In implementing zero-trust strategies, companies are losing visibility into the applications they need to protect. Observability restores the balance between security and efficiency.
By Fernando Castanheira, Chief Information Officer at Riverbed Technology
Organizations are continuing-with good reason-to pursue zero trust security strategies, which have proven to be effective in protecting data and networks against many current cyber threats. But that level of security has come with an unintended consequence.
In the steady push to secure systems and data, companies are actually losing visibility into the very applications they are trying to protect.
Today’s distributed, often cloud-based computing environments have become exponentially more complex than traditional data-center architectures, and the tunneling involved in moving network traffic in the cloud hinders visibility into what applications are doing, obscuring crucial details about the health and security of applications from the IT teams attempting to monitor them.
To get the most out of a zero trust approach while ensuring improved performance and customer experience along with better security, it’s imperative that organizations make better use of observability solutions.
The Pros and Cons of a Zero-trust Security
Zero trust’s growing popularity is a response to the fact that cybercriminals are focusing on compromising credentials as their primary means of attack. The growth of cloud and mobile computing, remote work and anytime/anywhere access obliterated the traditional idea of a network perimeter. Security strategies need to focus on identities accessing the network.
A 2023 global study by the Ponemon Institute found that 51% of organizations had adopted zero trust security strategies, up from only 20% in 2021. The trust nothing/verify everything approach of zero trust does create a more trustworthy environment, but that also means less visibility into what users and applications are doing, leading to a different kind of risk exposure.
Gartner projected that 80% of enterprises will adopt Secure Access Server Edge (SASE) and Secure Service Edge (SSE) models by 2025. However, the SASE/SSE tunnels that move network traffic after a user connects also prevent network teams from monitoring that traffic. Teams can’t see the details in the data, which has been combined and homogenized, so they are unable to identify problems or what’s causing them, hindering their ability to secure applications using the data.
Because of this black-box effect, zero trust programs have actually elevated the importance of user data for IT leaders. Teams that are unable to monitor data within tunneled environments must now look to the outputs of their applications as the sources of truth on software performance and business success.
Observability tools and solutions, which combine monitoring, visibility and automation to evaluate the state of a system by assessing its outputs, can provide insights to IT leaders. Organizations are increasingly turning to these tools, with the observability market projected to grow from $2.4 billion in 2023 to $4.1 billion by 2028.
Bridging the Security/Observability Divide
CIOs need to prioritize both zero trust and observability. The solution to maintaining security without sacrificing observability is monitoring what users experience in a way that defines the exact status of the applications.
Consider, for example, a call center where agents use certain applications to manage calls and provide service. When problems crop up, it can be difficult for management to see from the agent’s point of view what is causing the trouble. In a case like this, the answer lies in the end-user experience, which is where they can track performance, identify any shortcomings and correct mistakes.
At the network level, observability works in much the same way. A unified observability solution, which pulls data from across domains (including details in logs and metrics), puts full-fidelity data into a single interface and uses machine learning and automated workflows to troubleshoot problems and provide actionable insights.
This allows teams to detect and resolve problems more quickly, while eliminating data silos and the alert fatigue that comes from chasing down too many false positives. The solution also allows organizations to codify the knowledge of experts with automated runbooks that guide the response of junior staffers, enabling them to achieve more first-level resolutions when applications are experiencing problems.
Monitoring User Experience Helps Improve Performance
Because visibility into the data is impaired in cloud environments such as SASE and SSE, organizations need clear visibility into the user experience. IT leaders are often caught in the middle, trying to make an increasingly complex, cloud-based IT environment seamlessly support business objectives while also working to face an increasingly sophisticated threat landscape that requires a comprehensive identity-based security strategy like zero trust. IT leaders, looking for visibility into the health of applications and end user’s device, are turning to observability tools that can help them understand the state of their ecosystem in zero trust environments.
The hybrid cloud isn’t going anywhere. If anything, it will become mainstream as IT leaders try to support 24/7 global networks. The move to zero trust will only accelerate as security leaders are trying to deter threat actors across an expanding threat landscape. The solution to this Gordian Knot is unified observability solutions that support zero-trust security while enabling better performance, which leads to greater productivity and improved business outcomes.
##
ABOUT THE AUTHOR
Fernando Castanheira is the Global CIO at Riverbed Technology. He is responsible for all aspects of IT, including digital transformation, Cyber/IT security, infrastructure, operations, and business platforms. In addition, Fernando leads the Saas Business Strategy function, partnering with the customer facing teams on new approaches centered on providing ongoing customer value and delightful experiences.
