Cyber Defense eMagazine March Edition for 2022

pandemic era. By empowering professionals with the tools needed to automate the mundane, we free
them to become more effective threat hunters.
Once the basics are in place, organizations will be better placed to meet regulation and compliance
obligations. Policies alone will not allow you to prepare the reports required by auditors. And good
intentions will not satisfy the strict requirements of standards such as PCI-DSS. The good news is cloudservice
providers and other vendors are beginning to provide controls such as MFA and DNS security,
and are even offering training sessions for end users to prepare them for the hybrid-work future.
But chasing the regulators in a constantly reactive mode makes for poor security strategy. There is no
substitute for gaining a deep and broad understanding of your organization’s environment and selecting
the visualization and automation tools that best fit your circumstances, your architecture, and your
business goals. Getting the basics in place – asset inventory, vulnerability management, and user
awareness – will give you a strong foundation to secure your digital estate.
What next?
Once you have mastered your environment, you can turn your attention to some of the latest policies and
tools that are being deployed against cybercriminals. Many of the headline-grabbing incidents that we
have seen would not have occurred but for a lapse in the management of privileged credentials.
SolarWinds’ Orion, for example, uses privileged access to connect to other systems, which is how
attackers were able to compromise so many other organizations. Privileged access management (PAM)
is an emerging technique that allows CISOs and their teams to stipulate how accounts connect to
environments, using policies such as session monitoring, password rotation, least privilege, just-in-time
provisioning, and the elimination of shared accounts to keep estates safe while avoiding hits on employee
productivity.
Other practices include Zero Trust, which has become something of a hot topic. Allowing everything in,
and assuming all processes to be suspect until they can prove themselves otherwise, is an approach that
shows how far removed we are from the recent past. Here, we not only assume we are going to be
attacked; we assume we already have been. It is a grim yet justifiable assumption that accurately reflects
the world in which we now live.
Do not dismay, however. The headlines of horror may imply an inevitability in becoming a cyber-victim,
but their postmortems also show a path to risk remediation. There are tools you can procure, policies you
can enact, and action you can take that will ensure that your organization’s name is not the next to be
splashed across media pages.
Cyber Defense eMagazine – March 2022 Edition 41
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.