JIE-READY STEP 1: Know what you have
The first and arguably most critical step in any data center consolidation or migration is to first understand what you have. Most complex or large-scale networks have grown so rapidly over the years or decades that there is no clear picture of the functioning system. As the opportunity to refresh large-scale global infrastructure becomes available today, experts are building security in on the front end. The challenge is understanding what exists today, how it is (or isn’t) being secured, and then designing the security requirements in tandem with the new system/network. RedSeal Networks provides a unique perspective on what is happening today on the network, how the network is actually connected, and the efficacy of security controls deployed in the network.
RedSeal Networks can provide this unique perspective by aggregating the configurations of core components that comprise the network, more specifically routers, firewalls, load balancers and switches. The RedSeal platform then analyzes these configurations and creates a model of the network. This is a visual representation of the network itself, but it is also a full model of all possible access based on the devices and the configurations of those devices. This model is a critical first step in understanding the DoD infrastructure today and will be the foundation upon which RedSeal will continue to provide unique data for the success of JRSS and JIE.
The model of networked infrastructure that RedSeal is providing to the JRSS project will not only help understand access at a high level. This model allows the capability to drill down into specific access areas, enclaves, single path analysis, and even model access that doesn’t yet exist. It is this flexibility that will allow architects and design experts to understand, from a high level down to fine detail, what is working today and what is not, so the new infrastructure can be designed effectively and efficiently.
Our next blog post will address Step 2 – Defense in Depth.
RedSeal Networks is playing a key part in the security component of the JIE program. Part of the JIE program is to migrate to a Single Security Architecture (SSA). The deployment of this SSA will be realized through what is commonly referred to as Joint Regional Security Stacks (JRSS). Within these stacks are integrated technology components that will provide comprehensive security to the JIE environment. The development and deployment of JRSS along with the overall JIE program will take a significant effort of consolidation and migration to realize the financial and organizational benefits. RedSeal’s role in this effort is recognized through four key use cases of the RedSeal Networks platform.
Of course I can’t speak for every board of directors, but a couple of companies on whose boards I serve have a line item on the agenda – usually during the audit committee report – to discuss cyber. Regrettably, the discussion usually lasts less than five minutes even though the headlines in the newspaper are full of corporate issues around being breached. I can’t tell if it is a lack of appreciation of how serious the problem is, or if there is even a real problem. I can’t tell if it is one of those “if I don’t ask, then I don’t have to know” problems. Solving any problem first requires acknowledgement of the problem. And the cyber attack problem is getting top billing in the news, just not in the board room.
This attack unimagederscores two vital truths:
“It’s a reflection of the age we living in. People are always trying to steal information” The main problem that encourages this kind of illegal activity is that it’s really relatively easy. Nobody thinks the hacker who stole the information from the Astros was heavily funded by a foreign government, or anything like that. Indeed, it’s quite possible the person or people involved had no more motivation than curiosity, and found it easy to get in. The challenge, of course, is that every business has secrets – how it approaches negotiation, or the pricelist for its upcoming products, or its next quarter of advertising plans. All that information is useful to others if it’s exposed. Many businesses like the Astros have treated IT security as a “high end” problem – something for banks, the military, or energy companies to worry about. But it’s just not possible to operate that way anymore – the risk of corporate embarrassment, or worse, is escalating. Attackers are finding our complex defenses are badly deployed, badly coordinated, and easy to walk through. All the attacker needs is persistence, and the search for a forgotten, unlocked “side door” onto the business can be largely automated. Defenders need to understand all the gaps, and how all the security defenses work together, even if their only target is “good enough” security. As the Astros have found, the standards of “good enough” are rising rapidly.
Collaboration at this scale is required to turn the tables on cyber criminals. The impact of today’s events should not be underestimated: this is bigger than any individual arrest. The global law enforcement community has sent a strong message to the individuals who commit these crimes – You are no longer safe to travel and operate outside of your home country, without significant risk of arrest and prosecution. Isolation is a powerful force in the effort to change behaviors. Confined within the borders of their home countries, I suspect we’ll see a change in behavior on the part of some of these criminals.
This was brought home in a powerful way when I recently attended a cyber security meeting in London. In addition to briefings with a number of industry analysts, this meeting also included a panel discussion with about 15 CISOs from various industries like finance, not-for-profit, publishing, media, banking, and manufacturing. To a person these CISOs said two things. First, their greatest need was skilled personal to run their networks. Second, their senior management was asking questions about not “if” they were breached but what they would do “when” they were breached. This shift in attitude, driven by all the news in recent years about breaches at large, household-name companies, was an “ah ha” moment for me.