I recently spoke at the QTS IT Security & Compliance Forum (ISCF) in DC. Tim Brown, CTO of Dell Security, kicked off the event by releasing results of Dell’s annual survey of Federal IT managers that was covered in this GCN article — Feds’ trust in agency cybersecurity erodes.
As the headline stated, the main takeaway was that of 464 senior Federal IT workers surveyed only 8% were confident in their agency’s ability to protect information systems from cyber intrusions – down from 18% reported in the 2014 survey. There was also a similar drop in their confidence that their department could protect their personal information.
During that same period, Government continued to invest in a myriad of security tools and services ranging from incident response, firewalls and IDS, vulnerability scanning, forensics, etc. More recently, they have been investing in threat intelligence in an attempt to understand where the hacker is and how they are infiltrating our systems.
Yet, even with the increasing investments in security, hackers continue to get more sophisticated and continue to access and exploit the Feds systems at an increasing rate.
In my opinion, instead of reacting to what the hackers are doing, we need to focus more on what we are doing with security designs and architecture that protect from the inside out with an emphasis on mitigation and being more resilient to the ever changing threat landscape.
Today’s security tools and services operate at the network layer — they are all IP based and focus on how to block IPs from the outside in. A new and better way of thinking about this would be a solution that ensures every IP connection is verified and trusted in advance.
My presentation at the QTS ISCF introduced the Software Defined Perimeter (SDP) as a new approach based on established technology that been proven to stop all forms of network attacks including DDoS, Man-in-the-Middle, credential theft, as well as vulnerable code exploitation.
Without getting into the details, SDPs can be designed and deployed to protect individual applications or whole IT environments – and particularly those supporting critical infrastructure.
For more info, check out this white paper on the emergence of SDPs and feel free to reach out to me directly to learn more.
