How a Security Architecture Can Keep Your Organization Upright Amid Future Upheaval
By Steve Durbin, Chief Executive of the ISF
As organizations claw their way back from the global pandemic, every penny has to be justified. But the threat of a cyberattack is too important to ignore. Implementing an integrated security architecture can help your infosec team consolidate functions and support its budget.
Security architecture can be seen as a black art. It is often poorly understood – even by security practitioners. But, if used properly, it can help to create consistency, standardization and strong return on investment.
After a transformational year, the need for an overarching security architecture or “cybersecurity mesh” is being felt across industries. Organizations are struggling to ensure regulatory compliance and maintain strong security postures across distributed workforces. On top of this comes a renewed drive for digital transformation and an appetite for new technologies and innovations that can build future success.
Security architecture can offer many benefits to a business if it’s planned and deployed correctly. It can help you to consolidate your security strategy to ensure regulatory compliance and harden your posture to reduce your potential attack surface. Bringing structure to a complex mix of information and systems is a major challenge, but the potential rewards make it a worthwhile endeavor.
Building a Security Architecture on Uneven Ground
Security architecture can appear nebulous, but it should always result in an outcome that is pragmatic, effective and secure. The core components of a security architecture define a consistent set of building blocks that can be applied across an organization’s systems, whatever they may be. It does this by providing shared and common security services like identity and access mechanisms; standard controls, such as network segmentation; and reusable templates, such as standard desktop builds. Consistently applying such an architecture ensures a consistent level of security.
As industrial digitization, driven by the internet of things, takes hold, concepts such as zero trust, cybersecurity mesh and microsegmentation will compete and vie for supremacy against the security architecture. (Zero trust just received a nod in the Biden administration’s most recent cybersecurity executive order.) Yet the ultimate goal of an appropriate level of security remains consistent, and the tried and tested components of the architecture will merge with the newcomers in a natural evolution.
Creating a Cybersecurity Mesh
With so many moving parts in play and many hardware and software assets beyond the traditional security perimeter, a modern distributed architectural approach or cybersecurity mesh provides an elegant strategy. Deploy security where it’s needed. Extend protection around a person or asset, whether it’s a remote worker, a new cloud service or a third-party team.
A modular system that’s highly responsive allows you to move faster and at scale without bending policies or losing protections. Define and model the security approaches you want to see throughout your organization and work to reduce friction so they can be extended immediately when required. With a core set of principles embodied in a library of security services and controls, you can reuse designs and configurations and draw from an approved list of hardware and software.
Demonstrating Compliance
A consistent security architecture can also be helpful in meeting regulatory compliance and fulfilling diverse obligations from multiple sources, minimizing point solutions and reducing costs and overhead. While some obligations are control specific, such as PCI DSS, many others are deliberately conceptual and principle-based (such as GDPR). As such, they are highly compatible with a principle-led architecture.