Asked how defensive strategy should change if everything can't be patched, Greatwood argued for prevention over detection through zero trust and micro-segmentation. The printer example shows how to limit an infection to a single asset.
…night, it would go offline for a few minutes to get a patch. But now, you might be having to patch many times every day. And that's not acceptable to the business. So you have to start to find some more preventative methods versus just the reactive patching that you've maybe done in the past.
Well, let's dig into that. I mean, if we accept that we can't patch everything, what's the alternative? How should organizations rethink their defensive strategy?
You know, I think the absolute headline level, it's sort of shift more of the effort towards prevention rather than detection and reaction or detection and response, as people in the industry say, of course. The nature of the prevention, I think, is multiple. It's partly really strict control of who's allowed to do what. So it's no longer so satisfactory just to sort of put an asset on a network and say, yeah, I'm sure anybody who needs it, they can get access to it. Maybe they need some sort of login or something, but it's still pretty exposed on the company network or the organizational network, whatever it might be. And the kinds of techniques which have been developed in recent years, often under the heading of zero trust, if that's not too much for a marketing cliche, but that zero trust idea, leaving aside the marketing, but the idea of only allow the minimum to go through the minimum authorization, the minimum entitlement, that reduces the attack surface pretty dramatically. And then, you know, I think the thing that has really accelerated this year, perhaps even more, is this idea of…
What are your recommendations to, let's say, a CISO who's listening to our conversation who feels like they need to make some changes here, that perhaps this is a journey that they're ready to start. How do they begin? How do they prepare themselves?
Yeah, you know, I think assessing where you are is always helpful. So take a cold-eyed look about what assets you have, which you know are vulnerable. Maybe you've got some older business applications or whatever, which might be vulnerable in the future. And we've seen with the PHP problems over…
That's Duncan Greatwood, CEO at Zage Security. When you run security for a company that's scaling fast, the stakes just keep climbing. More compliance frameworks, more vendors, more risk, and a board that wants to see it all in one place. And all the information you need, it's scattered everywhere.…
