Login
When you think about the most resilient creatures in the animal kingdom, what comes to mind?
Perhaps the camel, which can survive for 6 months with no food or water. Or maybe it’s the honey badger, which tends to drink snake venom like cranberry juice.
Or how about the immortal jellyfish? This is one of the most fascinating (and oldest) creatures on Planet Earth. Not only are they immortal, but they also live their lives in Benjamin Button-esque fashion. Turritopsis nutricula jellyfish live to the age of 50 and think, “Well that was fun, but what if I did all of that again in reverse?” When they get back to the beginning, they age forwards again…kind of like the David Fincher film playing on an endless loop, which, I must be honest, felt rather reminiscent of my watching experience.
Those are all fine contenders. But I think the award for the most resilient animal goes to the Tardigrade.
A Tardigrade is a water creature – it needs water to survive. But if there’s a shortage – say, they made their home in a lovely bunch of moss which has unfortunately dried out, they have a plan B.
A Tardigrade will curl up, slow down their metabolism by a factor of 10,000, and can go without a drop of water for decades. Then, when conditions are better, they reboot, rehydrate, and carry on as if nothing has happened. Take that, evolution.
That’s not all. They can also survive temperatures of up to 150 degrees centigrade, without so much as a flinch. How about colder temperatures? Snow problem. (Sorry.) Turn the temperature down to minus 272 centigrade (pretty much Sub Zero), and you’ll defeat the atom, but you won’t make a mark on the Tardigrade.
This one is my favorite: They can survive space travel. In 2008 European scientists sent a colony of 3,000 tardigrades into low grade orbit for 10 days. The majority were able to withstand both cosmic radiation, and the power of the Sun’s UV light.
I guess one question you might ask is, “Why?” Why does a tardigrade need such a robust defense strategy when it’s only a millimetre in size and looks like a cuddly bear under a microscope?
It comes down to adaptation. Tardigrades are water creatures who needed to adapt to occasional droughts. Sure, they may have overshot it a little by including the potential for space travel too. But, they addressed their main threat, and set a more positive course for the future. I think that’s a nice sum up of what being resilient means.
Which brings me to my main reason for this post. I’d like to talk about security resilience, and how it can be the baseline for plotting a stronger future for your organization.
I believe, as with most things, that security resilience starts with people – looking after them, giving them what they need to flourish, and in most cases, getting out of their way.
That all sounds basic. However, the scale of what our people and security teams need to protect within the enterprise and the internet as a whole, keeps getting bigger. Not everything’s in the data center, and not everything’s in the cloud. Addressing the core challenges, and adapting as needed, is central to a security resilience strategy.
This involves moving away from a siloed security policy that is only focused on threat prevention and treats all alerts and threats equally. Not only is this way inefficient – it wears defenders out. We can’t prevent everything, so we must prevent what will affect us most from a security standpoint, while increasing detection and response for anything else that may come our way.
That’s where a detection, response and recovery strategy comes into play. This strategy is underpinned by risk-based contextual analysis (i.e., “Exactly how concerned do we need to be with this new vulnerability?”) and continuous trust assessments.
For your people running daily analysis, this is crucial to help them move from the overwhelming environments that often stem from alert fatigue. Dealing with the latest headline threats is reactive, exhaustive, and is a large component as to why burnout is so prevalent in security. Context-centric security is a key factor to moving away from this.
We explore this concept and more, in our new e-book: Adapt and Overcome: Your guide to building security resilience with Cisco Secure.
In this e-book, we identify the key steps to implementing security resilience. We help you to find the priorities, so you can drive resilience faster, and more efficiently. You will also be able to see this in action, in our case study with the NFL (National Football League).
Later on, we get into some specifics about how Cisco can help you build security resilience across four key areas: risk reduction, visibility, mitigating insider threats, and what to do with actionable intelligence.
Plus, we share some security resilience success principles from other organizations around the world.
Please check out the e-book when you have a moment. I hope the stories, videos and words have meaning for you, and can help your organization as it prepares to meet its current challenges and opportunities.
And finally, remember that with the right security partner, your organization can adapt to change with speed and precision, making informed decisions with the right context at the right time.
Learn more about how Cisco Secure can help you build your resilience strategy.
We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!
Cisco Secure Social Channels
There are some very tough questions I’ve come across in my time. How does one walk into Mordor, if not simply? Why isn’t there a special name for the tops of your feet? (Credit to Lily Tomlin for that one.)
For a security leader, the toughest questions are often around security buy-in: How do you achieve active support across the organization for building resilience? Is there a way to overcome legacy systems, and perhaps even more crucially, legacy mindset?
To help answer those questions, three experts recently joined me for a live Cisco Chat. They offered context and insights into how a security leader might want to approach this scenario.
Meet the experts
I was joined by Liz Waddell, Incident Response Practice Lead at Cisco Talos, who’s often there at ground zero for data breaches, helping teams put out fires in remediation. She’s also been instrumental in shoring up network resilience for our customers in Ukraine.
Also, “Accidental CISO” (AC), Chief Information Security Officer, who was just trying to get SOC2 and ISAC certifications for a vendor when he was abruptly named CISO of his organization.
And finally, Christos Syngelakis, CISO, and Data Privacy Officer at Motor Oil Group. We asked Christos how he was able to align security resilience considering the digital transformation.
Our experts gave us their top four tips for getting the buy-in of the business when it comes to security resilience.
To get company-wide buy-in, we need to approach IT decision-makers with the mindset of making their lives easier. As Christos says, “You must be blended with the business mindset and understand what they really need.”
Accidental CISO (“AC”) adds, “Then you can implement tools and processes that also happen to address security risks, but that first and foremost are going to make everyone’s lives easier.” After that, he states you next rally support to help solve those problems by leveraging key relationships, and become an advocate for improving conditions from their perspective.
AC went on to give an example of a methodology that worked in his organization – “Happy Path Thinking.” The general thought with this approach is that other groups in the organization know their areas better than any security team ever will:
“Labelling happy path thinking was very helpful to get the organization to step back and consider what doomsday scenarios would wreck their plans and make it impossible for them to operate.
“We established standard design patterns and team norms to mitigate those doomsday scenarios. And we did this with input from across the business – engineering, product management, the development team infrastructure, customer support, and other groups.”
AC went on to talk about the gamification aspect of happy path thinking, and the importance of creating a safe space to do it:
“We turned it into a fun game. It was never personal in any way – we used objective neutral language. People didn’t end up feeling attacked when assumptions were challenged because the whole purpose of this was to try and think of risks that would blow up their entire thinking.
“The consistency of doing these exercises, and the creation of the safe space, were both crucial. We wanted to ensure that somebody who was not a developer could still make a suggestion. And nobody was going to tell them to stay in their lane. For example, the customer support team gave us valuable insights, because they are the ones on the frontlines.”
It’s all about people. It is through contextualizing security in the realm of human problems, solutions and lifesavers that gives our solutions relevance in the eyes of the humans that run these businesses, and allows us to get out of our own way.
This is best accomplished by getting to know the people with their “boots on the ground” – they’ll let you know where the weak spots are. “People think C-levels are most important (CISO, CIO, CFO), but the most effective relationships were at manager/director levels,” says AC.
“They own the day-to-day implementation of the controls, processes, and business operations in general. Working closer to ground-level let me better understand how the business worked and how to solve their problems and manage risk at the same time.”
Ultimately, security resilience buy-in comes when you can get out your own way. As Christos put it, “you must give them a safe way to do what they already want to do.”
Liz made the point that “The best Business Continuity plans have the roles and responsibilities marked out very clearly.” She then reflected on her onsite visits with customers:
“One of the things that I’ve often noticed is that it’s rarely made clear where the handoff is between your incident response team and whomever is managing your Business Continuity and Disaster Recovery (BCDR) plan.”
For many organizations, the IR team and the BCDR team are separate. Liz pointed out that these organizations may be missing an opportunity for alignment:
“We want to make sure that that handoff/partnership is going to be aligned in the best possible way. And that typically comes down to who is making your business decisions.
“For example, who has the authority to say we’re going to shut off the internet? That’s a pretty big call. Are we are going to do an entire enterprise password reset, and what does that involve?”
What’s crucial here is that the inputs that are developed during the BCDR plan, can often be applied directly to your incident response plan.
We lean back on the adage often in security, “it’s not a sprint; it’s a marathon.” Christos cautions, “Do not be disappointed. Keep trying to push the environment where it needs to go. It will not turn fast.” This is good to keep in mind when we pride ourselves on results, but they can be slow in coming. It’s also good to remind the organization in question, who might be expecting the same thing.
Work on making security improvements to your environment every day, and your security posture will grow, Christos continues. However, you won’t notice a big change from day to day, but when the activities are reviewed, the progress becomes apparent.
It is in constant, diligent, and persistent methods that your legacy systems will improve from their current capabilities to where they need to be to secure the technology of today.
By setting “slow and steady” expectations, you can gain the support of your employees, management, and C-Level for the long-haul.
Liz supports this theory: “I always make the joke that we’re not CSI Cyber. That’s not how actual security works. Ideally, you’ll have the infrastructure in place to enable a quick response. But it’s important for the C-suite and those who are making business decisions to understand that sometimes, they’re going to have to wait for an answer, and why that is.
“As the security team we’re going to get you answers as quickly as possible. But understand that we’re also going to need to take a breath and figure out what’s going on, so we can make an informed decision about what to do next.”
“Security resilience is the ability to protect the integrity of every aspect of your business in order to withstand unpredictable threats or changes – and then emerge stronger,” Neville Letzerich, VP of Marketing, Cisco Secure states.
However, improvement is deliberate and methodical, and security needs to find a way it can “fit in” without slowing down progress. The desire for speed, constant advancements, and ever more complex networks, technologies, platforms requires clear communication and expert execution.
You can check out more in our eBook, Building Security Resilience: Stories and Advice from Cybersecurity Leaders. It covers more firsthand accounts from Liz, AC, Christos and 10 other industry professionals sharing how they built security resilience within their organizations.
Find this blog helpful? Here’s a couple more you might like:
View all our blogs on security resilience here.
We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!
Cisco Secure Social Channels
FreshRSS 