Defence in depth includes the platform
Jul 22nd, 2024 by Jesper Kråkhede
Following the massive outage last week, a few thoughts for management.
The reflex after an event like this is to look for someone to blame and something to replace. That is understandable, but it misses the point. Any vendor can make a mistake. The question is whether your organisation can survive it.
Defence in depth has always meant several layers of protection, so that one failure doesn´t mean a breach. It also has to mean several layers of resilience, so that one failure doesn´t mean a standstill.
Trust the platform. Modern platforms, with protection built into the operating system, identity and the cloud, are generally safer than piling on separate tools. Fewer agents with kernel access mean fewer things that can break.
But make sure all the parts are there. Protection, detection, response and recovery. Many organisations invest heavily in protection and very little in recovery. Last Friday showed what that costs.
And monitor the platform itself. Your security tools are part of your critical infrastructure. Watch their health, their updates and their behaviour, just as you watch everything else. Who checks the guard?
Finally, review your contingency plans. How do you work when every computer is down at once? Who decides what comes back first?
Protection that can stop your business is a risk too. Manage it like one.