Paid Feature Ask a Network or Security Manager if their network is secure, and the answer – typically – is “yes, of course”. So says Andrew Want, Chief Technologist at Trustmarque, the UK value-add services firm.
In that case, why are there so many victims of ransomware attacks (which doubled last year, according to the UK spy agency GCHQ)? The harsh reality is, according to Want, “it’s not a case of have you been compromised. The likelihood is it’s a case of well, you have been, and what level of confidence do you have that you can quickly identify, control, and fix the breach? That’s reality. That’s the security conversation which needs to be happening.”
But how to get the conversation started? The problem is that many tech leaders find it hard to move beyond rigid tactical responses to specific, current threats and start thinking more broadly about the potential risks and the broader outcomes they want for their business.
This means considering the risk to the customer and employee experience that their systems offer, Rick Ure, Trustmarque’s Enterprise Connectivity division Head of Sales, explains. “Sometimes the risk is ransomware. Sometimes it’s loss of market share, or people choosing one bank over another because of issues with ease of use of a mobile application,” adds Ure. “Or the starting point may be as simple as recognising that we’ve got people working from home on an unsecured network accessing corporate intelligence or intellectual property.”
Silos of data are no longer static
As part of this process, companies should accept that the traditional perimeter “is no more, or it’s constantly changing shape”, says Want. Silos of data are no longer static but move and respond to different workloads. “Everything has a high degree of change…you need to be dynamic in your infrastructure to be able to support that.”
According to research commissioned by Cisco before the pandemic, 45 per cent of requests to access protected apps originated outside the business walls. After two years of mass-scale remote working, this percentage will inevitably be higher now.
This rise in external traffic might be seen as a vector for attack. But on the upside, this statistic could also suggest the confident use of cloud resources and hybrid working, both to get through the pandemic and, more broadly, as an element of digital transformation.
Obviously, a ransomware attack or other breach that freezes customer data or forces a company to halt operations, this will impact customers or suppliers. If an outage drags on, initial customer irritation gives way to concerns about the disclosure of personal data, while competitors begin to sharpen their knives to slice off parts of their ecosystem, and investors begin to worry about the future.
But there’s an internal dimension too, according to Ure. Workers have to be able to go about their jobs, accessing data and applications, whether they reside in the traditional network or in the cloud – “without the feeling I’m going to do something that compromises the organisation I work for.”
Protecting the disparate workforce
Likewise, remote, hybrid or home workers might be concerned about protecting their own digital assets, such as family photos or their digital media. An organisation leaving staff to dial into corporate systems via VPN or use their own devices is putting itself and the worker at risk. And, Ure continues, “We have to question whether we want to be part of an organisation which allows us to get infected by ransomware.”
“That’s why this security conversation needs to be a factor alongside all of the others,” says Ure. “How are my users operating? How are my customers interacting with my users? And do they feel safe in doing that? Do they feel efficient? And is that a good experience?”
Enter SASE
That’s a formidable range of issues to consider. Increasingly, the default framework for addressing them from a security point of view, is Secure Access Service Edge, or SASE.
The technological fundamentals of SASE are not hard to grasp. As Ure explains, “you’re going to have some form of network solution traditionally sat in that connectivity space, and then you’re going to have a security solution.”
The connectivity aspect may come in the shape of SD-WAN and underlying connectivity infrastructure. This will deliver a far more flexible infrastructure than traditional MPLS-based architectures.
The security element, Ure continues, “may be on-premises, but usually it’s in the cloud. It may be associated with the network, it may be more associated with what you’re putting across the network.” Essential components typically include malware inspection, next-generation firewalls, and the roll out of zero trust.
The result, implemented correctly, is a reduction in complexity, combined with the ability to set and automate network and security policy – including secure, accelerated access to the cloud resources companies are increasingly relying on.
But if defining SASE and its potential benefits is straightforward, what it means in practice is highly specific to individual organisations, in terms of their starting points, the experiences they want to protect and the outcomes they want to enable.
One problem is that security and connectivity have traditionally been very different disciplines. The larger the organisation, the more likely responsibility for each element, and the associated budget, will be held by different, even opposing, teams.
Ure thinks customers are either ”struggling because of a reduction in resources or because there are still these traditional boundaries. I’m amazed that these borders still exist to the degree that they do.”
Joining up the jigsaw
But organisations looking to embrace SASE can’t approach it in the same way they have traditionally approached security and connectivity. It shouldn’t be thought of as something that comes in a box, says Want: “It’s not like a voice solution, where it’s deploy and sweat those features.”
“It can be more helpful to think of SASE as a jigsaw”, Want explains. “And while the total jigsaw might have ten pieces, an organisation could achieve their network goals with, say, just six, some of which it may already have in-house.”
That means implementing SASE is not about implementing a particular API, installing a given set of technologies, or replacing existing solutions with a single pane of glass – all those existing products do serve a purpose, after all.
Want adds that the often key challenge is bringing these existing components together more effectively and ensuring that they are able to share and provide data effectively. Otherwise, “you’ve effectively got the pieces of the jigsaw, you just haven’t connected them together.”
So, when it helps a customer implement SASE, Trustmarque’s approach encompasses the organisation’s existing skills and technologies, Trustmarque’s own predefined templates and skills, and custom technology elements, where necessary. The company dubs this approach “standardised flexibility”.
“We have these turnkey standardised operational modules that can keep your software up to date, keep your infrastructure running, keep it compliant,” Want continues. “So, we can do that, leaving your people to develop and progress what you offer to your markets.”
“You may want some [services] to be co-managed, for example, or co-developed. So how do we start having more open conversations about the things that are going on in your business? It’s not for us to tell you what you need to do to succeed, but to have a two-way conversation,” says Ure.
The aim, says Ure, is not just to allow an organisation to feel confident that its systems are secure, whether that’s from ransomware or connectivity problems, but to “enable a business to adapt very quickly in the competitive markets they might be moving into.”
Or to put it really simply, give each customer and user the experience of “being secure in what I’m doing.” Whatever that happens to be now, or in the future.
Sponsored by Trustmarque.