Recently I asked my Twitter followers to quickly check the temperature down in Hades... because there simply had to be icicles hanging from the rafters after I saw this first tweet in response to my BYOD post.
What transpired afterwards, if you didn't get a chance to follow our conversation, is a realization of some of the hard truths behind today's highly agile enterprise environments... check this out:
All joking aside, my jaded pal has hit the nail dead on the head - "...Treat it all as hostile instead of nitpicking controls". Think about the reality that this presents us with.
Remember back to the last 10 years of building networks and how we've always separated the trusted corporate asset from the untrusted non-corporate asset. Now as corporate asset begins to lose its meaning as far as physical devices goes, and a glance back to the mobility of corporate assets from the "trusted corporate network" to a coffee shop, to a home network, to who only knows where... is that asset still trusted when it comes back to the corporate network? What proof do we have of this?
Our proof to attach the trusted label to corporate asset that's migrated off of our network for any period of time (or even one that never leaves!) is the staggering amount of bloated agents we keep loading onto these assets. Laptops so weighted down with antivirus, personal firewall, endpoint encryption, user management and on and on and on to the point where it's barely usable.
The result? We're still getting compromised left, right and center by devices that we are delusional enough to think we can trust because we feel like we've got sufficient control over them... where does it end?
Right here, right at the point where we become cognizant of the fact that no asset, corporate or otherwise, should ever really be trusted. We should be treating each asset as potentially compromised (or as we put it above, hostile) at all times.
What a liberating feeling, when you finally make your peace with that.
Applying uniform controls can severely uncomplicate things... in so far as there will be less policies, less chance to apply the wrong one to the wrong type of asset, and less complication leads to better understanding and better risk management.
That's my opinion... and I agree with the two colleagues - absolutely we should be treating every object as potentially hostile. What does that mean for your organization today?
Perhaps we can start to collapse our data protection strategies down to the individual data elements? Perhaps we can rely more on enterprise visibility (logging, analysis) and our ability to be resilient (already addressed in previous blog posts, more to come) rather than trying to determine whether we trust a specific asset or not. What if the answer was always a hearty "no"... would life in IT Security be better?
I think the answer is yes. Without sounding overly dramatic I think this is where better security, resiliency, and ultimately smarter more agile enterprises start. With realizations like these...
Cross-posted from Following the White Rabbit