Lately, I've been paying particular attention to the concept of having a cybersecurity portfolio. It's a view that looks at the need for enterprise-grade cybersecurity from a viewpoint akin to a savvy investment strategy: you want diversified investments, spread across a variety of assets to maximize your return. In the case of your finances, that might mean a healthy mix of higher risk investments along with consistently performing mutual funds. For cybersecurity, it means not putting all your proverbial eggs in the basket of prevention or detection, but having a balanced security spend that allows you to prevent, detect, respond, and remediate threats. The foundation of this idea is that there is no perfect perimeter security. Threats will get in and so you must have mechanisms to limit their reach and counteract them.
As I've pointed out throughout this series, central to the idea of the cybersecurity portfolio is the need for companies to know themselves. There's no one-size fits all portfolio that will be right for every business. Each business has different assets, in different places and infrastructures, and therefore, the way it protects those resources must be unique.
I'm not alone in thinking this. Illumio's approach to cybersecurity can be compared to the model employed by the Secret Service to protect the president, and in this piece, I want to show how a product like Illumio fits into the cybersecurity portfolio as a whole. I spoke with Nathaniel Gleicher, Illumio's Head of Cybersecurity Strategy, about his thoughts on cybersecurity and how the insight a product like Illumio provides can support a balanced cybersecurity portfolio.
My discussion with Gleicher focused less on the benefits of individual products, or on which aspect of the cybersecurity spectrum companies should devote more of their resources to, than on a larger philosophical question about the nature of quality security. Gleicher says that prior to pursuing any security strategy, companies should take a step back and do a meta-examination of what they need this strategy to produce. And that answer, in stark comparison to the individuality companies may need in the cybersecurity portfolio itself, should be the same for almost all businesses.
Nowhere in tech is the old adage of knowledge is power more pertinent than in relation to security. Threats thrive when companies have little transparency into their own operations, when intruders can move laterally from one system, or one network, to another, without being detected because the business lacks controls and the ability to see its technology in its entirety.
Illumio does extensive live application dependency mapping to show how all of the components (namely, the applications) of your business are connected. But perhaps the most important part of Illumio is that it delivers adaptive segmentation, which is a way to have high-level, simplified security policies in place that stop the lateral movement of threats and enable a quick response to remediate. This is what Gleicher means when he advocates that companies have understanding and control.
The basic idea governing Illumio's approach is to map the communications between applications in real time. Illumio's Policy Compute Engine identifies any instances where policies are violated and applications are communicating with one another that shouldn't be, and then allows you to secure them with their adaptive segmentation technology. But the goal is to have a policy engine that manages everything from granular to fine-grained policies, rather than the current manual process used with so many firewalls. There is simply no way for a human overseeing a firewall to process and analyze 15,000 or more rules. With Illumio, human oversight only has to account for 50 or so, then the policy compute engine manages the rest. This greatly aids in achieving the understanding that Gleicher so passionately calls for. Segmentation, or limiting what can communicate with what, then offers the type of control needed for strong internal and external security.
That is why Gleicher and I agree on one important aspect governing the entire cybersecurity portfolio discussion: you must have governing policies that lead to insight and transparency.
Thus, a product like Illumio can apply across several categories of cybersecurity I've outlined previously in the series. It isn't focused exclusively on detection, prevention, remediation, or recovery. The understanding into your company's security vulnerabilities and strengths enables you to then make better decisions across all these categories. As its name suggests, illumination is the key to quality cybersecurity; opacity feeds vulnerability. It's therefore essential to have the capacity to gain this understanding so that your spend across the rest of your profile can be as effective and targeted as possible.