Establishing A Digital Immune System

In the rapidly changing reality of cybersecurity, one of the few things which seems to remain an absolute constant is the fact that threat actors are consistently becoming more sophisticated, and the risks to a business’s digital estate consequently more severe.

Faced with this relentless pressure, it can be easy for business leaders and cybersecurity decision-makers to fall into a mindset of always seeking to improve and strengthen the defences they have. Cybersecurity strategy, however, is not just about finding better answers: it’s also about making sure that you are answering the right question.

What does that mean in practice? Not too long ago, it would have been fair to describe the typical approach to cybersecurity as being like defending a castle. It was about shoring up the organisation’s walls, finding new ways to repel attackers, scanning the perimeter for potential weaknesses, and knowing how to drop the drawbridge quickly if - and only if - the person trying to get in is trustworthy.

Leaving The Castle

That all made sense when enterprise IT had a clear, well-defined core to defend. As businesses have increasingly relied on cloud computing, SaaS, and remote access in their IT infrastructure, however, the shape of the digital estate has become much more diffuse, and will only become more so as emerging trends like edge computing come into full force.

Now that there’s no definite perimeter to defend, it’s little wonder that new metaphors and big-picture ideas are everywhere in cybersecurity right now. One of the most interesting and fundamental is the trend towards thinking in terms of establishing a digital immune system, or DIS. Named as one of Gartner’s top ten strategic technology trends for 2023, a DIS shifts away from the front-line prevention focus of traditional cybersecurity strategies and instead thinks in terms of responding to and recovering from breaches, bugs and failures as quickly, effectively, and painlessly as possible.

Like a human immune system, DIS assumes that any barriers between the inside and outside of a system will be breached, and aims to notice and react to those events as necessary. Mimicking a human immune system, DIS aims to be highly flexible and agnostic to the cause or source of damage, as what really matters is the recovery. And, as with its human equivalent, the ultimate goal of DIS isn’t to tackle problems for their own sake, but to keep the body’s systems functioning for as long and well as possible - meaning that an awareness of proportional response and overall business impact is built into its thinking.

In other words, DIS is useful in part because it creates resilience regardless of the shape that a business’s IT infrastructure takes on.

At the same time, one thing that makes it a really interesting proposition today is the way it also targets the growing consequences of security breaches, alongside bugs and other flaws. The specialist technology insurer Parametrix recently found, in a survey of corporate decision-makers, that the median respondent said that IT downtime would cost them around £10,000 per minute. In that context, the value of designing to recover from, and not just prevent, downtime is glaringly obvious.

Building Immunity

Like other big ideas in cybersecurity, DIS does not signify any single technology, tool, or idea; rather, it is a collection of interventions, some new to the field and some very well-established, which are united by a common organising principle.

From my perspective, businesses looking to implement DIS should start by introducing advanced, field-tested methodologies to their human workforce. Chaos engineering, for instance, simulates random or unpredictable failures in infrastructure to vet how quickly systems and the teams responsible for them can achieve recovery, while site reliability engineering brings software-like flexibility to hardware-based operations. 

Taking this a step further, businesses can look to explore AI-powered testing and remediation tools, which automate the discovery of potential issues on the one hand, and the repair of active failures on the other. Through focused investment in groundbreaking technologies such as this, we can take steps towards creating organisations that are not only resilient, but can pinpoint and rectify IT incidents before they cause disruption. This is the future we’re ultimately striving towards: the self-healing enterprise.

The essential element that underpins all of this is monitoring and observability. The immune system analogy holds once again: the body has many ways of solving damage and infection, which operate according to various timescales and levels of severity, but they all start with noticing the problem and triggering a response as swiftly and accurately as possible.

Once information about technology performance - which might range from hard disk read times to user dwell times - is integrated into a unified, granular, and holistic platform, businesses will be in a position to start truly targeting recovery and resilience, rather than just investing endlessly in tools to forestall the inevitable failure.

The DIS won’t replace front-line defences entirely - but it will make the damage that breaches do to users, reputation, and revenue less severe.

Matt Tuson is General Manager,EMEA at LogicMonitor                                   Image: John Barpikle

You Might Also Read: 

Protecting Your Company’s Data Against Insider Threats:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« LockBit Hacked British Military Data 
The Unique TTPs Attackers Use To Target APIs »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

ThreatConnect

ThreatConnect

ThreatConnect is an enterprise threat intelligence platform by Cyber Squared bridging incident response, defense, and threat analysis for InfoSec & DFIR teams.

QTS

QTS

QTS Realty Trust, Inc. is a leading provider of secure, compliant data center, hybrid cloud and managed services.

ISC2

ISC2

ISC2 is an international, non-profit membership association for information security leaders. Our information security certifications are recognized as the global standard for excellence.

App-Ray

App-Ray

App-Ray provides fully automated security analysis of mobile applications to find security issues, privacy breaches and data leaking potentials.

Auth0

Auth0

Auth0 is a cloud service that provides a set of unified APIs and tools that instantly enables single sign-on and user management for any application, API or IoT device.

IT Career Switch

IT Career Switch

An IT Career Switch Traineeship is the easiest way to start a new career in IT or Cybersecurity with fantastic career prospects.

CM Blockchain Security Center

CM Blockchain Security Center

We are dedicated to building a healthier blockchain ecosystem, providing solutions to security technology, and helping those who practice in the area of blockchain to get insight into industry trends.

CliftonLarsonAllen (CLA)

CliftonLarsonAllen (CLA)

CLA exists to create opportunities for our clients through industry-focused advisory, outsourcing, audit, tax, and consulting services.

WhiteJar

WhiteJar

WhiteJar offers an innovative approach to modern cybersecurity needs, empowering Ethical Hackers within its unique crowd platform.

Securonix

Securonix

Securonix delivers a next generation security analytics and operations management platform for the modern era of big data and advanced cyber threats.

U2opia Technology

U2opia Technology

U2opia is a consortium with a proven track record of delivering groundbreaking technology, cybersecurity, and innovative business solutions.

Conceal

Conceal

Conceal’s mission is to stop ransomware and credential theft for companies of all sizes by developing innovative solutions that provide social engineering protection in any browser.

Cura Technology

Cura Technology

Cura Technology offers a wide array of security solutions meticulously designed to address specific facets of your security requirements.

ZeroGPT

ZeroGPT

ZeroGPT.com stands at the forefront of AI detection tools, specializing in the precise identification of ChatGPT-generated text.

Opkalla

Opkalla

We started Opkalla because we believe IT professionals deserve better. We help our clients navigate the confusion in the marketplace and choose the solution that is right for your business.

Viatel Technology Group

Viatel Technology Group

Viatel Technology Group is a complete digital services provider. We have over 26 years’ experience delivering fully managed security, networking, cloud and communications services.