Closing the Top Five Cybersecurity Gaps
By: Koroush Saraf - VP Product Management, ZPE Systems
Although cybersecurity is a $155 billion industry with more than 1,800 vendors, companies still struggle to assemble holistic cybersecurity. According to IBM’s 2022 Cost of a Data Breach report, ransomware breaches increased 41 percent in the last year and now cost $4.54 million on average. With many great products available and increasing investment in cybersecurity, why aren’t these attack trends decreasing? Why is it so difficult to protect digital assets? Working with Big Tech, ZPE Systems has developed a reference architecture—a network automation blueprint—as the best practice to cover the security gaps that remain open.
Five cybersecurity gaps to close
Digital services—otherwise known as applications, data, and the platforms that host them—now live across a mix of public-cloud (Azure, AWS, GCP) and private on-prem colo, branch, and edge locations. During the push to adopt the cloud, this hybrid model helped companies meet increasing customer demands to deliver applications quickly and at scale.
This hybrid infrastructure (including edge computing), however, spreads applications, data, and systems that protect them across more locations, creating a large, porous attack surface. Today’s infrastructure presents so many vectors that attackers can use to exploit things like leaked passwords, buggy software, and disjointed solution integrations, among others. Let’s examine the five gaps that organizations must close in order to achieve holistic cybersecurity.
Credential theft
Hybrid infrastructure has caused an explosion of apps and platforms that require authentication. This presents many opportunities for cyber criminals to steal credentials. Research from Digital Shadows states that in 2021, there were more than 24 billion credential pairings available for sale on the dark web.
ZPE Systems
Founded: 2013
Customers: 300+ including 6 of 10 Tech Giants
Location: Fremont, California with worldwide offices
What: ZPE Systems addresses the pain in infrastructure reliability, holistic security, and personnel shortage of large enterprises and digital service providers – including 6 of the top 10 global tech giants – by delivering on what Gartner calls Infrastructure Hyperautomation
How: Enterprises trust ZPE’s Intel-based serial consoles, services routers, sensors, zero-touch zero-trust provisioning and cloud managed out-of-band automation, to eliminate human error and operate an agile, easy to manage, secure and resilient infrastructure from datacenter to distributed edge at scale
Visit: http://www.ZPEsystems.com/
Even with multi-factor authentication, credential theft or bypass still happens when systems go unpatched. Recall the SQL injection or the Active Directory attacks, where hackers were able to bypass authentication altogether and pivot to other systems. Preventing credential theft requires diligence on the part of the organization, with programs to educate employees about vulnerabilities, performing regular pen testing, and continuously patching all network infrastructure.
Unpatched infrastructure
In 2021, there were 28,000 vulnerabilities and exposures (CVE) reported and cataloged at the government-sponsored website for Common Vulnerabilities and Exposures. Many of these common vulnerabilities can be exploited for successful cyberattacks. For this reason, an application and infrastructure patch management strategy is the cornerstone of protection; however, teams are reluctant to update systems, and for good reason. What if the software upgrade includes an undiscovered vulnerability that blows open an attack vector in an otherwise-protected system? Imagine executing the Friday-night upgrade using the latest software, only to have a bug or CVE bring down the network and force the weekend shift to restore services.
The fact is that system upgrades always come with the risk of reducing the security posture of the whole infrastructure. I worked at Fortinet for 10 years and it is a fantastic company, but this Fortinet CVE is a perfect example of why teams need a solution to
