The app is no longer fixed in one location. Where the app goes, so too should protection, says Martin Walshaw, senior engineer at F5 Networks .
Applications are the gateway to our data. Whether at work or in the home, the way we manage private information is critical to safeguard our integrity. There appears to be an app for everything fuelled by the overwhelming appetite to meet the everyday lifestyle and commercial demands.
Companies spend millions of dollars on IT to ensure their infrastructure is secure. However, with an exponential increase in online attacks, 72% of breaches are from attacks on the app and not the network. It is time for companies to rethink their IT strategy and embrace a new approach to application protection.
The new mantra
Cloud-based applications and mobility have changed the cyber game. Data is accessible from devices over which application providers have no control and from locations and networks that are out of their reach. Against sophisticated cybercriminals, perimeter-based security is no longer adequate.
Traditionally, data was secure once inside the network perimeter. Traditional security gateways and firewalls have SSL decryption capabilities. Security solutions designed to monitor network traffic to detect threats and prevent data leakage are becoming less effective as a result of the growing volume of bandwidth associated with cloud-based services and the rising amount of encrypted traffic, according to the results of an IDC survey commissioned on behalf of F5 Networks.
It is time to embrace the attacks to build a more robust architecture. Quite simply, accepting the fact that hackers will attempt to access your data at any level where it is exposed is part of tackling the problem, starting from the endpoint itself, mobile devices, browsers (Man in the browser – MITB), the Network layer, the application layer and its stored location. The application is where the cybercriminal sees the prize and for hackers, data means dollars and this is a growing business.
The app is no longer fixed in one location. It should be considered as part of the larger “” application architecture package “” wherever it is deployed ranging from on premises, in the public cloud or a hybrid environment. Essentially, where the app goes, so too should the protection. Each application must be given its own protective perimeter along with its own DDoS protection and personal, private web application security policies. Architecture is important to protecting your business ” vital resources.
In addition, dynamic application content has increased the complexity of maintenance and information integrity. With the right security solutions in place, organisations can minimise risk and safeguard their networks, applications and intellectual property from malicious attackers. Closing the door on data vulnerabilities will avoid damage to brand reputation, avoid business disruption and significantly reduce control costs on a global scale.
Smart devices are getting smarter. The connected world in which we live, from machine-to-machine automation and intelligent consumer goods, earmarks a new era in the internet of things (IoT). For many businesses, virtualised datacentres, seamless public and private cloud computing, next generation analytics opens up new challenges to a digital world that generates gigabytes worth of data. IDC recently reported, “” In 2013, less than 20% of the data in the digital universe is “” touched “” by the cloud, either stored, perhaps temporarily, or processed in some way. By 2020, that percentage will double to 40%.
Safeguarding apps wherever they live
Application security is primarily about context and control. Being able to understand application vulnerability, the endpoint using the application and how the application behaves amongst other criteria is critical to protecting vital services. Traditional firewalls often fail because if traffic is good or bad. Simply, you cannot secure what you do not understand.
Intelligent security is about protecting the asset and its user – not the location. To protect the application, you have to understand the application expected behaviours. Focusing security efforts on applications is more effective and less expensive. It is possible to implement protection based on the value of the app instead of attempting to protect everything equally.
A successful security strategy delivers visibility into all application traffic, enhancing a company ” s security portfolio with additional layers of intelligence that traditional defences leave exposed.
Embracing change
Protecting your applications protects your identity. Organisations today must adapt quickly in a fast-paced digital environment. Hackers are becoming increasingly sophisticated with their techniques for an attack. Migrating security like DDoS protection and application firewalls to the cloud is an effective solution, where bandwidth, capacity and access are broadly available. Centralisation delivers enormous benefits, including the elimination of device management.
In addition, implementing a zero trust model represents a fundamental change in security management and requires a comprehensive, integrated plan to transition the business to be effective with its cyber risk strategy. With better orchestration, analysis, detection, prevention and response mechanisms in place companies will avoid silo work practices and mitigate cyber-attacks efficiently.
Cyber defence must extend beyond simply protecting the IT department ” s network infrastructure. Embracing the notion that it is time to rethink the threat landscape and make life harder for cybercriminals to breach systems and protect against attacks will provide a more robust defence in this ever increasing digital data-driven world.