Architecture matters. This is true across many aspects of our lives, from buildings to software to cybersecurity. For example, we have all encountered buildings that have been retrofitted or remodeled, and as a result become awkward and inefficient. For example, on a recent trip to New York City, I visited a building that had been designed and constructed in the 1920s in fabulous Art Deco style. But 100 years later, the lobby area was cramped and overly crowded with barriers, checkpoints, and security screening hardware. This once airy and elegant lobby was simply not designed to accommodate today’s X-ray machines and metal detectors, and suffered as a result.
Like buildings, cybersecurity program architecture matters. By program architecture, we mean the organizational structure, processes, tools, and information flows that are used by an enterprise to execute a given function. Cybersecurity architecture manifests itself in ways as simple as a reporting hierarchy, or in more complex ways such as task handoffs between teams, or a set of tools, technologies, and partnerships.
There’s an art to creating a cybersecurity program that can smoothly handle unknown or unexpected changes. This in essence is the definition of future-proof, which should be the goal of every cybersecurity program. But how do we achieve this? This two-part blog explores this concept and provides guidance on how best to approach future-proofing your cybersecurity.
Change vs. Cybersecurity Architecture
We live in a world of constant and accelerating change – and few areas move faster than cybersecurity. One of the hallmarks of change is that it often occurs in unexpected ways, or on unpredictable timelines. While we can’t predict every change, we can anticipate change will happen. And we need to architect our cybersecurity teams so that they're equipped to handle it. So, what types of changes are out there and how do they impact your cybersecurity program?
- Changing threats
Our world’s threat actors are unfortunately pervasive, and often well-funded and persistent. This results in an evolving set of tactics, techniques, and procedures which we need to be aware of – and able to detect and mitigate. For example, adversaries have recently developed technical and non-technical ways to perform MFA bypass attacks, which we now need to counteract. - Technology changes
New technologies bring exciting opportunities, but also associated threats. Whether it’s threat actors exploiting vulnerabilities in new technology, or using it maliciously for their own gains, it’s vital that organizations are able to defend themselves. For example, AI has rapidly spawned new deepfake attacks with highly believable voice or video mimicking colleagues. Effectively defending organizations against these kinds of threats requires both technology and process changes. - Economic and political changes
Global and regional economic and political forces make up the business climate in which all enterprises operate. Any changes or developments will ultimately impact cybersecurity programs. For example, political attention on your firm or industry sector could make your enterprise a prominent target for criminals, hacktivists, or nation-state sponsored actors. And economic challenges in specific areas could increase the number of fraud attempts in a given region. - Organizational changes
Enterprise budgets, priorities, personnel, and organizational structures are frequently adapted to better support business goals. For example, many organizations undergo merger and acquisition activities (including spin-offs) that have a major impact on people, reporting structures, priorities, and budgets, not to mention tools, working styles, and philosophies. These types of changes must be anticipated and integrated into the cybersecurity architecture - Unknown changes
By definition, these are changes that we can’t anticipate or control. Our ability to handle these unexpected events is a test of our overall readiness and flexibility. The clearest example of this is the COVID-19 pandemic, when organizations were forced to shift to remote work almost overnight. This same shift had to happen in cybersecurity programs – not just from an operational standpoint (with remote employees), but also from a scope perspective. From one day to the next, enterprises were faced with very different network and user access methods, presenting new vulnerabilities to monitor and defend.
Architecting for Change
Now that we’ve defined the five types of change that impact your cyber defenses, we’re ready to explore how to architect a program capable of handling them effectively. Future-proofing isn’t just about anticipating what could happen. It’s about creating adaptable structures, processes, and tools that empower organizations to respond to change – much like an architect designs a building with longevity and adaptability in mind. In the second part of this blog series, we’ll delve into actionable strategies for architecting a resilient cybersecurity program – one that stands the test of time and keeps your organization secure, no matter what changes come along.
Check out Part 2 in the blog series. If you have any questions in the meantime, our experts are here to help you.