Industry executives and experts share their predictions for 2024. Read them in this 16th annual VMblog.com series exclusive.
Visibility is a Game-Changer for Security Decision-Making
By Pandian Gnanaprakasam, Founder and CTO, Ordr
It is impossible to protect what you don’t understand. This simple statement is why real-time, accurate data about your organization’s network of devices, users, applications, and its overall attack surface is so important. But those data needs are evolving. In order to make informed decisions about security, in the coming year teams will need to understand context, the exact software and patch levels of the core operating systems, and the specific version of the software installed. They will also need to begin to utilize AI to quickly analyze and address any behavioral abnormalities.
The growing complexity of the enterprise technology environment and the need to properly secure it is one of the lingering trends of 2023. There is not an easy solution to the daunting task of keeping a constantly evolving and expanding attack surface well-understood and protected. Ask any organization that deals with a large amount of connected assets – such as those in the healthcare, smart cities, or manufacturing industries – and you’ll soon understand just how difficult it is to be certain you’ve properly and completely protected your organization. Without a granular, accurate, real-time source of data about what is connecting to the network – and what those assets are transacting in the network – it will be impossible to be sure there isn’t a vulnerability just waiting to be exploited.
Looking ahead to 2024, the central theme will be visibility and how gaining a proper handle on your asset data – devices, users, cloud workloads and SaaS applications – can help organizations address the problem of not even knowing exactly what they have to protect. Without better understanding and insight into your assets and their attack surface, it will be impossible to make data-driven decisions about mitigating risks and implementing stronger protections.
The Vital Role of Visibility and Context
Visibility and context are fundamentally important. To effectively respond to incidents and threats, you need accurate data. But there needs to be several types of data in order for your analysis to truly be effective. When it comes to devices, you need to know not only what a device is, but also where it is located (both its physical and network locations) – and most importantly, what it is doing. Is it connecting to the network? How often? What is it doing when it gets there? Having this context is crucial for two reasons.
First, these details will be critical as a single source of truth on asset data for management and as a way to help pinpoint compliance issues. Are there devices running outdated operating systems? How many devices banned by the government are in the network? Are there managed endpoints that should have Endpoint Detection and Response (EDR) agents, but do not? Are there devices not adhering to corporate policies such as encrypting disks, enabling endpoint firewalls, or allowing monitoring by MDM agents?
Second, context about a device and where it is located is important to accelerate incident response. Imagine a situation where an incident occurs, and all you have is an IP address. Can you take immediate action based on just that? The answer is no. A compromised device that connects to the wireless network often roams and gets a new IP address. To understand that host in question, you need to piece together all the IP address changes to accurately pinpoint the device associated with the incident. To respond effectively, you need to know what actions are possible. This requires detailed visibility and context. The ability to answer questions like “what is it,” where is it?” and “what is its role?” will become essential next year to help teams seamlessly move from detection to response.
Granular Details: Uncovering the Software Bill of Materials
Next year, the significance of granular details in modernizing security protections will come to the forefront. It’s not just about knowing the device’s location and identity; it’s about understanding the device at a deeper level, including the software and applications it runs. This is why there has been such a push from security practitioners and government regulators to get software and hardware manufacturers to provide a software bill of materials (SBOM) defining exactly what is contained within their devices – and to get them to keep updating that SBOM at a regular cadence.
Teams cannot fully correlate and comprehend the vulnerabilities associated with a device without this deeper knowledge. Details about the operating system and the applications installed on it are critical to successfully being able to protect your environment. Knowing this level of granularity is vital for determining if a device is susceptible to vulnerabilities.
Baselining Transaction Behavior and Implementing Segmentation In the Era of AI
Segmentation and Zero Trust are becoming critical components of an organization’s strategy. In 2024, companies with heavy connected device use within their organizations will come to understand the importance of baselining behavior, not only to identify devices behaving abnormally, but also to aid in Zero Trust segmentation. Gaining accurate data on what constitutes normal device behavior is essential for making informed security decisions, and artificial intelligence (AI) will play a pivotal role in achieving this. AI technologies will enable organizations to monitor and analyze device behavior quickly, easily and at a large scale – and will be a critical tool for analyzing any deviations from the norm.
For instance, AI can help baseline what a particular device is communicating with – and most importantly, whether these interactions are typical or suspicious when compared to other “similar peers.” This level of analysis enables organizations to quickly surface any anomalies. Understanding “normal communications” is the foundation for delivering Zero Trust segmentation policies. Zero Trust segmentation can allow appropriate access while limiting exposure, and is particularly valuable when there are critical devices running out-of-date operating systems, as it allows organizations to keep them in operation.
Navigating the Data-Driven Security Landscape of 2024
In 2024, security teams’ efforts will be driven by the theme of visibility. Understanding context, diving into granular details, and embracing AI-driven behavior baselines will be the cornerstones of success in an even more data-driven era. Those who master these changes in approach will be able to better protect their network landscape with confidence.
##
ABOUT THE AUTHOR
Pandian Gnanaprakasam has more than 20 years of product and engineering leadership experience and is also a serial entrepreneur. Before founding Ordr, he was the Chief Development Officer at Aruba, responsible for all engineering and product management functions. Aruba, an enterprise mobile wireless company, was acquired by HPE for $3 Billion in March 2015. Before Aruba, Pandian served as the head of engineering for Cisco’s multi-billion-dollar Wi-Fi business unit and before that as VP of engineering for low-end switching product lines. He graduated with a master’s degree in Electrical Engineering from IIT, Chennai, India and holds several patents to his credit in various networking technologies.
