Security Without Barriers, Part One: A New Cyber Security Narrative

Information security professionals often use defense-in-depth
analogies to describe their security goals. For example, it’s common
to conjure an image of a castle and moat to explain cyber security
strategy to stakeholders. These visualizations are often accompanied
by an explanation that if an attacker gets past one layer, the next
layer will stop them.

One problem with defense-in-depth analogies is that the traditional
perimeter—i.e. the moat—is mostly gone today. Digital transformation
projects, adoption of cloud computing solutions, and the growing use
of mobile and remote computing devices have dramatically changed how
technology is deployed and used. Perimeter security solutions, such as
firewalls and VPNs, cannot be relied upon to protect digital assets.

A more fundamental problem with using defense-in-depth analogies to
explain your security strategy is they describe security success in
absolutes: Prevent an attacker from getting in.

Unfortunately, security teams face an asymmetric threat where
inexpensive attacks can, and often do, evade organizations’ expensive
cyber defenses. This reality can be summed up with two assumptions:

• No technical solution can prevent all attacks all the
  time.
• There will always be bad actors looking to exploit this
  security gap.

Because of this unbalanced threat landscape, many security leaders
have adopted cyber resilience strategies. They balance investments
that protect against attacks with other investments that mitigate the
damage caused by attacks that get through the defenses.

We’ll explore the components of cyber resilience more in the next
blog post of this series. First, let’s think about how to describe
cyber resilience to stakeholders.

Changing the Security Narrative

Describing a cyber resilience strategy requires a vastly different
mental image than describing defense-in-depth strategies. Rather than
explaining how a castle’s defensive layers keep attackers out,
think instead about how a museum protects its assets.

The core principle is the same: Protect valuable assets. However,
the methods and strategies used to achieve this goal are very different.

Instead of hardening the perimeter to keep attackers out, a museum
must create an open and welcoming environment. They need to draw
visitors in, often allowing them within inches of their most valuable
displays and exhibits. As a result, museums assume bad actors can
easily get inside the perimeter. Their strategy shifts from
preventing access to preventing exploitation of access.

There are other differences between describing a “castle-like”
defense-in-depth cyber security strategy versus a “museum-like” cyber
resilience strategy.

At first glance, describing your cyber security strategy as a museum
seems odd. However, if you think about how most IT organizations
define success, they’re more like a museum than a fortress. IT leaders
design solutions that are welcoming to visitors, that are easy to use,
and that still protect critical assets from theft or misuse. Adopting
similar language and goals to describe your security strategy helps
align cyber security messaging with other IT leaders’ goals.

Heading Toward Cyber Resiliency

Security leaders need a new narrative to describe their security
strategies. By adopting cyber resilience strategies instead of
prevention-focused defense-in-depth strategies, you also help your
organization better prepare for the asymmetric threat posed by cyber attackers.

The next post in this series will explore steps organizations can
take to build strong cyber resilience. We’ll build on the analogy of
how a museum protects assets and show concrete steps for implementing
cyber resilience within your organization.