In the last article from this cyber strategy and innovation duo, Nicolas Chaillan and Israel Martinez revealed that the Petya/NotPetya cyber-attack was designed to destroy data and create disruption, how it was disguised as ransomware, and how it represents an inflection point toward more effective cyber-attacks in the future.
This is a sequel in a series of articles about practical steps that CIOs and CISOs can take to better secure their environments. Israel Martinez, Chairman for the Global Manufacturing ISAO and CEO for Axon Global, has been working with government leadership, including Nicolas Chaillan, the Chief Architect for Cyber.gov at the U.S. Department of Homeland Security, Fortune 500 companies, and select leadership at HMG Strategy to address this problem from a new perspective.
“Traditional cyber security methods such as perimeter security are now obsolete,” said Martinez. “In fact, many believe security on the current DNS architecture is no longer sustainable, including for government or the private sector. Therefore, new tactics and strategies must prevail.”
In a separate publication, “Traditional Perimeter controls are dying. Time to move to Software Defined Perimeters,” Chaillan discusses the mass migration to the cloud and the evolution of new technologies as reasons businesses can no longer focus solely on protecting what is contained within its walls.
Here are some new approaches to consider:
Software Defined Perimeter (SDP)
Software Defined Perimeter is becoming the enterprise’s best solution to securing on-premise, mobile and cloud-based systems, even for organizations with legacy based systems.
These solutions are provided by the likes of Google, Cryptzone, and Vidder. SDP fulfills the NIST Cybersecurity Framework and SEC recommendations regarding network segmentation and ensures that all endpoints attempting to access a given infrastructure are authenticated and authorized prior to gaining access to any resource on the network.
SDP provides unique advantages, including:
- Role-based access rules that are granular, granting access to specific systems and enforcing “Need to Know,” “Least Privilege” and validating usage heuristics.
- Verification of a device’s state, including antivirus/malware, OS fingerprinting, and vulnerability scans before granting access.
- Protection of any system including legacy, cloud and mobile systems.
- Enforcement of strong authentication, with several multi-factor authentication options supported.
- Enforcement of proper patching by assessing patch levels before granting access to resources.
- Protection against DDoS and vulnerability scans by leveraging the “Dark Cloud” concept.
SDP also uses a mutual Transport Layer Security (TLS) protocol and Single Packet Authorization (SPA), making it more secure, lower cost and light weight than traditional VPNs.
"Scheduled as part of the DHS S&T Cyber.gov program is a publication, “Network Segmentation,” which details how to migrate to SDP through the right processes,” said Chaillan."
Combined with data encryption (in motion and at rest), Martinez believes the strategies in this publication will be the keys to success. “Nicolas’ leadership and the passion of his team to articulate practical and effective cyber security strategy has been outstanding,” said Martinez. “For example, they also created baseline requirements in a forthcoming Cyber.gov publication which will detail requirements for selecting SDP vendors.”
Included in the publications will be tactics that help small-to-medium-sized enterprises (SMEs) as well, such as leveraging whitelisting, both on the application and the network side. Cyber.gov will also be providing requirements for application whitelisting, application isolation, network segmentation solutions, and more. Practical playbooks that help protect large enterprises as well as SMEs that typically cannot afford cyber security resources will be key to protecting the mid-market and critical infrastructure.
Look to future articles as we explore other strategies and innovation.
Israel Martinez is a member of the HMG Strategy Network and Chairman, Global Manufacturing ISAO & CEO, Axon Global, and a contracted member partnered with the U.S. Department of Homeland Security, “enhancing the protection of critical infrastructure and government networks and systems that are vital to national security and the nation’s economy,” as well as in the private sector.
Nicolas Chaillan is the Chief Architect for Cyber.gov at the U.S. Department of Homeland Security (DHS). Cyber.gov is the DHS Science & Technology (S&T) program that is designing the new cyber security architecture for the civilian.gov agencies. Chaillan is also a serial entrepreneur, software innovator and investor. With more than 17 years of experience, Chaillan has sold over 180 products to more than 40 Fortune 500 companies.
(Opinions expressed are personal to Martinez and Chaillan as individuals)