2024 Should Be the Year of Resilience. But You’ll Need to Put In Some Work.

According to Merriam-Webster¹, The English word resilience is derived from the Latin word resilire, which means “to jump back” or “to recoil.” The base of this word is the Latin word salire, a verb meaning “to leap”, which to me implies not just returning to an original state, but potentially leaping beyond where we originally began. 

This is an apt metaphor for security, and something we should strive for in 2024. When our information systems are resilient, they should not only withstand the stress of an attack, but they should in fact result in our organization as a whole improving as a result².

Let’s take the human body as an analogy for information security. There is no doubt that our bodies are resilient, and have evolved with multiple redundant layers of defense against intruders. We encounter billions of bacteria on a daily basis, many of which are hostile. First, we have a perimeter defense – our skin. However, our skin is not impenetrable to bacteria, so we also have a set of detection and response mechanisms. When bacteria is detected inside our bodies, our immune system responds by producing antibodies that fight it. After it’s destroyed, the antibodies specific to that bacteria remain in our bodies, leaving us better able to defend against similar attackers in the future.

Everyone loves this analogy, but unlike within our amazing bodies, these benefits aren’t automatic within infosec. In fact, we need to specifically design our information security processes to obtain these results. 

The NIST Cybersecurity Framework³ defines five key functions: Identify, Protect, Detect, Respond, and Recover, and is widely accepted in the industry as a useful structure. However, I believe that it doesn’t have enough of an emphasis on how to tie things to our goal of improving resilience. (Nor does it sufficiently connect security to business value, but that’s a topic for another posting).

Within each of the categories, here are some basic but important questions to ask of yourself and your team. If your organization doesn’t have clear answers and a good understanding of the tools and processes for each of these, that’s an indication of an area to prioritize for improvement.

Identify

• How are you identifying user, infrastructure, server, and IoT devices as they appear on the network? 
• How robust are your processes for provisioning users and user devices with only appropriate access?
• What are the tools and processes for approving (or detecting) SaaS application usage?

Protect

• Do you have protections for your assets that are user device, server, and network-based? 
• How are SaaS applications protected? 
• Do you have sufficiently strong and phishing-resistant MFA in place? 
• Are you using email security to block malicious links and attachments?
• If you have a DevOps environment, how well protected is your deployment pipeline?
• How are you approaching Data security?

Detect

• What kind of detection mechanisms do you have in place? Common places for these include  user devices, network entry points, internal network segment boundaries, and on servers. 
• For cloud-based services, are you utilizing their native security detection tools, as well third-party tools such as CIEM or CSPM?
• If a host is compromised, you can no longer fully trust any telemetry it emits, so what types of  external validation do you have in place (for example observed network activity) ?

Respond

• How quickly can your tools and teams validate a potential incident, and begin responding?
• Are you proactively measuring the level of noise (false positives) and continually working to improve settings and filters?
• Are you testing your responses to true positives (e.g. defense validation exercises)?

Recover

• How confident are you in your backup and recovery processes, tools, and systems?
• Do you regularly test recovery into similar and dissimilar environments?
• Does the business understand your recovery time and recovery point objectives, and is everyone clear on the business impact? If not, does everyone understand that improving it will take additional investment?

In all cases, the most important thing is to ensure that every process within these categories doesn’t just perform a given task, but also has a way to drive feedback into the system itself to improve future results (this is the analogue of the antibodies that remain after an infection is successfully defeated). This feedback can take many forms, such as better inventory data or improvements to a process.

For example, onboarding a new server onto the enterprise network must also create an accurate configuration item in the CMDB, with a defined business owner and technical owner, and with appropriate metadata about its purpose, criticality, etc. And, there need to be defined attributes for all future activities for the server, for example patching and access governance. 

Here’s another example – for your SOC and Incident Response teams, ensure that there’s regular time allocated to step back, evaluate metrics, and proactively work to improve the fidelity of data, validity of detections, and efficiency and effectiveness of responses. 

Do keep in mind that we’re not advocating for unnecessary tool proliferation; we’re big believers in having fewer tools but making them deeply effective. But it is necessary to have enough tools to provide multiple perspectives and mechanisms within each of these areas. For example, you may have a process with which business users request access to certain sensitive data. But you should also validate this by comparing the actual access granted with what was requested. This will not only validate your automation, but also make your system more resilient to administrative bypass or ad hoc manual access provisioning.

System resilience isn’t easy, but it is necessary, and it is a great example of a virtuous cycle. Every time you improve the data in your CMDB, prevent unauthorized devices from being deployed on the network, or reduce the number of false positive alerts sent to your SOC, you’re making things better, faster, more effective, and more accurate for the foreseeable future. If your team can incrementally improve one thing every day, by the end of 2024 you’ll have made significant and meaningful progress. And that’s a New Year’s resolution we can all support.

Interested in ensuring your Zero Trust program is set up for success? Sign up here for our free, 30-minute Zero Trust Strategy Kickstart.

1. https://www.merriam-webster.com/dictionary/resilience ↩︎
2. This is sometimes referred to as “antifragility”, a term often used by John Kindervag to describe this concept. ↩︎
3. An overview of the framework Version 1.1 is here: https://www.nist.gov/cyberframework/getting-started/quick-start-guide  ↩︎