Five fundamentals for effective security design

As organizations continue to accelerate their digital innovation initiatives with an effective security design, new network edges are also introduced to their security infrastructure – from data center, LAN, SASE and more. The network continues to expand and splinter the perimeter, allowing new attack vectors to present opportunities for cyber criminals.

Many organizations have accumulated a wide variety of isolated security tools designed to monitor a specific function or protect one segment of the network in isolation. Some of these new environments are essential solutions to urgent business needs, others are often over-trusted and fly under the radar. Given the rate of innovation, there is rarely enough time to make them part of a cohesive or comprehensive security strategy. Nearly 80% of organizations are introducing innovations faster than their ability to secure them against cyberattacks. When security is deployed so rapidly, the aftermath is a complex network with limited visibility and control.

Creating an Effective Security Design

Cyber criminals are always searching for new ways to bypass security controls, infiltrate networks, and achieve their objectives. Their attacks have grown in sophistication, aiming to attack different network edges simultaneously to obscure their attack methods and identify the most easily exploited link in the security chain. Distributed networks that rely on traditionally isolated point products can’t see or defend against these threats. The clear challenge is that the disconnected and isolated security tools put in place to secure rapidly expanding and multiplying network edges don’t work together. This disconnection creates security and performance gaps that make it impossible to see and respond with speed and effectiveness to sophisticated and distributed attack sequences.

Five Fundamentals for Effective Security Design

The approach to network security needs to evolve. Here are five fundamental principles and practices that every organization needs to consider to get in front of and stay ahead of their current security challenges:

1. A unified security framework is essential to establish and maintain control over every edge. It must be able to span the distributed and evolving network to detect threats, correlate data, and seamlessly enforce policy. This isn’t about selecting a single vendor, rather about choosing the right vendors. Priority needs to be given to those vendors that leverage application programming interfaces (APIs) and common standards to support interoperability—especially those that allow policy decisions to be made outside of their solution.

2. Deployed security solutions also need to have access to common datasets across all network edges, endpoints, and clouds, enriched with real-time global and community threat intelligence shared from every area of the organization. This common intelligence framework enables holistic analysis of the state of security and performance, identifies emerging threats, and enables unified response across the organization.

3. An integrated security framework needs to support and enable advanced data analysis, combined with the ability to automatically create new protections across the full attack cycle when those analytics detect previously unknown threats. This system should also be able to function autonomously within simpler environments and be linked to extended detection and response (XDR), security information and event management (SIEM), and security orchestration, automation, and response (SOAR) solutions for increasingly advanced network operations center (NOC) and security operations center (SOC) environments.

4. This security framework needs to be able to rapidly launch a coordinated threat response across the entire ecosystem the moment a threat is detected. This breaks the attack sequence before its objectives can be realized. Leveraging machine learning (ML) and artificial intelligence (AI) tied to dynamically generated playbooks makes this possible without introducing slowdowns or human error.

5. Because change is the only constant in today’s digital world, a security framework needs to be dynamic, meaning that it must be designed to scale up and out as the network it is securing evolves and adapts. This requires deep integration between security and the network components and functions so organizations can continually innovate and expand networking and operations ecosystems without a lag in protections.

A Fabric-based Security Strategy Relies on Integration

For organizations to have an effective security design in today’s increasingly complex and ever-evolving network, security needs to be effective in providing broad visibility and control. Reducing complexity is the first step in achieving that. Only then can advanced analytics, threat correlation, dynamic adaptability, and integrated threat response be possible. Those functions, combined with the ability to be deployed broadly, deep integration and convergence between security tools and between security and the network, and dynamic automation augmented by AI, are the hallmarks of any security system capable of defending today’s dynamic networks and connected ecosystems.

The author is Regional Vice President, India & SAARC, Fortinet