5 Ways to Secure the Digital Core of Your Business
The infrastructure that keeps your business running is similar to the ropes, pulleys and sets behind the scenes of a stage play. These mechanisms must be in good working order and actions must happen on cue to create a seamless experience for the audience.
Your infrastructure, the digital core of your business, is comprised of critical business processes, data and transactions. It is what keeps your business operating behind the scenes. If you can’t pull the curtain up, the show cannot go on. If your digital core is compromised, then revenues, and possibly the ability to remain in business, are also jeopardized.
The ropes and pulleys of your digital core comprise many tiers of your production systems, including:
- Data storage
- Network devices
- Servers
- Gateways
- Load balancers
Disruption or outright failure at any tier would threaten to paralyze the entire digital core. For example, if your gateway or API server were to be compromised or shut down unexpectedly, or your third-party data supplier’s system were to stop functioning, then the applications that have dependencies upon those APIs also would fail. Therefore, these third parties should be included within your digital core.
For instance, a credit card company decided several years ago to offer an innovative promotion with the goal of extending the desirability of its brand to important new demographics. The program was a raving success—that is, until the CEO started receiving angry letters and e-mails. It turns out that blocks of users were prevented from taking advantage of the promotion without any explanation.
The company had no previous knowledge that there was a problem. It took about a week to track down the root cause of the failure, which turned out to be an API call to a tax table supplied by a third party. Needless to say, the negative experience combined with the bad press attributed to the failure greatly undermined the goodwill intent of the promotion. The moral of the story: Your digital core extends beyond your physical data center.
For your business to function properly, it is critical to build in redundancies and protect this digital core within all tiers. Security professionals agree that there is no such thing as one silver bullet for defense. Instead, a comprehensive defense-in-depth strategy is strongly advocated. Although most businesses do a decent job of defending applications using defense-in- depth principles, they often fall woefully short in applying those same principles across the full extent of their digital core.
Businesses often have little knowledge of all the root/control access credentials residing within their digital core when working with SSH and RDP, for example. That’s like locking the front door but leaving the back door unlocked. In this day and age, it’s only prudent to assume that bad actors are checking all doors to gain access. In fact, evidence suggests that these unmanaged and unmonitored back doors are the principle targets of bad actors, both internal and external. Therefore, IT security professionals must take care to apply defense-in-depth principles across all tiers of the digital core, both on-premises and in the cloud.
Protecting Your Digital Core: 5 Best Practices
- Inventory all the existing access to your digital core. But don’t stop there: Understand the process of granting new access. How is that process controlled? How can these processes be bypassed? If they are bypassed, how would you know?
- Inventory all of the elements of your digital core. Don’t forget API or cloud dependencies. Start with your network and map it all back to your databases. For this exercise, it is best to use a large whiteboard with lots of space.
- Take old, unused or low-encryption access credentials out of your entire environment.
- Implement multi-factor authentication (MFA) as part of your privileged access strategy.
- Decrypt traffic and send it to your other security tools for inspection—DLP, SIEMS, malware, antivirus, etc.
Securing the digital core of your business must include extending your defenses across all tiers of infrastructure. To make sure that your show goes on, employ best practices such as those described above.
