Summer is here, but now is not the time to let your guard down

This time last year I spoke of the “Summer of Security”, encouraging companies to opt for a ‘zero trust’ strategy to combat the alarming increase in ransomware and other cybersecurity threats that resurfaced during the pandemic. . If there is hope that this summer the situation will be different, surely it is true: it will be different. The bad news is that, in many ways, it will almost certainly be worse.

A Zero Trust environment remains essential. ‘Zero trust’ assumes that bad actors are always present on the network, and consistently takes necessary steps to prevent and remediate threats. It goes beyond network security to include user management, device management, and application security. Continuous assessment of security posture, role-based access control, and location awareness are some of the key features of this type of security.

However, ‘zero trust’, by itself, is not enough. Rather, it must be part of a comprehensive cybersecurity solution that is up to par with increasingly bold and sophisticated threat actors.

why are we here

In the first quarter of 2022, the Ransomware Index Report study – developed by Ivanti – revealed a 7.6% increase in ransomware-related vulnerabilities and an alarming increase in activity from the Conti ransomware group. The report identified 22 new ransomware-related vulnerabilities, bringing the total to an alarming 310 new threats.

Summer is here, but now is not the time to let your guard down

No doubt corporate IT and security teams were hoping to take a breather from the initial spike in ransomware attacks fueled by the pandemic, but this is clearly not the case. The continuing rise in these types of threats is compounded by an unprecedented shortage of IT professionals, with the result that fewer people are trying to do more every day.

The map for the road ahead

The 2022 version of the “summer of security” continues to have ‘zero trust’ as its starting point. If the company has not established a zero-trust framework, now is the time to do so. But that’s just the beginning. The next step is to develop a MAP for the cybersecurity journey ahead.

And by MAP, I mean a three-phase strategy that shapes a comprehensive, scalable cybersecurity strategy aligned with the new remote and hybrid work environment. This would be a brief description of the MAP model:

• Managing means establishing a fully known state, which means visibility to every endpoint, user, network, and application, everywhere. It means not only knowing what and who is on the network, but also how they are interacting and what information is being shared. Managing cybersecurity also means letting go of practices that increase risk, like delaying patching or allowing unmanaged devices onto your network.
• Automation is all about easing the burden of manual processes by automating them. This could include inventory management, device onboarding, patching to its most secure state, or any other repeatable process. Incorporating self-healing and/or self-service solutions could help lighten the workload for IT teams.
• Prioritizing is about assessing and addressing risk, giving IT the information it needs to go after the most critical vulnerabilities. Of course, even with a thorough automation practice, there will still be areas that require technical staff intervention. To avoid overwhelming IT, prioritization can provide the necessary data and risk scores to enable a strategic and intelligent approach to risk response and remediation.

The MAP approach can reduce errors and mitigate risk, while streamlining IT work. This is a win-win scenario. And this summer, everyone could use a win. The sooner you start your cybersecurity journey in a ‘zero trust’ environment, the sooner you can truly enjoy the summer.

Author: Jeff Abbott. Ivanti CEO