Those threats are inspiring innovations in security technology, chief among them the security mesh, which has at its core distributed policy enforcement and “pluggable, composable tools that can be plugged anywhere into the mesh,” Contu said.<\/p>\n
He said security mesh fabric enabler technology uses foundational services such as:<\/p>\n
- \n
- Centralized policy management and orchestration<\/li>\n
- Security analytics, intelligence and triggers<\/li>\n
- A distributed identity fabric<\/li>\n<\/ul>\n
What is Cybersecurity Mesh?<\/h2>\n
Gartner analyst Felix Gaehtgens said the security mesh is still a strategy rather than a defined architecture, but he said the concept better aligns organizations with threats: “Attackers don\u2019t think in silos. Organizations do,” he noted.<\/p>\n
By 2024, Gaehtgens predicted that security mesh technology will lead to huge savings in the cost of breaches. “Organizations adopting a cybersecurity mesh architecture to integrate security tools to work as a cooperative ecosystem will reduce the financial impact of individual security incidents by an average of 90%,” he said.<\/p>\n
Instead of SIEM<\/a> and SOAR<\/a> integrating security tools, the security mesh will use security analytics and intelligence, he said. The mesh will also include identity, policy, posture and dashboard layers.<\/p>\n
![\"cybersecurity](\"https:\/\/www.esecurityplanet.com\/wp-content\/uploads\/2021\/11\/gartner-security-mesh-scaled-e1637264959458.jpg\")
Cybersecurity mesh architecture (Source: Gartner)<\/figcaption><\/figure>\n Cybersecurity mesh architecture, or CSMA, “is more than XDR,” Gaehtgens said.<\/p>\n
XDR, or extended detection and response<\/a>, has emerged as a new way for security vendors to tie their products together in a unified platform. Gaehtgens said XDR is a “potential foundation” for the security analytics and intelligence that CSMA requires, as are SIEM and SOAR, which “can add value” to the security analytics\/intelligence layer in a security mesh.<\/p>\n
He called secure access service edge (SASE)<\/a> technology “a meshy approach of delivering distinct functions in an integrated manner,” but the security mesh has “a broader scope.”<\/p>\n
A number of cybersecurity companies<\/a> have CSMA-like approaches today, he said, among them Fortinet, IBM, McAfee, Microsoft, Palo Alto Networks and Broadcom-Symantec. Those platforms “can provide benefit and scale and cost in the intermediate term,” but have the potential for vendor lock-in and lack of interoperability.<\/p>\n
Gaehtgens recommended that organizations start building the supportive layers for a cybersecurity mesh strategy, including security analytics, identity fabric, policy management, and dashboards. Distributed security technologies offering interoperability will be key to the security mesh, so users should evaluate features such as inversion of control APIs, standards support, and extensible analytics.<\/p>\n
He\u00a0also told conference attendees to “familiarize yourself with current and emerging standards, and open source code projects as a potential alternative to supplement vendor interoperability gaps.” He listed more than 20:<\/p>\n
![\"security](\"https:\/\/www.esecurityplanet.com\/wp-content\/uploads\/2021\/11\/security-standards-scaled-e1637260744285.jpg\")
Security standards (Source: Gartner)<\/figcaption><\/figure>\n See also: Top XDR Security Solutions<\/a><\/p>\n
What is Decentralized Identity?<\/h2>\n
Decentralized identity will be key to the security mesh. Contu said that under decentralized identity, identities are linked to system elements, with a low reliance on centralized identity (see image below).<\/p>\n
![\"decentralized](\"https:\/\/www.esecurityplanet.com\/wp-content\/uploads\/2021\/11\/decentralized-identity-e1637260857303.jpg\")
Decentralized identity architecture (Source: Gartner)<\/figcaption><\/figure>\n Traditional identity and access management (IAM)<\/a> has “issues with security, scalability, reliability and privacy,” Contu said. [Gartner analyst Peter Firstbrook later noted that IAM has itself become a target in credential theft and other attack techniques.]<\/p>\n
However, decentralized identity is as yet an “unproven technology,” held back by Blockchain\u00a0 understanding and skills and the difficulty of assessing risks across Blockchain services.<\/p>\n
Also read: The State of Blockchain Applications in Cybersecurity<\/a><\/p>\n
Where Security Buyers Are At<\/h2>\n
Contu said the technologies buyers are interested in now include OT security, cloud workload protection, cloud security posture management, and behavior monitoring<\/a>, with integrated and digital risk management, container<\/a>-based network defense, passwordless authentication<\/a>, SASE and zero trust networking<\/a> gaining traction in the next one to three years.<\/p>\n
Contu recommended that organizations “position the enterprise for a more secure future by choosing cybersecurity technologies that offer high levels of integration capability. The security of the composable enterprise requires flexible cybersecurity mechanisms with a rich set of APIs, based on interoperability standards.”<\/p>\n
Buyers need to rethink network and server security priorities and “invest in solutions that are truly designed for cloud first and zero trust,” he said.<\/p>\n
Lastly, he said, organizations should invest in people, process and organizational change to address the expanding role of security to address “external threats, digital trust and safety that arise from the digitalization of business.”<\/p>\n
See also: Best Zero Trust Security Solutions<\/a><\/p>\n
Supply Chain Threats to Grow<\/h2>\n
Firstbrook said in a press briefing at the conference that by 2025, 45% of organizations worldwide will have experienced attacks on their software supply chains, a three-fold increase from 2021.<\/p>\n
He listed nine supply chain attack methods and some of their victims:<\/p>\n
- \n
- Authenticated partner compromise (Target, Stuxnet<\/a>)<\/li>\n
- Outsourced IT based attacks (Kaseya<\/a>, CloudStar)<\/li>\n
- Source code modification (SolarWinds<\/a>, NotPetya<\/a>, CC cleaner)<\/li>\n
- Modified applications in production (Web CC scraping)<\/li>\n
- Stolen Certificates (Codecov, Bit9<\/a>, Mimecast)<\/li>\n
- Stolen source code (RSA)<\/li>\n
- Open-source code components (RubyGems)<\/li>\n
- App store and browser plug in trojans (Exodus, Great Suspender)<\/li>\n<\/ul>\n
APIs<\/a> are a growing target and often ignored attack point, Firstbrook said.<\/p>\n
Also read: The Biggest Lessons about Vulnerabilities at RSAC 2021<\/a><\/p>\n
Endpoint Security ‘Critical’<\/h2>\n
Firstbrook called endpoint detection and remediation “critical first responder tools, even if they fail to detect the initial intrusion.”<\/p>\n
- Outsourced IT based attacks (Kaseya<\/a>, CloudStar)<\/li>\n
- Authenticated partner compromise (Target, Stuxnet<\/a>)<\/li>\n
![\"Anatomy](\"https:\/\/www.esecurityplanet.com\/wp-content\/uploads\/2021\/11\/gartner-ransomware-attack-scaled-e1637261218371.jpg\")
![\"ransomware](\"https:\/\/www.esecurityplanet.com\/wp-content\/uploads\/2021\/11\/gartner-ransomware-backup-scaled-e1637261393231.jpg\")