Security Weekly Webcast: The challenge in securing data has increased in complexity as businesses move aggressively to cloud and modernize IT through the use of SaaS applications. In this virtual training, Paul Asadoorian of Security Weekly and SecureCircle will walk through how both legacy approaches, such as DLP, and modern approaches, such as CASB, struggle to plug the real world security holes that are required to meet a zero trust security model.As part of this training, the SecureCircle team will go deep into the different data security techniques and how zero trust requires more comprehensive protection that keeps data protected by default, not by exception.
The future holds endless possibilities. The next great moment, widget or experience is just around the corner. In cybersecurity, we have heard promises for a better future for decades. Different product categories have come (and, in some cases, gone). Many products were merely features and not a solution to a fundamental problem.
Marketing campaigns paint a picture that one solution fixes all your problems. The reality is there is no magic solution. One product isn't going to protect against phishing, malware, ransomware, lost or stolen devices, accidental sharing, malicious insiders, misconfigured permissions and secure collaboration.
What the industry has been aiming for is a zero-trust solution. To implement zero trust, you need to have control over authentication, network, device and data. Today you can achieve control over authentication, device and network, but there is no control over data.
Once a user authenticates their identity, device and network, how do organizations protect data the user downloads from their SaaS solutions, like finance, human resources, sales or even software source code? Organizations need to add control over their data to achieve zero trust.
Authentication occurs over many protocols, but one of the most popular today is security assertion markup language (SAML). SAML centralizes identity and access management across cloud and endpoint. Identification must be managed centrally for all access control. Managing multiple authentication systems leads to data breaches, such as misconfigured authentication to cloud applications.
Achieve device control via mobile device management (MDM) and endpoint detection and response (EDR). MDM enforces that endpoints have a proper security posture, ensuring EDR and DASB installation. Administer the posture before the device gains access to cloud solutions such as Salesforce, Workday, GitHub or QuickBooks. Without a standard baseline security posture, a computer that downloads sensitive data may be at risk or may already be compromised. EDR will maintain security on the device and protects for malware, antivirus, key loggers and suspicious insider behavior. EDR can automatically monitor and disable suspicious devices and block the device and user from accessing any sensitive data based on historical usage profiles. An EDR is not looking for a specific risk signature but is looking for suspicious or unexpected behavior.
Transport layer security (TLS) ensures network control. TLS has replaced the secure sockets layer (SSL). The combination of MDM and SAML can ensure a device is connecting from a secure network location before accessing sensitive cloud data.
Read the full article here
Security that follows the data is the only solution. Companies need to enable their teams to work from any location across the world, including work from home. Remote distributed workforces have grown 44% over the last 5 years, enabling access to specialized talent, reduced office overhead, flexible freelance-based staff, and of course an increased ability to adapt to unforeseen world events.
Enabling remote work requires security diligence. The risk of a data breach within an enterprise is already high - add to this the potential of data leaking onto remote workers’ personal devices, cloud applications, and public shares, and your risk is amplified exponentially. Supporting remote work also requires additional layers of compliance, typically to show data is protected by default and tracked and audited at all times.
Search “securing remote workforce” on Google and you will find lots of articles preaching traditional security best practices: have remote workers log in via virtual private network (VPN), ship secure devices to remote workers, classify all your data and set up data loss prevention (DLP) to monitor and block data sharing, set up a cloud security access broker (CASB) to restrict access to non-sanctioned cloud applications, etc. Some of these measures are important, some offer partial protection, and some are a significant impediment to worker productivity.
Why are remote workforce security measures insufficient?
Most data protection tools focus on putting up walls around the data, rather than protecting the data itself. Unfortunately, each solution that puts up walls, such as a DLP, is very complex and error-prone. There are just too many possibilities where the security team can fail to configure some aspect of the technology appropriately and leave a gap, especially in today’s continually changing landscape where sharing and collaboration tools that focus on productivity are far ahead of legacy security tools. There are just too many possibilities of the data being misclassified, where DLP incorrectly allows the data to pass unfettered.
Traditional security measures can also be insufficient if they don’t scale. For example, in the case of a significant weather event or pandemic, a remote workforce may put too much strain on the corporate VPN.
Why does remote security reduce productivity?
Given all the potential protection gaps in data protection, as the remote workforce increases, the risks increase. The security team starts to add more heavy-handed DLP rules, forcing staff to use a very narrow set of applications and workflows and slows down from false positives. Many will attempt to lock down a remote workers’ experience entirely with virtual desktop infrastructure (VDI). VDI can be very secure, but it comes at considerable cost in the form of usability and productivity. As staff feels increasingly pressured to get their jobs done despite all of these blockers, they increasingly find workarounds, literally undoing the security team’s work. This leads to a vicious cycle, a downward spiral of security gaps and productivity drains.
The solution is data-centric protection.
The only way to break the vicious cycle of insufficient security and hampered productivity is to shift the data protection strategy from attempting to secure every possible endpoint to securing the data itself, by default.
The Data Access Security Broker (DASB) platform provides data-centric protection. With DASB, any data is automatically protected by default, and this protection is persistent no matter where the data goes or how it is accessed. Moreover, once DASB is implemented in the enterprise, it automatically protects any other similar data it comes in contact with, expansively extending DASB’s protection to any new and existing data in the enterprise automatically.
Most importantly, DASB requires no changes to the user experience. Employees, no matter where they are working from, use the applications they want, in the way they want, with no plug-ins, pop-ups or special viewers. Unlike other attempts at remote security such as VDI, DLP, orDigital Rights Management (DRM) that force constrained workflows and put unfair limits on file types, applications, and versions, end-users are not even aware that DASB is protecting data behind the scenes unless they attempt to violate business policy.
The organization has persistent access control even in the event that data leaks onto an unauthorized device or cloud, or into the wrong hands. DASB tracks every action taken on protected data and reports it to your Security Information and Event Management (SIEM), turning every action into an auditable event.
When data is protected by default and stays protected and audited wherever it goes, even if it leaks into the wrong hands, it stops the vicious cycle of insufficient security and reduced productivity. Companies can finally get off the hamster wheel of constantly trying to discover and classify new data, and constantly trying to find and plug vulnerabilities in your remote security infrastructure. And only then, when thousands of remote workers are accessing data daily from their personal devices and cloud applications, the CISO remains confident that data is airtight.
A publicly traded Cyber Security Company (CSC) located in Silicon Valley, with 50+ in-house software developers and 100+ contract developers from several 3rd party consulting firms. CSC is also a Gartner Magic Quadrant leader, with over 3,000 customers in more than 80 countries.
CSC needed to ensure that their source code was not stolen or lost. A costly virtual desktop infrastructure (VDI) solution, was implemented to prevent misuse and add accountability for developers working with source code. This was met with resistance from their developers. They were extremely limited by VDI. Developers struggled with simple tasks like copying/pasting, taking screenshots, and collaborating. Despite employing VDI and other defense in depth strategies, source code was still lost. The scale of misuse is still unknown.
See how SecureCircle's DASB was able to solve this customers issue.
Browse our blog to see what our experts are talking about, and for insights on the latest cyber security trends impacting your business.