The ABCs of cyber security

To understand your Cyber Asset Attack Surface Management (CAASM), let's start with your attack surface, defined as any physical or digital interface where a cyber attacker could gain entry to your system and access your sensitive information.

CAASM is a relatively new term that provides greater visibility over assets such as your software (cloud or on-premises), code repositories, devices, and identities.

As the complexity of your digital assets continues to evolve, particularly with the emergence of remote working, the harder it is to understand your complete digital asset profile, not to mention monitor and protect it from any potential breach.

CAASM provides a single pane of glass for your digital asset management. Without it, you're not just limiting the visibility of your IT Security team, but leaders throughout the business are left in the dark about their areas of greatest vulnerability. So, it serves not just as a tool within your cyber security team's confines but can help educate the rest of the business and help them visualise their shared risk.

To understand a Cloud Workload Protection Platform (CWPP), let's first define a 'cloud workload', which is any app, database or function run within the cloud.

A CWPP solution is limited to monitoring and protecting workloads within the cloud. Think of it like a mechanic who can monitor and protect the car from potential breakdowns but can't do anything to protect you from another car on the road rear-ending you at a red light.

In summary, CWPP ensures the security of the cloud workloads, while CSPM focuses on the broader view, including the accounts deploying those workloads on the company's cloud platforms.

With elements from Microsoft Defender for Cloud, Microsoft Sentinel, Azure DevOps, Microsoft Secure Score, and Secure Score, we can achieve the same goals as CWPP, especially CNAPP, which combines CSPM and CWPP. (Watch this space as we're likely to see Microsoft Dynamics 365 published on the Gartner Magic Quadrant).

'Firewall' has become a commonly understood term, even by the most technology-illiterate users. This is because firewalls have remained the most basic and fundamental form of network security for the last 25 years.

What separates a Firewall as a Service (FWaaS) from a standard firewall is its security capability and near-instant scalability.

A FWaaS can be integrated within instances of Microsoft Sentinel for increased visibility, where a connector or API has been made available by the FWaaS supplier.

A Managed Detection and Response (MDR) service combines the speed of technology and automation and the expertise of human intervention to perform threat hunting, monitoring, and response. The main benefit of MDR is that it helps rapidly identify and limit the impact of threats without the need for additional staffing.

Any business that needs the ability to respond to any threats to information security rapidly should consider an MDR solution

An MSSP is a Managed Security Service Provider. MSSPs typically monitor security events and manage IT security technology.

Managed Detection and Response (MDR) services are often compared to Managed Security Services Provider (MSSP) services. While they share similarities, they also have significant differences.

MDR services are proactive and focus on improving vulnerabilities within your environment, whereas MSSPs are designed to be reactive to real and immediate threats that enter your environment.

So you could say an MDR provider is going to provide a greater layer of security than an MSSP.

Secure Access Service Edge (SASE), pronounced 'sassy', was first described by Gartner (2019) as "The Future of Network Security in the Cloud."

Traditional security systems were designed to assume that most, if not all, users and applications would sit inside the local network perimeter, but this is no longer the case. Your data has moved to the cloud, your employees often work remotely, and your business transformation initiatives need your technology to remain agile.

One of its key benefits is the ability for it to be scaled up and down based on usage.

The term SecOps is a conjunction of Security and Operations. It is a result of removing barriers between security-focused and operationally focused teams within your business.

As with many functions within your business, priorities can vary dramatically, so SecOps was designed to reduce conflicting priorities and align disparate tools that can create inefficiencies, reduce your security posture and expose the business to unnecessary risk.

When security and IT operations teams work more closely together in a SecOps approach, they share accountability for the priorities included in maintaining the productive state and security of their enterprise's environment.

If SecOps is your highly skilled team of professionals, then Security Operations Centre (SOC) is the shared command centre facility from which they can perform threat detection and alert triage.

In the case of your security partner, it may also be used to deliver SOC as a service which can include Managed Detection and Response (MDR) and Extended Detection and Response (XDR) services for customers too.

Most, but not all, SOCs operate 24/7 with SecOps teams working in shifts to log activity and mitigate threats.

Extended Detection and Response (XDR) collects threat data from previously siloed security tools across an organisation's technology stack for easier and faster investigation, threat hunting, and response. An XDR platform can collect security telemetry from endpoints, cloud workloads, network email, and more.

XDR typically involves the creation of automated playbooks and results in tightly integrated detection and response. One of the advantages of having a security partner is that it provides your business with access to a comprehensive playbook of threats that have occurred across a range of environments. This gives greater visibility of potential threats that may approach your environment.

Zero Trust Network Access (ZTNA) is a philosophy as much as it's a technology. It ultimately assumes that all devices and their users are threats until they prove otherwise.

Think of it as guilty until proven innocent, which may seem a little unjust, but it's this set of granular, adaptive and context-aware policies which could ultimately save the business millions in lost data, finances or reputation.

Next time you're banging your head against a brick firewall because you have to perform another Multi-Factor Authentication (MFA) to access your emails, think of the bigger picture and the added layer of security for the rest of the business.