Breaking Down the Cyber Journey: A Guide to Adopting Systems that Work For You

Gaining a clear understanding of how to focus your time and energy continues to become cumbersome. With the everchanging landscape of technology, staying competitive is already complex enough. Now add Cybersecurity to the mix and things get even more convoluted.

Recently, AutomaTech and Nozomi Networks hosted a webinar on how to navigate the complex Log4Shell vulnerability. During the webinar, the audience was asked a series of questions designed to better understand three main elements of an organization’s cyber strategy within IT/OT/ and IoT: organizational readiness, technology adoption, and technology expertise. This post is designed to help ignite the conversation around where you may be in your own cyber journey and how to further evolve.

Step 1: Create a baseline of what strategy is in place

Like all journeys, you need to know where to start and where you are heading. Take a moment here to define what you want the end result to be, do not focus on the details yet.

For example, “We want to know what we have and be able to protect from outside attacks. We would also like to know where to focus without having to redo everything”

· It's imperative to know what the strategy is on a local level

· Must understand how local strategy fits into larger scope

Step 2: Make note of all inefficiencies in both strategy and process

Now that you have an idea of where you want to get to; how far away is it from where you are now? You may need a “map” to figure it out. The NIST framework is a very good starting point. The NIST ICS framework breaks things down into 5 actionable categories.

1. Identify

2. Protect

3. Detect

4. Respond

5. Recover

Back to the beginning Step 1 (Identify)

Where are gaps in the solution?

Look at each step and evaluate what you have in place and what is missing or needs improvement

Step 3: Create a mind map of all tools and systems related to your strategy

Having a mind map helps you understand where systems communicate and where they don't

Building on your initial framework, you can start understanding where key processes and tools falls within the framework. Going through this exercise with your internal teams will start to shine light on gaps in processes and any overlap that exists. The outcome is a deeper understanding of your own eco-system.

Don’t get caught up on how to facilitate a mind map, what’s more critical is ensuring you have the right people in the room and are able to open the conversation around the framework that works best for you. Allocating the right amount of time can help break barriers of understanding and help begin putting the pieces of your eco-system together.

Create an inventory of software and work with vendors to understand the impact of log4shell

To better understand what applications are impacted by Log4Shell an inventory is critical to cross reference any affected applications and systems provided by the vendors. At this point, most if not all vendors have provided clear indication of the impact of the Log4Shell vulnerability. Outside, of just log4shell, the best practice is to gain visibility into what exists. There are several tools that automate visibility, but if they are adopted too early, the tools will only add to the complexity and will not give you a clear picture of the eco-system.

This is typically where gaps can be uncovered between teams and infrastructures. Some people have certain context, and if the right cross-functional team is developed, it could speed up the process and ensure everyone has a better handle on all things inventory. Then automation can be valuable. Having 24/7/365 inventory will help continue the evolution of internal processes and understanding of what steps need to be taken to remedy any gaps.

Step 4: Determine which systems overlap and where and fill gaps

Some systems will overlap but cannot be replaced because of how critical they are. It's key to understand these systems and how to ensure you're maximizing value from them.

Once a mind map is developed, a key framework is adopted, and inventory is constructed, you can begin looking into dependencies, inefficiencies, and gaps. This is where the real magic can happen. Typically, overlaps will exist and sometimes, tools that have become the status quo can be deemed redundant with no added value. The goal, once again, is to create the conversations and understanding of the architecture, communication paths, and features that each system fulfills. Don’t be shy to include one or many vendors in these calls to drive alignment your adopted framework.

Organizations typically believe one system will solve all their problems, but reality shows that no “one size fits all” exists and every set of requirements is different.

This is a key item to note. There is no “one size fits all” or “system that does everything.” If a vendor suggests this, their solution has several features that probably only go surface deep. In certain circumstances this may be sufficient, but the key is to understand your needs and your strategy. Vendors can help educate and guide, but most do not extend this, even while charging. If certain vendors are willing to go that extra mile and learn about your environment to help devise a strong scalable eco-system in a collaborative way, then the vendor is probably looking more like a partner to scale with.

Step 5: Setup consistent evaluation of evolving strategy

What happens next when a strategy has been adopted?

Once a well-defined strategy is adopted by the many teams involved, the work doesn’t stop there. You must consider that the cyber landscape is ever-changing and will require tweaks throughout. The

number one idea is to have a strong foundation where small incremental changes will not seem daunting. There must be a continuous cadence to evaluate the strategy as time goes on.

Step 6: Ensure training is available to key players

With new systems in place, you want to ensure that the right daily users are maximizing the value within your org.

If your org continues to depend on your vendors for any changes within their tools, then you become too dependent. The real sweet spot is when there is a strong understanding of the joint strategy and the needs of your facilities / networks, then working with vendors that will help guide and enable your team to solve problems, create strategies, and evolve processes. The key to this is to take advantage of any readily available trainings and clearly designate roles and ownership of different components within your cyber strategy. Internal experts will help bridge the gap along with the necessary services from your vendors.

We all continuously hear about the cyber journey and its large impacts on our organizations. People adopt technologies rapidly and hope to build strategies and processes around tools and technologies. In this ever-changing landscape you do not want to be Pidgeon-holed by a tool, but rather you want to ensure the partners you choose will continuously enable your strategy and help fill the gaps of the frameworks you adopt. It’s a long-term play where cultural changes will occur, and the goal will be to have the tools at your disposal for everyone in your organization to be well-equipped to contribute as their roles define.

Contact us at solutions@automatech.com if you would like to review your specific use case with a Solution Architect. 

Considerations for Running Critical Applications Successfully and Securely in the Cloud

To modernize processes, enable quick innovation, and spur growth, almost all businesses have adopted the cloud. The following factors should be taken into account when choosing a solution to control your risks when running your critical applications in the cloud:

1. Can the solutions be applied across all clouds and other cloud-native security solutions?

The wide choice of security service offerings from the cloud service providers (CSP), which are quick and simple to deploy, are frequently used by businesses to secure their cloud resources. To reduce integration friction and increase value, businesses should think about solutions that also interface with the cloud-native security services and technologies they have already purchased from the CSP.

Businesses should search for solutions that provide the most extensive integration amongst the main clouds. This gives them the ability to manage their workloads on a single platform with constant security and user-experience across all of their clouds. With only one platform to study and develop expertise on, outcomes are more predictable, and cloud security operations are more effective.

2. Can the solutions give you a prioritized list of the most important security concerns to pay attention to?

It is important to not only have a broad understanding of all potential new and emerging risks but also to have insight into the most important ones that need to be mitigated as well as to accept controllable risks.

The best solutions integrate with other security tools and services in order to correlate and normalize security information produced in real time by various security technologies across cloud environments, taking into account security posture, vulnerability, permissions, and threat signals to produce a normalized risk analysis.

3. Can the solutions address the threats and simplify security operations?

Solutions that use integrations with other security solutions and services should be simple to activate, cloud-agnostic, and not require expertise in advanced security technologies when it comes to simplifying security.

To reduce security coverage gaps across all major cloud environments, solutions that enable uniform workflows are crucial. These solutions free security teams from having to learn the nuances of each cloud platform and its corresponding security service.

4. Can the solutions be integrated into a mesh platform for cybersecurity?

Organizations are faced with more complexity and decreased visibility as more applications and workloads are deployed in the cloud, leading to blind spots when managing both on-premises and cloud deployments. A cybersecurity mesh platform that integrates with cloud-native integrations is essential to solving this problem. An automated, comprehensive, and integrated cybersecurity platform can assist businesses in integrating enterprise security with cloud deployments. Organizations can gain from centralized administration and visibility, uniform regulations, automatic response, and operations over the length of their deployment thanks to this potent combination. In the end, this contributes to closing the cybersecurity skills and resource gaps that many organizations have by enabling businesses to respond to threats faster and more effectively by utilizing artificial intelligence and machine learning.

How Can AutomaTech Help You

AutomaTech is here to help on your Industrial Internet Journey by transforming your business and transitioning to become a digital industrial company.  By connecting machines, intelligence, and people, the Industrial Internet is reshaping the way industrial companies do business.  The Industrial Internet simplifies connectivity from sensors, HMI/SCADA systems, Historians, databases and other sources to the Cloud to take advantage of powerful tools and analytics.  AutomaTech can help you get started with various solutions for Edge Connectivity, Monitoring & Optimization, Analytics, Asset Performance Management, Field Service, and much more.  Click here to find out more.