Defensible (de·fen·si·ble\di-ˈfen(t)-sə-bəl) is described as “capable of being defended”. “Defensibility” thus alludes to the ability to remain protected from attack. Cybersecurity should have always been defensible… to be able to adapt to changes, especially continuously changing business intent and risks thereof….
The industry has felt this quite long ago. As early as 1970 a Report of the Defense Science Board Task Force about Security Controls for Computer Systems, noted that providing satisfactory security controls in a computer system is in itself a system design problem. This seems to be true today too. Despite spending billions on cybersecurity, cybersecurity teams are continuously fighting fires because protecting the organization is an asymmetric challenge. Security Leaders need to protect an increasingly larger number of entry points while the bad guys just have to find just one-way in.
In the aftermath of COVID19, we are looking at a new way of doing business…. Now, there are more and more users outside of the enterprise accessing services than inside… more unmanaged devices connecting to services than managed devices and… more and more internal users are consuming applications delivered from outside of the enterprise network than the inside. Digital transformation is hinged on using the Internet more and more, but the Internet was designed to be flexible and open, not secure. Every mobile phone, cloud application, branch office, IoT and remote employee is an entry point.
It is time for defenders to change the approach.
On May 12, CMS IT Services launched a fresh new approach to cybersecurity – the Defensible Cybersecurity Model, in an industry where there are just too many cybersecurity technologies overlapping in intent and content at the enterprise.
The CMS IT Services Enterprise Cybersecurity Solutions are designed to help enterprises embrace the Defensible Cybersecurity way of ensuring that they can protect their crown jewels through optimized investments in cybersecurity technology and processes, detect deviations, events, incidents, and breaches in their computing infrastructure, and can respond effectively to ensure that the consequences are limited and contained to the extent the leadership desires to, within the boundaries of their risk appetite.
Intricacies of the Protect, Detect and Respond Portfolio
The genesis of the Defensible Cybersecurity model can be traced to2 key papers. The first is the report of the New York Cyber Task Force at Columbia University SIPA, titled “Building a Defensible Cyberspace”, And the second is a physical security concept that was designed to reduce crime by intelligently designing defensible spaces, through Natural Surveillance, Access Control, Territorial Reinforcement, and Maintenance, called as Crime Prevention through Environmental Design (CPTED).
Defensible Cybersecurity is a holistic approach to address cybersecurity challenges, aligned to the context of business, addressing systemic issues, challenges and stakeholder requirements, designed to handle constant change while Consistently improving operational controls, designed to address cybersecurity risks for both traditional & digital businesses and their supply chains.
