Unleashing visibility for cyber resilience

The days of two-dimensional, perimeter-based cybersecurity are long gone as hybrid environments have created a more complex world. Network access is essential, and maintaining that access requires a greater level of vigilance and innovative defenses, including those that focus on the back-end applications and workloads.

Threats are getting increasingly complex -- most notably with ransomware. This year alone, the FBI noted ransomware reporting has increased by more than 60% with ransom demands running as high as $25 million. Imagine all the ransomware attacks that are going unreported.

Federal IT leaders are focused on preventing threats, hunting for bad actors and repairing the damage from ransomware attacks. Even the National Security Agency has made ransomware a top, near-term focus area as it assists the FBI and U.S. Cyber Command. However, reducing the impact of attacks will require more than just a quick reaction.

Agencies must take a proactive approach to cybersecurity to make themselves resilient to attacks. This means denying attackers the advantage in a ransomware attack. For example, what if a federal employee inadvertently downloads ransomware, but the threat can’t move around the organization?

The Office of Management and Budget’s recent memo calling for agencies to improve cyberattack investigative and remediation also stresses the need for increased visibility -- especially within security operations centers (SOCs) -- to provide insights before, during and after cybersecurity incidents.

There often isn't sufficient network visibility, especially between applications and workloads. By establishing visibility within their networks, agencies can proactively defend against attacks and efficiently secure their data and applications.

More connections mean more vulnerabilities

Visibility can provide federal technology leaders with actionable insights not only to reduce the reach and impact of ransomware but also to prevent cyberattacks from happening in the first place. However, a dizzying maze of unseen connections between applications and workloads often prevents agencies from making progress. Teams don’t understand what is inside their networks and therefore don’t know what there is to defend.

This rings especially true in highly connected hybrid environments. As the number of connections – and complexities – within an environment grows, so do the vulnerabilities. Within this maze is often a scourge of unnecessary connections between assets that many technologies are not sophisticated enough to identify.

A lack of visibility into the connections between applications and workloads prevents teams from quickly detecting a breach or potential attack. Teams can reduce their operational risks and gain key insights by visualizing all communications and connections both within their environments and to the internet to understand the paths attacks could use to spread. This is important even in classified environments where there are no internet connections.

The Cybersecurity and Infrastructure Security Agency recommends a series of mitigation efforts to reduce the risks of ransomware, including segmentation, access restriction and the removal of unnecessary applications. However, before agencies can segment, they must have visibility. Visibility is the first step toward protecting the network and is critical for SOCs to detect intruders and stop the spread of cyberattacks.

Focused efforts yield immediate security impact

Visibility helps teams quickly reduce risk, focus security efforts and limit or stop the lateral spread of ransomware and malware. Mapping communications between applications, workloads and devices provides the knowledge agencies and commands need to help stop attacks. Teams can also create vulnerability maps to highlight which parts of the environment are at the highest risk so they can prioritize what is most vulnerable to attacks.

OMB’s memo explained that agencies should prioritize their compliance activities by focusing first on high-impact systems and high value assets, which include applications, data and workloads that are central to the mission. These assets are key targets for cybercriminals and are currently undefended once adversaries scale network perimeter defenses. Teams must determine their HVAs’ level of vulnerability to help further prioritize where to focus efforts. 

The first step is understanding which parts of the environment are mission-critical and where the greatest vulnerabilities lie. Then teams can eliminate risky connections, including those that are communicating outside of the organization, and non-compliant data flows that are commonly abused by ransomware. These actions alone help reduce risk and stop lateral movement. This new visibility accelerates agencies’ and commands’ strategies to adopt another key element in the Biden administration’s executive order on cybersecurity -- a move to a zero-trust architecture.

Visibility for effective zero trust

Visibility is the first step in any zero-trust security strategy and is essential to stopping the pervasive threat of ransomware. With a comprehensive view into the network, teams can proactively contain cyberattacks by shutting down communications in unnecessary, risky and vulnerable ports.

Teams can also reduce the reach of ransomware and improve cyber resilience by integrating real-time data into security responses and threat investigations. Agencies cannot effectively secure their networks against threats they never see coming, let alone threats that are hidden inside unseen connections between applications and workloads.

By establishing visibility as a precursor and complement to other security efforts, agencies and commands can accelerate their zero-trust strategies and trust that their defenses are well-positioned for mission success and a defend-forward posture.