably the most critical. That’s why you should design your infrastructure with security in mind. Doing so will result in security that’s delivered both invisibly and seamlessly.

However, that doesn’t mean you need to re-platform your whole environment, although for small organizations that may be a viable and perhaps preferred option.

What it does mean is that it’s worth considering re-platforming specific infrastructure within your environment for the sake of radically improving your organization’s security.

You don’t start with the whole data center. You start with the critical applications that matter, such as the applications that manage the data center or directly communicate with the outside world. Our system essentially builds security into the fabric of the environment where you run your applications.

If you have any doubts about the security of your current environment, just remember that nothing is foolproof. I often say, “Never tell a hacker they can’t do something, because they will prove you wrong.”

Thinking Ahead

The security of our infrastructure should be a top priority, not a last-minute consideration. However, that usually isn’t the case.

Throughout the course of our industry’s history, we’ve always bolted security onto the infrastructure that we’re using after the fact.

We rarely think about it beforehand and build it into a new platform.

Sadly, we continue to make this mistake with new platforms, even though we’ve seen time and again that security is much more effective when it’s designed into the architecture rather than a bolt-on afterthought. Every time we roll out a new platform, be it laptops, tablets, smartphones or the internet of things, the developers focus on the feature functionality, but in doing so, they forget to focus on how the platform is actually going to be used — or more importantly, misused.

Until implementing security on an architectural level becomes an industry norm, it’s up to the rest of us to try to solve the problem by building security into the infrastructure rather than treating it as a tacked-on accessory.

When it comes down to it, the future of cybersecurity has the potential to be bright, but it depends on what we do next as an industry. Do we embrace automation, focus on prevention and think proactively, or do we sit back and wait until the next attack?

The choice is ours.

If you liked this article then check out the Skyport Blog for more about the hybrid enterprise and cybersecurity.

About The Author

Art Gilliland is the CEO of Skyport Systems and a 15 year veteran of the security industry. You can connect with him on Twitter and LinkedIn.

Given that a significant number of confirmed data breaches involve weak, default or stolen passwords, it’s not hard to see why Active Directory (AD) is so essential to nearly every organization’s cyber security.

To illustrate AD’s importance, imagine the security “system” of a medieval city. Traditionally, a large, all-encompassing wall would be used to protect the city in its entirety, with guards posted at multiple checkpoints along the wall’s perimeter. However, while the wall itself may be strong, this sort of defense system harbors several weaknesses.

Its most apparent deficiency lies in its failure to account for the fact that, in the event of a breach, intruders will face no other obstacles once they’ve entered the city. And, as if that weren’t enough, it also fails to account for the actions of the city’s own residents.

For these reasons, it makes more sense to lock the doors of each of the city’s houses, rather than relying on a single line of defense. And, if one of those houses held the keys to the kingdom, wouldn’t that house call for an even sturdier set of locks?

As you may have already guessed, our medieval fortress’ wall is analogous to a traditional firewall, and the unlocked house inside it is analogous to AD. Since it contains the keys to the kingdom, AD is more than deserving of its own security system.

But, in too many organizations, traditional security practices such as standard firewalls are viewed as sufficient sources of protection, while AD is viewed as just another house.

Why Standard Practices Can Fall Short

Skyport Systems recently partnered with Redmond Magazine to conduct a survey of more than 300 IT professionals to gauge the effectiveness of organizations’ AD security measures. After analyzing the results of the survey, we made several key findings, which offer valuable insight into the current state of AD protection.

Overall, our medieval fortress analogy seems to be holding true. The survey revealed that nearly 40 percent of organizations neglect to employ a host-based firewall to protect their IT infrastructure. And, without a host-based firewall, an organization’s cyber security is dependent on the assumption that no internal or external factors will affect its strength.

The survey also found that over approximately 23 percent of organizations use privileged accounts to read email or browse the web, which can provide an easy way for attackers to circumvent the main firewall and go straight for the credentials they need.

So, while the perimeter of a city may seem secure, that doesn’t necessarily protect the houses inside it from intrusion.

A False Sense of Security

Another flaw of the medieval-stronghold model of defense is that it can lead to a false sense of security within the organizations that adopt it. Over half of the companies surveyed believed their AD to be “secure” or “very secure,” and approximately one-third believed their AD to be “moderately secure.” That leaves us with a mere 2.5 percent of companies who rated their AD as “not secure.”

Despite this, many respondents didn’t take additional steps to protect AD, regardless of the crucial credentials it holds. Forty-one percent did not allow only specific workstations to access domain controllers, about 70 percent did not require administrators to use multi-factor authentication and 86 percent did not practice whitelisting of admin workstations.

Altogether, this paints a picture of high confidence and low security. It’s unknown whether that confidence comes from unfounded certainty or from a general lack of AD security awareness, but either way, the result is the same.

Ultimately, it makes no difference to cyber criminals why an organization’s AD is left vulnerable, it just matters that the privileged credentials they’re after are easily accessible.

Our Own Findings

Although the results of Redmond Magazine’s survey are certainly compelling, they’re by no means the only evidence that organizations’ AD security is often lacking. Skyport Systems has conducted AD security assessments for a variety of companies over the past year, and we’ve made some meaningful discoveries:

• More than 50 percent of companies allow administrators to use the same account to configure AD as they use for everything else.
• Less than 10 percent have implemented secure administrative workstations (SAWs) for AD management.
• Fewer than 25 percent use multi-factor authentication for AD administrator accounts.
• A mere 15 percent use administrative whitelists to limit the systems that are permitted to alter the AD configuration.
• Almost none implement host-based firewalls to protect their domain controllers (DCs).
• A total of 0 percent have built an Enhanced Security Administrative Environment (ESAE), otherwise known as an isolated admin forest.

From these findings, we can be sure that the results of the Redmond Magazine survey did not reflect an anomaly. Unfortunately, most of the companies we assessed were also leaving AD far more vulnerable than they likely thought.

These vulnerabilities aren’t immune to common hacking techniques, either. If an unsecured administrative workstation is breached, a weak password is cracked or a domain controller is hacked, the criminal behind those attacks can gain access to administrator-level rights almost immediately.

And, once an attacker has obtained elevated rights, they can begin to impersonate administrators, exfiltrate information or access sensitive data.

How Secure is Your AD?

The bottom line is that too many companies are leaving AD open to malicious attacks, and you don’t want your company to be one of them. Even though AD is commonly perceived as nothing more than a utility, it in fact serves the critical purpose of housing the keys to your kingdom.

You might believe your AD to be secure but, as the survey results have shown, that doesn’t necessarily mean that it is.

To find out if your AD is truly protected, it’s best to get a professional AD assessmentbased on Microsoft’s recommendations. From there, your risk level can be accurately gauged and the appropriate precautionary measures can be put in place.

With these steps, you can start better securing your AD today. After all, it might just save your entire kingdom.

If you liked this article then check out the Skyport Blog for more about the hybrid enterprise and cybersecurity.

About The Author

Art Gilliland is the CEO of Skyport Systems and a 15 year veteran of the security industry. You can connect with him on Twitter and LinkedIn.

There is a lot of reflection on what we have accomplished and where we tried but didn’t succeed. Looking forward, I am most excited about the massive architectural changes going on in infrastructure as it adapts to business requirements.

Cloud computing has had a tremendous impact on what organizations expect from their environments. Those expectations will have a remarkable impact on what emerges and defines 2017 and beyond.

Here are my Top 5 predictions as to what to expect in IT infrastructure and security.

1. Lack of Qualified Technical Talent Will Change How You Work with Vendors

The continued lack of qualified IT and security talent will push IT organizations into a more “shared responsibility” operating model for their on-premises datacenter infrastructures.

Organizations continue to struggle to hire the skills they need to run and secure their infrastructure. The lack of resources challenges IT organizations to remain relevant and provide the speed and agility that their businesses demand.

More and more, organizations will turn to solutions that provide opportunity for IT to spend more of their effort on architecting business-relevant services, and less time on building and maintaining the core infrastructure platforms.

This will lead to an even greater adoption of cloud computing and SaaS service models where the IT focus can be on the solution outcome. New operating models for on-premise data centers will emerge based on cloud-managed infrastructure, allowing organizations to consume on-premise data centers without requiring the integration and maintenance of the underlying platforms.

2. Existing Security Tools Will Become Obsolete

The adoption of software-defined datacenter infrastructure eliminates the requirement for much of the existing security tools.

The continued use and consumption of converged and software-defined infrastructure will call into question why firewall, proxy and other host-based security tools are necessary. Organizations will be able to radically simplify their environment by adopting infrastructure that provides the visibility and control over applications and communications without needing to rely on separate tools and infrastructure.

3. Prepare for a Rise in the Commoditization of Compute, Storage and Virtualization

Significant commoditization will continue for not only compute and storage, but also virtualization within enterprise IT.

Organizations are already moving away from the VMware stranglehold with AWS, Azure and other virtualization platforms. The value will move away from the underlying virtualization and into the management process and experience of operating the infrastructure as organizations.

4. The “Cloud Everything” Pipe Dream Will Start to Dissipate

The “cloud everything” pipe dream gives way to a more practical implementation of hybrid environments.

Enterprises responding to the marketing hype around cloud computing will settle into more practical approaches for how to leverage the power of the cloud. Enterprises have learned the true costs of cloud computing, and discovered that it is not the cost savings that they expected.

However, there is still significant value for certain types of workloads. In particular, experimentation in the cloud is much more cost-effective as the requirement for capacity planning and the fixed costs of failure are much less.

In 2017, organizations will continue to increase their consumption of cloud, but will step away from a cloud-only model to a more balanced approach in leveraging cloud computing for the workloads and projects where it makes the most sense, consuming SaaS services where applicable and investing in their own data centers.

5. Get Ready for Private Cloud Version 2

The initial private cloud projects have largely failed. This year will bring more experimental investments into private cloud V2 based on converged systems.

The intense requirements for IT organizations to build, integrate and manage all the elements of the private cloud infrastructure have significantly contributed to the failure of most private cloud projects.

Many organizations will either revert to running their infrastructure as they always have with incumbent virtualization vendors, or they will begin to invest in more fully integrated platforms from the newer converged systems vendors.

Success in these projects will depend heavily on how much of the management layer integrations and capabilities can be delivered without requiring specific expertise. Solutions that have full integration across server, storage, virtualization and security will provide a more viable solution for the private cloud V2 projects.

In summary, the expectations of ease of adoption, ease of use and ease of management that have been set forth by cloud computing will continue to set the experience bar for internal IT teams.

This pressure combined with the lack of resources will drive the desire for pre-configured, easy-to-use and scalable platforms that in many ways will change the face of the data center. Building these private clouds has not been easy. Expect new technologies from incumbent and new vendors to rush to fill the gap of the existing environments.

If you liked this article then check out the Skyport Blog for more about the hybrid enterprise and cybersecurity.

About The Author

Art Gilliland is the CEO of Skyport Systems and a 15 year veteran of the security industry. You can connect with him on Twitter and LinkedIn.

With all of the talk these days about how much security has changed, you’d think something extraordinary has happened.

I’ve worked in the security industry for 16 years. Way back in 2000, we were already past the initial viruses that created the industry for companies like Symantec and McAfee. There were also a lot of virus writers pursuing underground fame. That changed, and more hackers then worked to steal.

While the bad guys’ intent evolved, what they attacked and how they attacked stayed relatively similar. In fact, recent reports by Verizon, HP and others about exploited vulnerabilities highlights that the approaches taken by the bad guys don’t need to change because the environments they attack don’t change. There is plenty of innovation going on, but for the vast majority of attacks, they still use the same old stuff.

What has radically changed is who cares about security. When I started, it was the proverbial “guy in the basement,” typically a network engineer or ex-auditor charged with security. Now, almost every organization has a chief information security officer (CISO). And, the CIOs, CEOs and boards of directors care and ask about security, too.

Cybersecurity Ventures predicts the world will spend $1 trillion cumulatively on cybersecurity products and services over the next 5 years from 2017 to 2021. One recurring question is: “Why am I spending so much more money on security, but the results don’t get any better?”

This question is strikingly simple, but fundamental to how enterprises invest and manage risk. It all boils down to two fundamental issues. First, the bad guys have an important advantage that we cannot overcome easily — if at all. Second, the technical approach and architecture to protect enterprise environments is fundamentally flawed, error prone, wastes scarce resources and will not work in our new IT reality.

The Bad Guy Advantage

So what is the bad guy advantage? It’s simple. They are running amid a criminal economy where participants buy and sell services. They are highly motivated to make money. They operate as profit centers. All investments made increase their returns. They invest heavily in tools, automation and skills. As profits pour in, innovation and investment only increases.

Also, they can fail and fail and fail, but if they succeed just once, they win. They also have a low risk of failure. They work from homes and offices far from danger, often in countries where it’s difficult, if not impossible, to initiate legal proceedings.

In contrast, the teams that defend the organization are cost centers. They face tight budgets, an ever-expanding number of projects and new work areas and must make tough choices: continue to fund existing programs or invest in new technologies. Many projects that need to get done never get done, whether it be for lack of money or lack of talent.

We also make it hard on ourselves. We document the frameworks we follow to protect ourselves. We publish the models as standards and follow and audit ourselves against them. These standards, like ISO 270001 or NIST Cyber Security Framework, provide the adversary a clear guideline to the approach that we will take.

We also list our priorities annually through surveys. So, we not only give adversaries the map to what we think we need to do, we also tell them how far we’ve gone and what we still need to accomplish.

Even though the economics favor the adversary, we still have the advantage of knowing our environment better. This should give us the ability to build great defenses. Sadly, we typically do not leverage this advantage.

That is because our security architecture is flawed. Over the last decade, the way in which organizations consume and deliver services has massively changed. Cloud, mobile and social radically changed how our infrastructure operates. Still, our security approach is essentially the same as it was 25 years ago.

Architecturally, we build walls at the perimeter and post guards (agents) inside the applications. The challenge is that many of our systems don’t live within our walls anymore and agents are as vulnerable as the applications; they also consume the same resources that applications need to perform. As a result, security suffers.

The Failing Perimeter

In the past decade, there have been many statements that the perimeter will disappear. Yet firewalls and firewall companies continue to grow. Why? Perimeter-based controls are powerful. They implement the right kind of security that is enforced outside and away from the application that you are trying to protect.

This means that enforcement doesn’t consume the same resources that power the workload. Also, any vulnerability in the operating, system or underlying technology hosting the workload doesn’t impact the protection.

Even so, the network perimeter is failing to protect the organization from breach. It fails because organizations often open the edge to cloud, mobile and third-party vendors, and so that strong protection is not always where you need it.

The perimeter is also constantly shifting to accommodate changing internal requirements. This creates complexity and opportunity for administrators to make a mistake. It is no accident that misconfiguration and errors is one of the largest contributors to breaches.

The sad truth is that perimeter security is powerful, but organizations cannot deliver it effectively because they are focused on solving for the needs of the whole enterprise.

The Agent Trade-Off

One approach to delivering security for any one workload or system is to deliver it with an agent or small software application that runs on or in the same environment that is being protected.

The benefit of this approach is that the protection follows the environment and it can be configured to the needed and appropriate level of protection. This has benefits over traditional perimeter-based approaches. It also has serious flaws.

There are two primary challenges with agent-based approaches.

1. First, the agent is as vulnerable as the application. As I mentioned earlier, the agent often runs within the environment it protects. So, if a system is compromised and the attacker achieves the privileges of an administrator, the attacker can simply turn off the protections. Also, if attackers get below the system with hardware-centric attacks or attacks like “rootkits,” which run below the operating system, the system will just “lie” and say everything is good even when it is not.
2. The second challenge with agent approaches, and arguably the more significant, is that agents share resources with the system they are designed to protect. While some sophisticated attacks use this resource sharing as a way to compromise systems, that is not the primary challenge. The primary challenge is operational. As agents become more sophisticated to process needed information, they slow down the systems. This typically results in users disabling the protections they need. In some cases, failures or conflicts of the agent can crash the entire system. This creates a lot of resistance internally to agent-based technologies, especially since many of them will be deployed to provide the required level of management and security.

What Needs to Change?

The adversary is professional. Our architecture is not designed for the way in which we run and manage our environments today. So, what do we do? There are no cure-all solutions. Anyone who tells you different is lying or delusional. But by implementing the following five approaches, you’ll significantly improve your chances.

1. Build a security program focused on adversary disruption. To do this, you need to think like your adversary and focus on the process they use to attack and breach an organization. In security circles, we call this process the “Kill Chain.” It enumerates the steps that an attacker follows to steal or damage an asset.
2. Protection for services in and from the cloud need identity-based perimeters. As more organizations consume services or infrastructure from SaaS and cloud providers, the need for a different security model becomes important. The most interesting architecture for solving this challenge is the advent of what Gartner calls the Cloud Access Broker. They are essentially gateways that implement policies on interactions between users and the cloud. The trick that they have to solve is that they need all users — not some or most, but all — to route through their policy engines. There is a way to address this challenge, and we talk about it more in our latest ebook.
3. Protections for services in and from “on-premises” need individual trust zones. While many workloads are moving to the cloud, others will continue to be managed and owned by the enterprise. For these workloads, the most promising new architectural approach is in the creation of individual security perimeters around each and every workload in the data center. This approach is often referred to as micro-segmentation and represents the separation of the network trust zones into units of a single zone of trust for each and every application or workload.
4. Make alerts and analytics simple and easy — or outsource. The adversary is patient, talented and will find a way in. After they do, you need to find them fast. Building and monitoring alert systems will help. There are also interesting “honey-pot” technologies that can help make searching for adversaries easier. The biggest goal is to create a system that doesn’t need constant tuning or management. Don’t waste your time or money on technologies that are only going to tell you to do more work. Invest in basic alerting and work with partners to ensure it continues to operate effectively.
5. Encrypt without breaking stuff. Stopping the adversary is goal one. However, if they steal stuff, wouldn’t it be nice if the information was rendered useless, so it can’t be monetized? Broad use of encryption is needed. The trick is understanding what to encrypt and how to do it, especially since much data lives in applications we don’t own in the cloud. Start with the stuff that really matters and work from there. It is not necessary to encrypt everything at once. Second, find technologies that can encrypt data without breaking applications. Approaches like tokenization and format-preserving encryption can protect without breaking the existing environment.

A Changed World

The way in which organizations deliver and consume services has changed. It is now based on a blending of cloud and on-premises services. This hybrid looks radically different than organizations of the past, but yet we build and defend our environments with much the same approach.

The adversary has adapted to this new environment and now we also need to change. Organizations that do will be more secure. The goal is reducing risk. In some cases, all that is required is being faster and/or better than the bad guys.

For more detail on what needs to change, download our ebook: “The IT Security Spend Dilemma: More Isn’t Always Better.”

If you liked this article then check out the Skyport Blog for more about the hybrid enterprise and cybersecurity.

About The Author

Art Gilliland is the CEO of Skyport Systems and a 15 year veteran of the security industry. You can connect with him on Twitter and LinkedIn.

Congratulations to the crew at Nutanix, who hit the public markets in a successful IPO. I hope this marks the beginning of a tech-IPO revival. What it definitely demonstrates is that organizations are investing heavily in their hybrid enterprise infrastructure. It also highlights the huge role converged systems will have on the data centers that companies will continue to build.

Excitement continues to build regarding the growth of cloud computing, and it should.

This IPO, however, underscores that the market for technology in the data center also remains robust. The difference is that companies want infrastructure solutions that are easier to manage and integrate. They want to focus less on building and managing the underlying systems so they can instead focus more on running and operating the valuable applications. The hyper-converged market — bringing networking, storage and computing together — is the new wave of this tightly integrated stack that helps organizations quickly deploy and deliver their services.

So what is the next step?

We believe there are four parts that must be integrated and work in concert to deliver the infrastructure that organizations need. They are compute, networking, storage AND security. As it occurs with most exciting new platforms, the early converged entrants focused more on functionality and forgot the security. That has proven to be a painful choice for their customers.

Skyport Systems built infrastructure with security at its core to provide a safe environment to run the most important and often most vulnerable systems. We are committed to delivering secure infrastructure for your hybrid enterprise. As security captivates the minds of CIOs, CEOs and boards of directors, now is the time to invest in building security into the fabric of your infrastructure. Hyper-converged products will help to make it easier for companies to more quickly deliver services. Skyport Systems has now made it safer, too.

If you liked this article then check out the Skyport Blog for more about the hybrid enterprise and cybersecurity.

About The Author

Art Gilliland is the CEO of Skyport Systems and a 15 year veteran of the security industry. You can connect with him on Twitter and LinkedIn.