Hybrid Pathways’ Post

Transcript

Hi everyone, It's Roland Cloutier, Global Chief Security Officer in Digital Enablement Executive. Welcome back to another episode of Security Sparks Insight for pros, our series sponsored by Hybrid Pathways, a new era company. Recently we've done an episode on understanding the concept around value chain defense programs. I'd like to follow up on that by tackling a theory around. Monitoring and incident response in an integrated digital ecosystem. Just to catch folks up, when we talk about a digital ecosystem, we're talking about the total data infrastructure and technology architecture that is your business. For many organizations, this includes a broad supply chain that is internal and external to your organization. It's responsible for key operations, development and even delivery between you and your customer base. The reality is that the delivery of secure services, protection of consumer privacy interests and legal liability may still fall on your business. We all have a duty to protect the business entrusted to us, and a big part of that is our monitoring and incident response capabilities. Now, I won't waste any time providing you with detailed examples of third and 4th party issues that have resulted in catastrophic incidents. There is no one root cause for all of these, but a common issue. Is the simple fact that organizations were not ready and in many cases did not understand the reality of what the that part of their digital ecosystem actually meant to their business operations. Again, in the spirit of keeping these short and simple, I'm not going to dive into every manner in which businesses are interconnected. There are very direct connections that organizations have through V Wins or Sassy. Many of us rely on a significant amount of API. And of course, the majority of us have in some way, you know, outsource key or critical functions to a service organization. Once you start looking at the complexity of your business, it's natural to say where should I start? Since we can't focus on everything, and assuming you've done a good job at understanding your total digital ecosystem, the critical asset protection program is probably the best place to start. When I say asset, I don't just mean a piece of data or a server in your environment. Assets can be business operations in any operating environment. What you really need to focus on is how it integrates. With your business, what it does and why it's important, The next place to focus is on your documentation. Whether it's your value chain defense model documentation or a business architecture document. Begin to catalog your connections. Your shared interest points in simple information like who owns it, what's their contact information, do we have visibility and do we have threat Intel operations focused on that area? Next, create a target list of the most important. Components of your extended digital ecosystem that you believe your team should engage in. Monitoring and response based on sound risk practices, good threat Intel, and business input. Of course, it's great to talk about how to create a target list, but in practice, what can you actually do when it's not your own environment, your own technology or platform? Well, in some extreme cases and with very mature organizations, joint monitoring is actually possible. Typically these happen through a joint operating agreement where a larger organization that utilizes a smaller company as a critical component of their business process provides monitoring and response services to technology that is integral to their relationship. Another take on a like model is the shared monitoring or shared incident data model. This is where organizations agree to joint monitoring or forensics operations and utilize a third party searches such as. A Managed Security Service provider or MSP to provide monitoring for both entities. This includes shared capabilities or access to information necessary to protect each of their business interests. The most common method does not allow for either entity to view the others monitoring on an ongoing basis. However, they both agree to a joint response program. This of course includes legal agreements, but just as important, shared. Playbooks, joint tabletop exercises, and incident operating plans. This method typically works very well in emergency situations, especially when teams are familiar with each other. Last but not least is the 501C3 like entities. These could be Isacs and CTA and others that provide a central location for the investigation of incidents or issues targeting an industry upset of businesses or a corporate group that operates independently. Although you do not get joint monitoring, the response is typically deeply involved industry wide and provides you with a scaled capability due to the number of responders that participate. In the incident or issue, the last thing you have to decide is who you want to target to be able to do this with in this type of work. Well, my suggestion is that you prioritize partners that matter to your business. Whether it's partners that provide the most important part of your go to market, have access to some of the most regulated or sensitive information you have, or your business has a deep invested interest in the relationship focused on the business implication. 1st Next, do a normalized risk based assessment of the partners in your critical ecosystem and create a target list based off that. Since everything is based off from the reality of what is legally possible and practical, focus on the contracts that are capable or negotiable to engage in this type of relationship. The future of our practitioner ship will evolve and the integration across a broad and diverse ecosystem of technologies entities that are your business. Hopefully, I've sparked a few insights that will help you think about how you can protect your business in this new era of technology. And I'm looking forward to bringing you our next edition of Security Sparks insight for pros.