Taking the Offensive Approach in 2021 – Security Ramifications

The bumpy road of 2020 has led to a much-changed business and technical environment as we enter 2021.  While the path has been rough, new insights and initiatives are creating opportunities for savings, improved security, better work-life balance for employees, and in general, improved prospects for organizations that transform thoughtfully.

Recently, Susan Bowen, the CEO at Aptum Technologies, brought together a panel of executives who have been living and informing these transformations, and we had a great discussion that can be viewed here.  I wanted to highlight both the security topics, and the security ramifications, of our discussion.

Employee Relationships are Changing

Whether we are talking about work hours, collaborative meetings moved to video, productivity in a home environment, or just blowing off steam, the increased prevalence and necessity of working from home is having a meaningful effect on our employees. As leaders and technologists, we need to understand that this isn’t just a situation where people are doing their jobs from different places. The actual effort, from job description to working hours, is very different due to the lack of face-to-face communications, common areas, and group discussions.

Existing pre-pandemic security practices did not evolve to facilitate this remarkably granular, heterogeneous, and dynamic environment. As a result, there are new risks created by shared devices, insecure home networks, and the steady leakage of company confidential information to systems and locations where the security is less well-understood. New security friction is creating heat among employees as well. Multiple authentication mechanisms, restricted access to formerly internal services, and migration to new services for sharing data and communications are all in process. As security practitioners, we need to look for ways to decrease this friction and frustration in the daily lives of our employees. The transforming technologies of cloud-based services are helping, as they organically deliver the type of protected and location-insensitive service enablement that can abstract away the underlying complexity of successfully engaging remotely.

Acceleration is a Common Theme

At the start of 2020, most client companies of all of the panelists had begun planning and executing a strategy of cloud-driven transformation. As the year passed and remote work became a necessity because of fears of infection or government action, these plans took on a new urgency, and we all saw powerful acceleration in cloud-based services to maintain productivity. The goal was to move the existing operations to a more virtual, remote-enabled, implementation.

After this initial push, though, we’re seeing acceleration of more strategic initiatives. A great example comes from a healthcare organization I was speaking with in December. A forward-looking CIO had plans to increase virtual desktop use and remote collaboration at the start of 2020 to improve remote healthcare, better support healthcare workers servicing multiple facilities, and decrease costs associated with the acquisition and integration of smaller healthcare provider practices. As the pandemic took hold early in 2020, this CIO simply increased the tempo and training of his move to a more virtual infrastructure, and when we spoke at the end of the year, the provider had seen measurable improvements in productivity and decreases in costs associated with security because those motions were already in place.

These environmental and platform changes carry with them a new set of requirements, for security, for rapid implementation, and for management. As a result, we are all seeing an increasing demand for service provider involvement. Recruiting sufficient new staff to support cloud migration, security, or integration, is a challenge because of skill gaps, scarcity, timelines, and cost. As a result, organizations are identifying opportunities for improved security and savings by leveraging expert service providers in these spaces. We panelists, coming from providers like Aptum,  Claremont, and Alert Logic, are all finding ourselves offering advice, experience, and services to clients and a market driven by a need for plans that facilitate rapid, reliable, progress.

Security is a Core Competency

Fortunately, many of the 2020 transformation plans, especially those created with the help of expert providers, included considerations of security. Unlike earlier rapid technical migrations (think Internet circa 1995-2000) requirements for security are clearer. The planning for 2021 includes elements of securing architectures, respecting the cloud’s shared responsibility model for security, and consideration of the need for consistent monitoring and response capabilities.

Beyond the increased distribution of workloads and teams, the new environment is accelerating the deperimeterization of organizational security. Whether we consider employee access or partner transactions, there is a new granularity of security that directly connects individuals and organizations to the data and services they need, without much consideration for corporate boundaries. This is creating a robust system of access that is highly data-centric, and one that is more flexible and responsive to changing offerings, partners, and customer needs.

It’s Just “Normal”

We find ourselves using the phrase “new normal” frequently, but after a year of this, it’s probably time to think of this environment as just normal. With collaboration and the insights of partners who are seeing these challenges across hundreds or thousands of customers, we need to set our sights on the opportunities ahead, and not see these changes as perturbations that will settle back to the environments of 2019.

The change to location-independent, deperimeterized, security has been coming for a decade.  The topology of our internetworking hasn’t faintly resembled the geographic topology of our organizations in that time, and the cloud has further democratized access to almost all of it.

The experts on this panel reinforced the unexpected benefits of this migration in creating a more flexible, more distributed, more reliable, and more secure, environment.

Jack Danahy applies nearly 30 years of security experience to the advancement of managed detection and response (MDR), most recently as the Senior Vice President, Business Development and Chief Evangelist at Alert Logic.