As I noted in my previous article, companies should use foundational controls to assure integrity of their software and critical data – doing so can help prevent many data breaches and security incidents from occurring in the first place. That's not all that integrity driven by foundational controls can accomplish. Here are two more benefits organizations can enjoy when they give integrity the attention it deserves:
Integrity Connects Security and Operations
Security and operations personnel have different priorities. The former care about confidentiality, or the need to protect critical information in valued systems. Meanwhile, the latter cares about availability and uptime, all in an effort to keep those systems running. Fortunately for companies, integrity connects operations and security together. It does so via foundational controls, security measures which both address vulnerabilities and changes that commonly cause downtime as well as reduce the attack surface that can lead to system compromise. As a result, integrity can help both groups ensure that critical systems operate continuously in a known and trusted state.
Integrity Can Help Companies Address Security and Compliance
Enterprises commonly use frameworks to address their security and compliance needs with NIST, CIS, PCI, NERC, GDPR, and other standards. What they don't know is that many of those frameworks focus on foundational controls that drive integrity. For example, the first six of the Center for Internet Security's (CIS) critical security controls (CSCs) can help an organization prevent incidents and reduce risk; five of those six measures align with integrity management as I've described it. By implementing these tools first, an organization can prevent a majority of breaches, achieve compliance, and pass its regulatory audits. Going the Distance Many organizations do have at least some foundational controls in place but don’t go far enough with their implementation. These enterprises frequently embrace a strategy that focuses only on the critical assets like your PCI or PII servers. It ensures the integrity of these assets because of auditors' greater degree of focus on them, but it doesn’t address the cumulative risk of leaving other assets uncovered. Extending integrity management to more of the assets you manage enables you to reduce your overall attack surface and address more of the cumulative security and operational risk you have. With that said, those companies that have embraced suitable cloud-computing architecture need to ensure they've deployed the same level of security, compliance, and operational controls in the cloud as is required for their on-premises systems. Why? The cloud is not secured by default. Cloud providers’ focus is security of the cloud. However, customers are responsible for security in the cloud. As with on-premises systems, foundational controls are a great place to start when it comes to cloud security. Additional guidance on this matter can be found here and here.
Foundational Controls Should Be Your First Budget Consideration
We know you have a hard choice to make when it comes to spending your security budget. Going back to basics might seem like a step in the wrong direction. But spending more and more money on the latest technology to solve security problems will often only lead to a false sense of security, a more complicated IT environment, and bigger problems in the long run. When it comes to budget decisions, foundational controls for integrity assurance should be your first investment for effective security and operations. Tripwire recognizes this fact, which is why its integrity solutions are focused on three aspects of the organization:
- Security controls that leverage industry standard frameworks like NIST and CIS;
- IT operations controls that help organizations maintain their infrastructure and configurations for continuous operations; and
- Compliance coverage that offers one of the most extensive policy libraries in the industry.
For more information on how Tripwire's solutions use foundational controls to assure integrity, click here.
