Rethinking cybersecurity strategies.

Let’s assume that organisations have gone through three phases since 2020.

Phase I – React.

Businesses and organisations initially focus on ensuring business operations, that their employees can carry on working from home, and their customers have access to goods and services. Investments in e-commerce business are top of the agenda and managers continue to ensure that core business and supply chains were maintained.

Phase II – Rethink.

Businesses understand the changing demands of the markets and their employees, creating an opportunity for new ideas and visions. The result is a new mindset that’s fit for the future, which is achieved by restructuring product portfolios and rapidly streamlining a scalable operating model. Security risks have to reevaluated and zero trust standards prioritised.

Phase II – Renew.

In this phase, the IT organisation reviews its cybersecurity strategy. Companies redefine themselves and their underlying business models in order to exploit every opportunity to bolster the business and make the organisation and its processes more robust. Continually adapting the business to the changing business landscape and tweaking technologies and processes to adhere to laws and compliance requirements are essential in this crucial phase. IT managers must develop and implement new security concepts based on a sound roadmap, whilst business needs are balanced with the risk situation.

• ANALYSIS – Identify areas of action and analyse the current state of your IT infrastructure.
• STRATEGY – Follow your security roadmap, identify risks and adapt your strategy to the current situation.
• PLAN – Develop concepts for implementing your action areas.
• BUILD – Configure your security landscape in accordance with the three phases of the FAST transformation.
• RUN – Create a robust and future-proof operations and service concept and lay the foundations for a successful transformation.

1. Zero trust.

At the heart of this concept is the thought that everything must be checked before systems and applications can be accessed. The identity of every person, every admin account, every application, every bot and process must be validated and managed by a control process. This strategic approach demands that network, end devices, workloads and employees must fulfil all zero-trust criteria and be adapted as required. This policy is backed up by overarching visibility into the IT landscape through intelligent methods of analysis. Automation and orchestration allocate specific tasks to services, processes, applications and workloads and manage the dependencies between them. The security concept is backed up by components such as Identity Access Management (IAM) and Privileged Access Management (PAM).

2. Risk assessment.

If you, like many other organisations, have recently made changes to your corporate architecture and now use new tools for collaboration, for example, it’s time to carry out a risk assessment of your environment.

To help, the use of standardised processes and practical recommendations for action can be useful:

• IT Risk Management
• Cyber Risk Management
• Baseline IT Security
• ISO/IEC 18028 (IT Network Security)
• ISO/IEC 27005 (Information Security Risk Management)
• ISO/IEC 15816 (Security Objects for Access Control)
• ISO/IEC 27001 (Information Security in Organisations)

3. Prioritise security projects, budgets and resources.

Understanding the risks posed to your newly configured ecosystem will help you determine security project priorities and use resources and budgets more enterprisingly. Project scopes and which tasks need to be implemented with the highest priority can best be defined in workshops or with the help of an assessment and subsequent analysis.

4. Simplify and optimise the security landscape.

A multi-layered security approach with the right tools is essential, but be sure to keep measures to a minimum. Bechtle has developed a security standard based on an Advanced Security Framework, which addresses network and perimeter security as well as all zero-trust model components. Our security specialists also put organically grown networks through their paces and consider securing critical production networks. Another factor playing an increasingly important role in the development of network architectures is the consistent separation of IT and OT. We develop modern, needs-based, scalable and flexible multi-cloud infrastructures for our customers always under consideration of end-to-end security.

5. Renew and modernise the IT landscape.

Achieve your security objectives and focus on the long-term realisation of your security vision.

Implement a holistic IT security approach and make this a component of your digital transformation.

The right tools for modelling your security vision are:

• GAP analysis
• Strategic roadmap
• Concept
• Blueprint
• Target architecture plan

Summary.

Successful modelling or adapting a cybersecurity strategy is no easy task. The principal pillars of a standard security framework are good parameters for a future-proof setup—identify, protect, detect, respond and recover.

The result is a cybersecurity strategy that can keep pace with a dynamic environment. Get in touch if you’d like to make your corporate IT security fit for the future.