ESG Blogs

We all understand that zero trust is a complex initiative. There’s a wide array of use cases, supporting technologies, starting points, and strategy options. On the bright side, one of the keys to succeeding with zero trust remains something companies arguably have the most control over – collaboration across the organization. The less encouraging news? These cross-functional relationships could be better.

The identity and access management ecosystem has come a long way in the past decade, invigorated by cloud identity, customer identity, mobile identity, and open identity standards. Industry incumbents and cloud providers have made significant investments to support scalable, distributed, multi-factor enabled and decentralized identity systems.

In my first (and exciting) week at ESG, I met with a series of sharp-minded entrepreneurs and newly funded startups that are tackling the complexities of authorization, access governance, and multi-cloud identity orchestration.

The topic of network and security convergence has been front and center in the industry over the last year. The line between networking and security continues to blur, with collaboration increasing across traditionally siloed IT functions and technologies used by these teams continuing to inch closer together. One of the more notable initiatives is secure access service edge (SASE), and both enterprises and vendors alike are now embarking on their SASE journey.

Secure access service edge (SASE) has continued to garner significant interest in the market due to the need to ensure that security and networking strategies and technologies are aligned to better address the increasingly distributed nature of the modern enterprise. In this video, Bob Laliberte and I discuss some of the different vendor approaches to SASE, the balance between platforms and best-of-breed approaches, and the organizational issues users must consider with regards to SASE.

In my last blog post, I described how the market for eXtended Detection and Response (XDR) is evolving and how CISOs should approach this new and promising technology. It was good and useful information, if I do say so myself, but it didn't directly address the question of why security professionals should care about XDR in the first place.

Beyond threat detection and response, CISOs should think of XDR as a catalyst for modernizing the SOC, automating processes, and improving staff productivity.

According to ESG research, enterprise organizations claim that improving detection of advanced cyber-threats is their highest priority for security operations. As a result, 83% of organizations will increase threat detection and response spending over the next 12 to 18 months.

Somewhere around 2015, the security industry adopted a new mantra, “cybersecurity is a boardroom issue.” This statement was supported by lots of independent research, business press articles, webinars, local events, and even sessions at RSA and Black Hat crowing about the burgeoning relationship between CISOs, business executives, and corporate boards.

At the beginning of last year, I noticed that boardroom buzz about cybersecurity hadn’t really changed over the past 5 years – same old tired rhetoric and hyperbole. Hmm. Certainly, things must have progressed in that 5-year timeframe, right?

In continuing my chat with Marc Solomon, CMO of ThreatQuotient, Marc and I discuss:

1. SOC integration. At its heart, SOAPA is an integrated heterogenous technology architecture for security operations, so I ask Marc how integration plays into ThreatQ’s strategy. Marc mentions that the platform includes bi-directional integration where ThreatQ consumes and provides data. What type of data? External threat data, enriched data, event data, etc. ThreatQuotient can be used as a SOAPA data broker, acting as the single source of truth for security operations.

Mark Solomon, CMO of ThreatQuotient. and I had a chance to get together and talk SOAPA recently. In part 1 of our video, Marc gives a brief description about what ThreatQ does and then we proceed to chat about:

1. What’s the deal with cyber threat intelligence (CTI)? For every SOC manager who tells me that threat intelligence is the foundation of security operations, another says that his or her organization struggles to operationalize threat intelligence. What’s going on here? Marc believes the term “threat intelligence” is somewhat poisoned and meaningless today. The real key is to collect, process, analyze, and act upon the CTI that aligns with your organization’s infrastructure, industry, location, etc., and then integrate it into every aspect of security ops.

Anton Chuvakin knows his stuff, so I was excited to have him participate in ESG’s SOAPA video series. In part 2 of our video, Anton and I chat about:

1. Security data. I mention to Anton that many SOC teams are buried in large volumes of security telemetry and then ask if we are trying to collect, process, and analyze more data than we need. Anton responds that we have too much “dirty data” that really isn’t useful. Therefore, the challenge is understanding which telemetry is useful, how it’s useful, and which other data elements we need for data enrichment to improve the efficacy and efficiency of our analytics.