Part4: The Changing Attack Surface For The US Government With Dan Lohrmann & Bikash Barai

As we navigate the ever-evolving landscape of cybersecurity, one thing becomes clear: preparedness is key. Cyber threats continue to grow in complexity, and organizations, especially those responsible for critical infrastructure and national security like the US Government and Homeland Security, must remain vigilant. One powerful tool in their arsenal is running cyber crisis drills.

In this Fireside chat, we bring you insights from two seasoned cybersecurity professionals, Dan Lohrmann and Bikash Barai. They share hands-on tactics for conducting cybersecurity drills that prove invaluable for the government and enterprise board members.

Dan Lohrmann: A seasoned Chief Security Officer (CSO) and Chief Strategist at Security Mentor, Dan has a remarkable career history, including serving as the former CSO for the State of Michigan. His journey began at the National Security Agency (NSA), making him a cybersecurity veteran.

Bikash Barai: As a Co-Founder of FireCompass and CISO Platform, Bikash brings a wealth of knowledge and experience in cybersecurity. His background includes expertise in red teaming and advisory board roles, making him a thought leader in the field.

Before we dive into the tactics, it's worth noting that this is Part 4 of a 4-part discussion. If you haven't checked out the previous parts yet, you can catch up here:

The Changing Attack Surface

The attack surface for organizations has transformed dramatically. No longer confined to office premises and data centers, the attack surface now extends to various uncharted territories. It's a shift driven by the growing remote workforce, a blend of home and office environments, and the widespread adoption of cloud technologies.

The Extended Attack Surface

As Bikash pointed out, organizations often overlook the extended attack surface. With employees working from home, even the home routers and personal systems become integral components of this surface. Understanding and securing this extended attack surface is a challenge that must be addressed effectively.

The Power and Perils of the Cloud

Cloud technology is a double-edged sword. While it offers scalability and flexibility, it also scales both security and insecurity. As organizations increasingly embrace the cloud, they need to ensure that they configure their cloud environments securely.

It's worth noting that defaults can be insecure. A case in point is MongoDB databases with default configurations left wide open to the internet. These lapses result in open databases accessible to anyone, posing significant risks.

The Need for Consolidation

The complexity of modern cybersecurity is a significant challenge. Multiple security tools and solutions are available, each claiming to be essential. However, these tools often don't communicate with each other, creating operational silos. The solution? Consolidation.

Zero Trust: The Path to Consolidation

Zero trust, a concept gaining traction, seeks to eliminate many tools by centralizing security measures. By focusing on verification and not blindly trusting users or systems, zero trust can significantly simplify the security architecture.

Cloud as a Catalyst for Consolidation

Cloud environments, as Bikash explained, provide a uniform playing field for consolidation. The transition to cloud platforms enables organizations to bring various security measures under a single roof, streamlining security management.

Response and Recovery

In today's cybersecurity landscape, it's not only about preventing attacks but also about having a robust response and recovery strategy in place. Here are some essential elements:

Backups

Regular, secure backups are crucial. They serve as a safety net when incidents occur, allowing organizations to recover data and systems swiftly.

Crisis Drills

Conducting cybersecurity crisis drills is like preparing for a fire drill in a school. The exercises help teams practice their responses, identify weaknesses, and fine-tune their incident response plans.

BCP and DR

Business Continuity Planning (BCP) and Disaster Recovery (DR) strategies should be part of an organization's preparedness. These ensure that the business can continue its operations during and after a security incident.

The Path Forward

As the conversation between Dan Lohrmann and Bikash Barai draws to a close, they acknowledge that the path forward will not be without its challenges. While consolidation seems inevitable, it might take time to see a significant industry-wide shift. However, the gradual alignment of industry drivers indicates that we're moving in the right direction.

In conclusion, the complexities of the evolving cybersecurity landscape require constant adaptation. By embracing a zero trust approach, making the most of cloud technology, and preparing for crises through drills, organizations can bolster their defenses. As the experts suggest, the future holds promise, and the journey towards a consolidated and secure cybersecurity landscape continues.

>>For more insights and discussions on cybersecurity, join CISO Platform - the CyberSecurity Community. Sign up here.

All Articles