Establishing an Effective Network Security Posture Requires the Unification of Access Control, Risk Mitigation & Endpoint Remediation Capabilities

There’s a movement underway in cybersecurity today to adopt tools for enterprise network authentication. This trend makes sense. After all, authentication is just a fancy way of saying identity verification. Proving one’s identity has been a way of granting one’s access to something since time immemorial. From the secret passwords used to enter Chicago’s famed speakeasies to the retinal scanners used to clear you through airport security today – proving identity ensures trustworthiness and minimizes risk. 

Today, there are three primary methods that organizations rely on for network and application authentication: 

• Password-Based Authentication – Passwords are the most common methods of authentication. Passwords can be in the form of a string of letters, numbers, or special characters. To protect yourself you need to create strong passwords that include a combination of all possible options. Of course, humans are lazy and tend to stick to what they know…meaning the same password gets used almost universally 
• Multi-Factor Authentication –  MFA authentication methods and technologies increase the confidence of users by adding multiple layers of security. MFA may be a good defense against most account hacks, but it has its own pitfalls. 
• Certificate-Based Authentication –  Certificate-based authentication technologies identify users or devices by using digital certificates. A digital certificate is an electronic document based on the idea of a driver’s license or a passport. This is perhaps the strongest means of authentication. 

Now,  Mission Impossible fans might say  hey, wait a minute, biometric authentication is missing off this list.  They’re not wrong, but frankly we’re not really focused on physically breaching CIA headquarters at Langley to get our hands on the coveted NOC list here. Rather, let’s focus on the day-to-day use of authentication techniques adopted by employees during business hours. 

I’m On the Network: Great, Now What?

The efficacy of the network authentication methods above can be debated to no end. That’s not why we’re here. Once a person’s device is authenticated to a corporate network, there are several security considerations that pure-play authentication tools can’t address. 

For example: 

• Is the connected user an employee, guest, or contractor? 
• What’s the user’s role within the organization (i.e. seniority or department)? 
• What can the user access on the network? 
• What’s stopping the user from accessing resources that shouldn’t be available to them? 
• How do you monitor the risk posture of the connected device? 
• How do you know if that user’s device becomes infected with malware? 
• Can you prevent that infected device from moving across the network? 
• Is there a way to return a non-compliant device back to a healthy state? 

Inside that medley of questions are a grab bag of other more detailed and technically intricate considerations that network security administrators may worry about. The point is this: once a user authenticates their device to the network, how can you prevent that device from posing a risk to the organization, even if unintentional? If you’re solely relying on authentication methods for network security, the answer is: you can’t. 

Closing the Gap on Network Security Blind Spots

The list of considerations above boils down to needing three primary capabilities on top of network authentication when it comes to network security. Without these, you’re essentially flying blind, unable to determine the true security posture of your network.  

These capabilities include: 

• Access Control –  If authentication is the first step, employing access control is the second. Here, you’re aiming to dictate who can access what across your network. For example, you may not want Marketing to access Accounting’s VLAN. Why? Because Accounting’s VLAN holds sensitive financial information that has no bearing or relevancy to the day-to-day operations of Marketing. 
• Endpoint Risk Posture Assessment –  The ability to continually monitor the risk threshold of each endpoint connected to your network means knowing how vulnerable you are to compromise. N etwork administrators will typically define a risk assessment policy, which assigns a risk score to each device. This score will indicate the level of risk posed by the device, taking into consideration the status of the device’s firewall, antivirus, applications in use and more. 
• Proactive Device Remediation –  In some instances, the network security team may define a series of remediation policies. Essentially, a remediation policy consists of unattended corrective and preventive actions (CAPA), automatically applied to devices upon every transmission or on a recurring basis. A remediation policy can be used to reduce devices’ risk scores and increase compliance levels for network access. 

Unifying these Security Essentials With NAC

There is only one type of cybersecurity technology that brings together network authentication, access control, risk monitoring and remediation. That’s network access contro l (NAC). NAC, such as  Portnox CLEAR NAC-as-a-Service , unifies these network and endpoint security essentials in a single platform, and helps you fill in these critical gaps that an authentication-only approach fails to cover: 

• Device profiling for contextual understanding 
• Role-based and location-based access control 
• Segmentation through dynamic VLAN assignment upon authorization 
• Risk mitigation through device posture monitoring 
• Device quarantining based on risk score policies 
• Automated device remediation of non-compliant devices 
• …the list goes on… 

Ultimately, anything less than complete network security coverage enforced through a NAC system that brings together these essential capabilities isn’t “network security” – it’s holding on to a hope and a prayer. Rely on standalone authentication tools at your own peril – we’ll just have to say we told you so.

Cyberattacks against mid-market and enterprise organizations are on the rise. From man in the middle (MitM), distributed denial-of-service (DDoS) and SQL injections, to zero-day exploits and phishing, cyberthreats are getting more sophisticated, more prevalent and more costly. But one type of cybercrime reigns supreme: ransomware.

Not-so-fun facts about ransomware today:

• Ransomware cost the world $20 billion in 2021. That number is expected to rise to $265 billion by 2031.
• In 2021, 37% of all businesses and organizations were hit by ransomware.
• Recovering from a ransomware attack cost businesses $1.85 million on average in 2021.
• Out of all ransomware victims, 32% pay the ransom, but they only get 65 percent of their data back.
• Only 57% of businesses are successful in recovering their data using a backup. Source: Cloudwards

COVID-19 is not the only pandemic to emerge and gain a global stronghold as we push on into the 2020s. Ransomware has its tentacles everywhere. No network – corporate or personal – is immune. The financial damage being inflicted, especially at the corporate level, is only getting more and more severe. It has the potential to bring some institutions to their knees and send ripples through the global economy, eventually impacting the everyday consumer.

If we’re to right the ship, the castle walls around our ever-expanding networks must become stronger, more dynamic and more intelligent. It also requires vulnerable entities to step into the realm of psychology. What’s motivating these threat actors? What do we as an organization have that they want?

Stopping Ransomware Just as we wear masks and get vaccinated to protect ourselves from the threat of contracting COVID-19, we must take the proper precautions to limit or eliminate the possibility of a ransomware attack.

Know Your Enemy For most companies, the enemy (or hacker) just wants money. More rarely, they’re after corporate data for some personal gain – again, that could be to sell it or leverage it for other malicious initiatives that could be politically or ideologically motivated. Even more rarely, they’re just looking to tarnish your brand’s reputation.

Regardless of their intent, however, there is one simple commonality: they want to breach your network through clandestine means. The emphasis is on the network even if that network is not physical. Today, it doesn’t need to be. In 2022, your network is merely where your corporate endpoints are in use, and ultimately where data accessed via those devices is stored.

The attempt to understand the enemy has given rise to threat intelligence services that can help you profile your attackers. Such tools can determine whether these individuals have a hold on your network, endpoints and/or users. But threat intelligence alone isn’t enough – organizations need to know themselves, which requires a unified stack of security technologies and tactics that when deployed in conjunction with one another can thwart even the most sophisticated ransomware attack.

Know Your Organization Corporate endpoints serve as the initial entry points to any corporate network. These devices store proprietary, sensitive data – the hostage in this hostage taking scenario. To effectively secure the network requires instituting a bevy of endpoint security measures as part of a larger security posture strategy. Frameworks such as the CIS Critical Security Controls outline these best practices.

Ultimately, however, organizations can start with these basics:

• Use Multi-Factor Authentication (MFA) when possible; discourage the use of corporate applications that do not allow for MFA activation; use a password manager when MFA is not available.
• Have a mechanism to isolate any infected machine in use across your network to prevent lateral movement and further spread. Network access control (NAC) solutions have been purpose-built to do just this.
• Employ an email content inspection software that proactively inspects all links and attachments within incoming emails; this aids in stopping malware via phishing attempts.
• Deploy an Endpoint Detection & Response (EDR) program on all machines – managed devices, BYOD & IoT / OT – that runs 24/7 with automatic system updates.
• Ensure you’ve instituted proactive device remediation for all connected endpoints that can automatically update firewalls, antivirus and VPN services in use. NAC also incorporates this functionality.

If you follow those principles, you can win every battle. As legendary military strategist Sun Tzu wrote in his classic work, The Art of War: “If you know the enemy and know yourself; you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.”

In early December 2021, a significant vulnerability in a common piece of Java-based code by Apache set the world on fire…at least for IT security professionals. Within 24 hours of disclosure, leading software companies like IBM, Oracle, Amazon, and Cisco went into damage control, seeking to assess the level of potential damage they had and could expect to sustain, and frantically working on patches to prevent their customers’ data from being siphoned off and sold to the highest bidder. The event was fitting for 2021, a year marked by disinformation, confusion and fear.

“The log4j vulnerability is the most serious vulnerability I have seen in my decades-long career,” Jen Easterly, U.S. Cybersecurity and Infrastructure Security Agency director, said in a interview on CNBC.

As December 2021 dragged on, related flaws continued to surface, sending those same software companies back to the drawing board to repackage and test yet another series of patches for customer distribution. This after communicating initial patches to customers that often took a whole weekend or more to implement. It didn’t bode well for a happy holiday season for already resource-strapped IT teams who had been dealing with a plethora of network security issues for two years brought on by the COVID-19 pandemic and the overnight surge of remote workforces.

Depending on the version and the type of application, the log4j vulnerability’s scope and severity ranged from focused and moderate to widespread and critical. Some vendors were hit harder than others, such as Cisco, whose Identity Services Engine system saw more than 120 configurations affected. Others, like Microsoft, capitalized on the opportunity, rolling out solutions to proactively seek out and manage affected files, software, and devices impacted by log4j.

Widespread & Hard to Pin Down

The extent of the impact of the log4j vulnerability was in many ways foreseeable. The root cause: human “ingenuity” that could otherwise be called laziness. Rather than reinventing the wheel by creating a new set of code for each application that is developed, software engineers now often patch together existing libraries and packages for shared functions to generate much of the codebase that runs critical applications.

Like many noteworthy cyber incidents before it, the Log4j vulnerability helped us open our eyes to just how many software dependencies exist across enterprise systems — no matter if they are designed for security, operations, or sales. It also highlighted to us just how hard it is to mitigate and develop stopgaps for these vulnerabilities when they are so far-reaching and barely understood, especially in the early days of disclosure.

While the ability to utilize the same code across many systems does offer value in terms of time to market, the problem is that many prefabricated libraries and open-source projects are interdependent, resulting in a web of dependencies that drill down many layers. Inevitably, this creates a scenario where indirect dependencies that can be nearly impossible to identify and troubleshoot when a vulnerability is unearthed.

For the average Joe IT manager, this just means that the software you licensed was likely built using common third-party code you’re not even aware of that likely contains some vulnerabilities. Multiply this shared code across other enterprise systems in your stack – and queue the headaches.

Avoiding Issues Like Log4j as an End-User

Java is a programming language that’s been around for a while and is commonly found in older on-premises software. As such, it should not come as a surprise that the classic tech giants of the world wasted no time prioritizing the log4j vulnerability – they had billions of dollars in revenue at stake across their suites of legacy software. And to make matters worse, the issue didn’t just impact Java-based systems, but also Java components and development frameworks that rely on it including Apache Struts2, Apache Solr, Apache Druid, Apache Flink, ElasticSearch, Apache Kafka and many others. We’re talking about tens of millions of impacted systems in use at any given moment today.

How to avoid such widespread vulnerabilities is more than a question of choosing which apps are programmed with which language(s) – software engineers can debate the efficacy of each until they are blue in the face. Rather, it’s a question of how to consume enterprise software. For organizations more reliant on cloud native software-as-a service applications, IT employees almost certainly experienced fewer lost weekends dealing with the log4j problem.

This is because SaaS has a shared responsibility model, whereby both the vendor and the customer are responsible for the security of the application in use. The onus is on the SaaS vendor to deliver secure products and services, while the responsibility for configuring, managing, and using the product lies with the customer. In the case of Log4j, most of the heavy lifting falls on the SaaS vendor. They must ensure that their products are not affected. If they are, it is up to them to provide transparency into how the system is being patched and how the vulnerability is being mitigated.

While this differentiation seems simple, implementing a cloud-first IT strategy – no matter if universal or by function – can mean retaining IT talent by avoiding burnout, optimizing your IT budget by eliminating the need for third-party professional services, and so much more.

For IT and security teams with limited staff and tight budgets, cloud-native software-as-a-service (SaaS) security products offer tremendous value. Some CIOs have even mandated that new security tools be delivered in the cloud where possible. Some vendors with older on-premises products have tried to sneak in their products by claiming they are now “in the cloud,” but the truth is that that is a façade. Let’s call these products “faux” cloud security to contrast against products that are truly “cloud native.” Vendors of faux cloud products hope that with a little marketing smoke and mirrors, they can use some “cloudy” language and potential buyers will not know the difference. When we say faux cloud, technically speaking, we mean that the vendor is just allowing the customer to host their on-premises product in the customer’s public cloud account. This means the customer still must install, configure, deploy, maintain, update, and eventually decommission that product. In other words, you as the customer must do all the work. The only “cloud” aspect of this arrangement is that you can do all the work on a server you are renting (that is, paying for) from AWS, Azure, Oracle, Dell, etc.

Faux Cloud Security in the Real–World

A real-world example of this software sleight-of-hand is Cisco’s Internet Security Engine (ISE). Cisco delivers ISE as a virtual appliance to handle network access control (NAC) – a critical component of any effective cyber security stack. As of ISE’s latest version, a customer can deploy the software in their own AWS or Azure accounts. That is the long and short of it, however. The well-known challenges of setting up ISE – or any other network security appliance – remain. It is difficult to get your ISE server configured properly, ensuring it communicates with all your network equipment, even after having committed over 1,200 pages of ISE documentation to memory.

Cloud Native Reduces the Hassles

In contrast, a truly cloud-native solution allows the customer to sign up through a web page, configure as needed, and move on – the application just works out-of-the-box. Period. Now, that’s the easy part. As your organization consumes a cloud service, it does not have to concern itself with nagging issues and questions along the way common with on-premises software (e.g., How do we roll out patches and upgrades? Is there a security vulnerability in the operating system? Who is handling system backup?). You, as the end-user, have historically been responsible for these items with legacy on-premises software. Portnox CLEAR NAC-as-a-service is cloud-native – “born in the cloud” as it were. To deploy CLEAR, a customer just needs to visit the sign-up page, enter their wireless controller information, configure the RADIUS settings on the network device, and CLEAR will begin enforcing policies. Portnox customers have done this in as fast as 30 minutes from start to finish. As is true of cloud-native solutions in other domains, customers can see value in minutes, not days, weeks, or even months. No complexity. No hassle.

Knowing the Difference Before You Commit

As a potential customer, how can you distinguish cloud-native from faux cloud security software? There are a few telltale signs. The table below summarizes some of the most salient differences. When you evaluate a new vendor, be sure to ask questions such as who is paying for the infrastructure? Who is responsible for updates and upgrades?