docplayer.pub

DYNAMIC CYBERSECURITY.REDEFINING THE SECURITYOPERATIONS CENTER FORA DIGITAL WORLD

HCL Cybersecurity White Paper1.Introduction2.From static to dynamic Focus on adaptive security processes Focus on threat prediction and proactive prevention- Case study Focus on the fusion of intelligence and expertise Focus on continual assessment Focus on frictionless security- Case study3.HCL Dynamic Cybersecurity Framework Dynamic security reference architecture Technology and product management Machine learning enabled, automation centric solutions Smart security operations Information security, governance, and analytics- Conclusion4.About HCL Technologies2

HCL Cybersecurity White Paper3INTRODUCTIONWe are living in an age driven by innovation- a hyper-connected world powered by digital transformation.It’s based on technologies such as cloud computing, big data, mobile, social media, the Internet of Things (IoT),machine learning, and artificial intelligence. In a world that has become increasingly dynamic, businesses aroundthe globe are pursuing innovative strategies to grow, gain market share, satisfy evolving customer demands,and maintain competitive advantage.In such a world change happens fast, so speed and agility are essential. In turn, this means the underlying ITlandscape must evolve to keep up. Companies are boosting efficiency by taking advantage of new cloud-basedapplications, as well as releasing software updates far more frequently. They are constantly evolving andadapting to embrace new opportunities and experimenting frequently.At the same time cybercrime is growing and becoming more sophisticated. It is predicted that cybercrimedamages will cost the world 6 trillion annually by 2021, up from USD 3 trillion in 2015. In addition, CybersecurityVentures predicts that a business will fall victim to a ransomware attack every 14 seconds by 2019.Against this backdrop, the dynamic nature of today’s IT environments, whilst necessary, must also be seen asa potential risk. Every single IT change potentially impacts the security of the organization. One single softwaremodification, left in a silo or done in isolation, can become a chink in an organization’s security armor and resultin a disastrous breach.Protecting this dynamic IT environment requires a complete rethink of the Security Operations Center (SOC) andhow it operates, in order to protect organizations from the continuing threats to which they are exposed.

HCL Cybersecurity White Paper4FROM STATIC TO DYNAMICTraditionally, the ethos of the SOC has been to prevent, detect, and respond to threats in a static and predictableenvironment. This was fine whilst the rest of the IT environment was static and predictable too.But today’s IT environments are not like that. They are dynamic and constantly changing. A static, predictablesecurity stance will simply not be able to keep up, exposing organizations to all sorts of threats.Today the SOC needs to be dynamic, working at the speed of innovation and change within the organization,constantly being vigilant against threats while simultaneously looking for ways to strengthen security.The question, however, is how to achieve this dynamic security environment. At HCL we believe SOCs need tofocus on five key areas.1. Focus on adaptive security processesAt the heart of a dynamic security environment is the abilityto implement adaptive security policies that quickly alignwith the rapid changes in user scenarios, the threatlandscape, and the underlying IT landscape.Through analyzing past and present activity data, as well asmultiple external and internal threat feeds and threatintelligence, systems can then use workflow orchestrationand automation capabilities to set security policies thatadapt to changing scenarios.Say your firewall policies are static in nature with a given setof rules that remain the same under all circumstances. Bysynchronizing the policies with adaptive security processes,the rules can be configured to adapt to changes in the cyberlandscape.For example, if an enterprise environment is under attack,self-adapting firewall or protection policies will allow ordeny access to any network connection to critical servers,without any manual effort or action. They also self-learnabout the impact of attacks which are constantly validatedbased on feedback from human engineers.2. Focus on threat prediction and proactive preventionAs organizations undergo digital transformation the volumeof data they process and generate on a daily basis can makeit incredibly difficult for SOC teams to monitor wherethreats are coming from, or identify the signals of cyberattacks that are under way.However, using predictive analytics to analyze historicaldata – combined with threat modeling and machine learning– organizations can now forecast the probability of anincident to occur. Such solutions don’t just show wherecyber criminals have tried to attack in the past, they alsoenable security managers to see where they are likely to hitnext, where their weak points are, as well as how wellprepared they are to counter an attack before it’s too late.This ability to predict attacks- combined with dynamicsecurity operations that proactively act on the insights thatare revealed- helps enterprises maintain a dynamic securityenvironment that supports secure growth in times of achallenging threat landscape.As threats travel across clients and networks, they don’t justhappen or infiltrate overnight. Usually, attackers performreconnaissance about how to exploit the target networkover a period of time, sometimes months. And, as theymove through the network, they leave identifiable signs.This local knowledge, combined with global threatintelligence and HCL’s CyberSecurity Fusion Centers, allowspotential threats to be identified.Once HCL’s security platform is connected, it looks forevidence of malicious intent and suspicious activity. When itidentifies a potential threat it flags it to security experts,who do more detailed analysis. Through this process we areable to predict potential attacks before they occur.Case study:HCL has transformed the security posture of this F500organization in line with realities of today’s dynamic securityneeds. Catering to the needs of defense in depth, HCL hassupported the client with proactive prevention capabilities.Through an intelligence fused security operations center,HCL is enabling the client to predict threats and act on themfaster than ever before. Also with a focus on assessing theefficiency of security controls and policies, we have helpedthe client become more resilient against future threats.

HCL Cybersecurity White Paper53. Focus on the fusion of intelligence and expertiseDigital business in the innovation age will be driven at anaccelerated speed. Decisions will be made in an instant andexperiments will be run rapidly. Business can ill-afford towait for cybersecurity teams to catch up.In this environment SOCs need to collaborate with otherteams to build adaptive, embedded playbooks and policies.At the same time SOCs require expertise from other parts ofthe organization – such as network, cloud, apps, platforms,mobility, and workplace teams – so they are aware ofchallenges and response mechanisms.Many enterprises have successfully found an answer bysetting up "fusion centers" which are SOCs designed tocollaborate with teams from other IT and Businessdisciplines, and fuse the gathered intelligence to enhancesecurity.Today, HCLs CyberSecurity Fusion Centers act as a singlepoint of contact for the complete security incident lifecycle.The centers fuse threat intelligence with state-of-the-artsecurity technology platforms and the expertise from highlyskilled security professionals. The capabilities of theseCSFCs are highly scalable, across multiple security teamsand teams managing IT Infrastructure such as data centers,networks and workplace computing. Sophisticated securityapplications closely monitor each customer environment forsecurity incidents and if a threat is found, the CSFCs workclosely with other disciplines to orchestrate the appropriatesecurity action.4. Focus on continual assessmentIn a constantly evolving and dynamic threat landscape,continuously assessing the efficiency of controls, policies,and user awareness is essential.This can be achieved by running an advanced analyticsplatform that is integrated with multiple sources of dataincluding internal threat intelligence.For example, a policy status analysis can be used tomeasure the efficiency of the controls that have beenimplemented and, as the analytics platform receives thefeedback, rule set definitions and control configurations canbe improved.By integrating data from phishing assessments run on usersand employees, user awareness can be assessed. Usingin-the-moment pop-ups not only help to measure userawareness, but also enhance it in real time.By capturing all this information organizations can gain aclear view of their security posture in relation to their statedcybersecurity strategy, which enables the Chief InformationSecurity Officer to have meaningful discussions with otherstakeholders about the state of the enterprise’s securityreadiness and areas for improvement.As a part of the Dynamic Cybersecurity Framework, HCLhas implemented analytics-driven continual securityassessment platforms at leading enterprises around theworld. For these companies HCL security teams constantlymonitor their environments in near real time to identifychanges and assess if they compromise the confidentiality,integrity or availability of their applications, data andinfrastructure.For example if a user clicks on a phishing email, is theimpact isolated to the user or do the effects proliferatethrough the network and impact a larger set of users andsystems? With such insight appropriate action can be takento limit the impact of such threats and even entirely preventthem from occurring.