The Cybersecurity Fortress: How to Optimize Layered Defenses

Digital business evolution has caused a widespread “extended enterprise” effect. Companies upgrading their digital infrastructure are now more reliant on decentralized, dispersed ecosystems to store and process large volumes of data.

Short-term cybersecurity measures like data hygiene, vulnerability management, backup testing, and crisis exercises are solid efforts but can only go so far. As cyber attacks evolve, security that addresses attacks at any point of your ecosystem becomes critical.

A layered, defense-in-depth approach can provide the all-around security needed to thwart attempts. By incorporating technology, relationship management, and forward planning, it offers comprehensive protection at every stage – from penetration to recovery.

Repel direct assault: layer the perimeter with “zero trust”

“Direct assault” targets your Identity and Access Management (IAM) setup. The most obvious route into your data ecosystem, direct attacks use stolen credentials and passwords to access privileged networks.

Traditional IAM measures based on usernames and passwords are vulnerable because they rely on a single point of authentication. Once an attacker has obtained credentials, it is easy to breach the security perimeter and wreak havoc from within.

A “zero trust” security model makes infiltration more difficult by forcing user authentication at multiple points within your ecosystem. Authentication credentials vary from stage to stage, and may change depending on user location and device used.

Maintaining authentication pressure at all times creates an omnipresent, shifting perimeter. When combined with central oversight of access attempts, it becomes challenging for attackers to attempt access without being detected. The prolonged time enables countermeasures to better identify and expel the attacker, giving theft victims ample time to report and alter stolen credentials.

All-around defense: secure third parties against indirect assault

Indirect assaults exploit less secure entry points among service vendors or in your cyber supply chain, with your ecosystem as the final objective. Cloud Service Providers (CSPs) storing and processing your data are also common targets for advanced techniques like relay attacks.

Emerging technologies, like confidential computing, can safeguard external data by conducting third-party processing in a secure enclave within your ecosystem. Leveraging your service providers’ processing capabilities within the safety of your layered security architecture can give you the best of both worlds.

You can augment this processing measure with strict and continuous internal review of third-party provider software verification codes. Due diligence and continuous evaluation can provide early warning of vendors at risk, allowing you to discuss and review mutual security arrangements.

It’s easy to assume third-party relationships are secure. But with the limited vision and control of an extended enterprise data ecosystem, their security must become yours too.

3. In event of a breach: deploy AI and automation for damage control and recovery

In the case of successful infiltration, speed of response is vital to minimize the damage from data loss. Creating contingencies for breaches is a critical part of the response process. Effective forward planning includes:

Many companies employ these ecosystem isolation measures for containment and recovery. But contingency responses are often unoptimized for speed.

Adopting AI and automation can enhance response speed and the learnings capture process, enabling swift adaptation to changing attack patterns. IT resources are also freed for high-value security work instead of run tasks AIs are better at.

Paired with backup systems and detailed recovery contingencies, the worst of the damage can be contained efficiently. Recovery can be accelerated further, reducing impacts on your business, organization, and customers.

As cyber attacks continue to gain speed and complexity, concentrating efforts using siloed defenses at fixed points is not enough. Effective cybersecurity is a team effort. It is imperative to connect your extended enterprise, create defensive depth, and plan for the worst.