Cybersecurity mesh – the next big thing for distributed organizations?

Cybersecurity is increasingly complex while headcounts and budgets are limited. Recent developments such as work from anywhere (but the office) – boosted by Covid-19 – and hybrid multi-cloud architectures require new cybersecurity approaches and architectures.

What is a cybersecurity mesh?

The most common definition of a security mesh currently is as follows: a composable and scalable approach to extending security controls, even to widely distributed assets. Its flexibility is especially suitable for increasingly modular models that are in line with hybrid multi-cloud architectures. It enables a more composable, flexible, and resilient security ecosystem. Rather than each security tool running in a silo, a cybersecurity mesh allows tools to interoperate through several supportive layers, such as consolidated policy management, security intelligence, and identity fabric. In other words, the traditional siloed approach will be broken up, different security solutions will share information, and management will be centralized.

What’s new?

Security meshes are not a new security solution. They are an architectural overlay to existing security solutions, designed to:

• create a more dynamic environment for security across the network by allowing individual security services to communicate and integrate;
• provide a more scalable and flexible security response, making an organization’s security posture more agile;
• improve the defense posture by facilitating collaboration between analytical and integrated security solutions;
• create an environment where cybersecurity technology can be easily deployed and maintained.

The four layers of a cybersecurity mesh

1. Security analytics and intelligence – Centralized security analytics and intelligence leads enable the majority of data to be collected, consolidated, and analyzed in a central location in real time. This improves risk analysis capabilities, threat response times, and mitigation of attacks.
2. Identity and access management fabric – This provides capabilities such as directory services, adaptive access, decentralized identity management, identity proofing, and entitlement management.
3. Centralized posture and policy management – This translates central policy into the native configuration models of individual security tools and provides dynamic runtime authorization services. It allows IT teams to more effectively identify compliance risks and misconfiguration issues.
4. Dashboards – They offer an aggregated view of the security ecosystem, enabling security teams to respond faster to security events.

Recommendations

A successful cybersecurity mesh strategy needs to consider both network operations and cybersecurity. The core building blocks of a mesh architecture are ZTNA, adaptable cloud security, and open architectures. The openness of the architecture is the key to preventing vendor lock-in. When starting to think about adopting a mesh architecture, users need to select the mesh vendor carefully:

1. The more tools you already use from a specific vendor, the easier it will be to integrate them into the mesh.
2. Make sure the mesh vendor has APIs and interfaces for all infrastructures, security tools, and applications to be used in the foreseeable future.
3. Make sure there are ways to implement APIs that might be needed in the future.

If you want to share your feedback or personal experience, please leave a comment or drop me an e-mail.