With an abundance of cyber security solution providers and an ever-increasing threat landscape, every customer has a lot to worry about and consider before securing their environment adequately.
Before going down too many vendor demos and POVs, I would recommend focusing on the basics and getting them right.
The non-negotiables should always be a firewall, endpoint security and e-mail security. This is much like the walls around your house, burglar bars and an alarm system with beams. While even that, particularly in the South African context, is unfortunately not entirely holistic, it is the bare minimum everyone should have.
Much like fitting home security, having the cyber security solution properly configured by a skilled partner is highly recommended. Out-of-the-box firewalls will have some basic settings that are effective, but like any device or piece of software, customisation is necessary for your specific purposes.
Once you have your walls and fences up, consider the internal area. Endpoint security can come in a few flavours: EPP (endpoint protection), EDR (endpoint detection and response) and XDR (extended detection and response).
If budgets are limited, at least have an EPP, but it is highly recommended to have EDR. If it is a bit more of a complex environment with many servers, switches, remote users and cloud apps, then XDR would be advisable, as it collects telemetry from all those rather than just the endpoints. Much like figuring out where a trespasser has come in – over the wall, through a door, top floor window, neighbour's garage – XDR will build a bigger picture of your exposure by identifying multiple areas rather than just the one.
EPP on its own is much like holding a shield and defending yourself from someone throwing harmful objects at you. It's good for defence, but what about fighting back? EDR has the ability to fight back by looking for threats proactively; imagine having a weapon along with that shield. XDR, by the same analogy, would be the shield, weapon and a pair of binoculars, because it allows you to see more of the threat landscape.
E-mail is still one of the most vulnerable channels because it is our key means of communicating. Everyone within a company – from the front desk, to finance and exco level – makes use of e-mail to communicate all the time. A physical entry into a building or your office is limited to working hours, but e-mail is used around the clock. General greetings, sharing of files, financial approval, supply chain relations, all travel via e-mail, all the time. The need to protect your business, end-users, partners, suppliers and customers is ongoing and critical.
My recommendation for e-mail security is to have not one but two solutions. One that is a gateway (eg, MS Defender, Mimecast) and a behavioural-based solution (eg, AbnormalAI). The reason is much like the security you have around your house. A palisade fence and a physical wall are far better than just a single barrier. What is also important to note is that most solutions still only identify the blatant threats, such as embedded URLs or attachments, but if the e-mail is a plain text then there is no visible threat to most gateways. However, that same text could be PII information such as ID numbers, banking details or medical records. To identify those and protect from insider threats or negligence, prevent regulator (POPIA/GDPR) fines and avoid public relations damage control, a behavioural-based e-mail security solution is required.
Lastly, I would suggest network segmentation, whereby you limit the threat exposure should a breach occur. Imagine a fire breaks out in your house, but you have the means to limit the damage to only a single room instead of the entire house. Network segmenting can be done relatively simply and is highly effective as it has network and cyber security outcomes.
If you wanted to improve on securing your house, have a look at the four walls. Consider what might be an acceptable risk, ie, the one neighbour has high walls, an electric fence, razor wire and a bunch of angry dogs. The chances are that you are less likely to be broken into from that side, so that will be your acceptable risk. However, the side of the house that has a low wall and regular foot flow day and night is where you should be focusing your attention, and budget.
While the house analogy oversimplifies what more often is a complex undertaking, try to get the fundamentals right and the bulk of your threat landscape will be covered. Then add more layers as needed and budget permits.
Share
