Secure Your Network from Modern Hazards

This article originally appeared on DARKReading.

Traditional security measures don’t stand a chance in a data-centric world. But within the crisis lie opportunities for IT security pros.

Rather than focusing on the containers, CISOs and IT pros must take a more data-centric approach with an emphasis on data encryption, both at rest and in transit. To achieve security in a world of mobile and dynamic data, encryption must be ubiquitous, automatic, and on by default. Ubiquitous encryption at scale is hard to do, but it can be done. And if done well, it can render data irrelevant if breached. One way to attain broad data encryption is to institute corporate-wide policies that say data can never be in the clear when it is in rest or in motion and to standardize on a commercial key management system.

Third parties: The weakest link might not be yours

As data moves between devices and users and finally comes to rest, it might not end up on your own infrastructure. Rather, the data might end up in a cloud server or in an online backup service, file share, collaboration software, workgroup server, or partner database. Most likely it’s in all of the above.

CISOs increasingly rely on partners for data processing and data storage, whether in the form of cloud providers or more traditional data processors and colocation facilities. Few companies operate without some footprint on Amazon’s Cloud, Salesforce’s CRM, or smaller SaaS players. Third parties represent a risk vector and companies must evaluate the risk of offloading data to a third party. There are new services available from vendors such as BitSight, Mandiant, and Terremark that offer independent metrics and scoring services for third-party risk.

You can prepare for the risks of moving data or processes to third parties by cataloguing all the third parties that store your data, requesting a security audit, and implementing encryption algorithms so that the data is not stored in the clear.

The information security market is in a perfect storm, but I see tremendous opportunity in this crisis. After all, every cloud has a silver lining.