Productization of Cybersecurity
It's been said that two mindsets rule the Financial World: “Fear and Greed”. In the the world of Cybersecurity there's just one: “Fear” - focusing on the “quick fix”.
Increasing Threat Environment
The current environment has brought with it an increasing escalation of cyber threats in the form of Ransomware as a Service (RaaS), Supply Chain Attacks, Advanced Persistent Threats, to name just a few. This reality has created an environment of acute fear within companies, who will often jump at any technical product to “solve” the threats of cybersecurity.
The flaw with this approach is that the “problem” of cybersecurity is far beyond one product’s ability to solve. The technical attack surface of nearly every networked device from servers to workstations to tablets, phones and IoT devices have two things in common: they utilize the OSI Model and have both TCP and UDP ports.
An Enormous Attack Surface
The Open Systems Interconnection (OSI) Model is a conceptual representation of the interrelationship of information technology devices and systems. There are seven abstraction layers to the OSI Model: Physical, Data, Network, Transport, Session, Presentation, and Application. Designed in the 1970’s it was amazingly prescient in anticipating how people, companies and networks in the future would communicate with each other and move data across the world.
Each of the seven layers has protocols that operate within them, moving information from one networked node to another. This data commonly uses Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP) ports to transmit information from one endpoint to another. Both TCP and UDP range from 0 to 65535 possible port numbers. Well known, commonly used protocols use defined protocol numbers.
The seven layers of the OSI Model with 65535 TCP and UDP ports are what companies have to defend on each device they use. The added complexity associated with remote working, cloud networks, perimeter-less networks presents companies with additional risk that is often not even considered or accounted for.
What this means, without going into great technical detail, is that there is a large and dynamic attack surface on every device, network and technology that must be identified, understood and protected.
No "Magic Bullet" Product
No one cybersecurity product can cover the entire attack surface that exists in every company. Most technical cybersecurity products are only capable of assessing a few layers and protocols within the OSI Model.
The Most Effective Approach
There are many excellent cybersecurity products out there - but no one product that will solve everything. It’s better to use multiple products, working in tandem to solve the technical issues of cybersecurity. When this is added to a yearly technical and procedural cybersecurity assessment, companies are provided with the best intelligence to protect their systems and reduce risk.
