Recent press coverage of Palantir, a $20 billion Silicon Valley data analysis firm being hacked in a test environment is not really news. The story, reported in BuzzFeed, How Hired Hackers Got “Complete Control” Of Palantir, detailed how Palantir hired a cybersecurity firm (Veris Group) to test its digital defenses. Veris Groups’ confidential report, obtained by BuzzFeed, shows how the pro hackers were able to dominate the tech company’s network including the discovery of gaping holes that left data about high profile customers exposed.
In fairness, the article also accurately pointed out that “Virtually every company is vulnerable to hacks, to varying degrees. In recent years, red teams generally have had a high success rate in getting deep inside of companies’ networks, and they virtually always find at least some security flaws, according to an industry source. That Palantir did a red team exercise shows that it wanted to identify and repair any such flaws. The Veris report notes multiple strengths in Palantir’s defenses, including an “excellent” response by its security staff.”
We applaud Palantir’s incident response capabilities as well as its willingness to examine its risk profile to better understand its vulnerabilities. I think we are all in agreement that tools-centric, conventional IT security is failing and that the current cyber security assessments and penetration testing practices only go so far. It’s not acceptable to know that hackers can get in, steal your assets, disrupt your business and not be able to prevent it. But there are new, proactive mitigation approaches emerging that are demonstrating great promise. In addition to an increasing emphasis on risk mitigation, software defined perimeter (SDP) is a new architecture and solution that is proving to be 100% effective in protecting critical infrastructure.
SDP is a connection-based and application-centric architecture built by proprietary security providers allowing a far more scalable approach. SDPs allow you to hide infrastructure by disallowing access to only those legitimate users. It is core to a new security and risk management paradigm that establishes an undetectable application infrastructure often referred to as a “Black Cloud.” The primary effect of the SDP is that it transforms the application infrastructure into an effectively invisible or “black cloud” that shows no domain name system (DNS) information or IP addresses.
SDP is being proven by early adopters such as Coca Cola, Google, Mazda and the DHS who have enormous financial and brand reputation interest in preventing and removing the risk of being impacted by DDoS attacks.
To learn more, check out our new white paper.