You need to protect your business from cyber threats. How can you choose the best enterprise security tools?

Problem solving 101 - Before picking a solution you have to understand the pain that needs to be fixed, for example theres no point getting your Dr to prescribe antibiotic’s when what you actually have is a broken leg ????♂?

Part of any baseline exercise should be an understanding of the current risk posture and an understanding of the aspirational state vis a vis a standard security maturity model. This will allow the entity to identify the priority of objectives, budgeting, and requisite resource as well as build a bridge plan.

A risk assessment is a great way to understand the current risks in your environment, and get started in establishing a standardized security program. But ultimately, you cannot protect what you can’t see, which is why continuous visibility prioritizes risk remediation and creates resilience and confidence against bad actors.

In addition to ensuring that the solution you are procuring integrates well with your current setup and toolset, you will also need the right processes and people to ensure that the benefits of the solution are realised. For example, who is going to manage the various aspects of the solution and how are you going to respond to any alerts that the solution throws up? Does your team have the skillset to manage the solution effectively? If these are not done correctly, the solution is just another piece of unused software.

In this age and with the trajectory I see from my perview, companies and people should begin to assume breach. Most tools today are preventative leaving the question, what happens when we are breached? How do we recover when every bare metal hardware is encrypted? Was our CMDB up to date and accurate? If you cannot guarantee recovery of ALL the systems that run your business, how do you prioritize what portions of your business you are willing to be without as you start again from scratch? When that event occurs, RPO and RTO are completely reset unless you have metadata about your data to know with some degree of certainty when you should recover from and how long that will take. Remember, your data is your gold. Don't lose it!

It is always important to acknowledge that you normally don't start on a green field. Very often there are many security products implemented and in some companies they have grown historically and represent now a patchwork of solutions. It doesn't mean that they are all connected, quite the opposite. Tools have been added to cover a specific weaknesses in the defense. First task - Understand the technical status quo as well as the risk situation and security maturity level before. Then based on the findings - Task 2: Focus on the homework and cyber hygiene (e.g. Patch Management, Access & Identity, DLP, etc.). Task 3 - Do the Rest. Never assume a tool solving security problems, go for a holistic end-2-end approach with clear priorities.

Frequently, infosec opt to acquire defensive tools and monitors from a myriad of vendors when there is a lack of a clear strategy and well thought out vision. A patchwork quilt .. that can often lead to risky Tactical decisions. Bases on your organization's existing infosec maturity, decisions should begin with humility and not hubris... because, it is what sort know that will be the epicenter of a breach. Also, as the saying goes, two heads are better than one...30 are better than 5 or 6... meaning if your team us small consider an MSSP, MXDR, a 3rd party who brings experienced resources and who can provide threat intelligence, situational awareness, and a wholistic sentry ahead of your systems. Perhaps, later you grow into your own SOC

Before acquiring new tool, evaluate your current system to determine if there are already security tools in place. If you already have an existing security tool, then research should be done to determine if it is configured and being utilized efficient and effectively, as well as making sure it is not an outdated solution.

Zero trust and microsegmentation are key strategies. Zero Trust includes controlling access to applications on an as needed basis and only the selected application(s). Microsegmentation allows you to segment your network to isolate pods and control access. Upon a breach (ransomware), the breach isolated to the segment and can be mitigated not impacting other systems.

To fortify your decision-making process, extend your research beyond the tools' official descriptions. Seek out comprehensive reviews, assess ratings, explore firsthand testimonials, and, whenever feasible, engage with demonstrations facilitated by both end-users and industry experts. This multifaceted approach enhances your understanding of the tools' qualitative aspects, ensuring a well-informed selection that aligns seamlessly with the unique intricacies of your security posture.

You will need to create test cases and predict potential normal and abnormal conditions and run a test to check your tests cases and see the result of pass or fail cases. Then reassess and fix failures.

Cybersecurity tools typically have a 2 to 3 year useful life in this age of AI. Be prepared to run proof of concepts on emerging vendors with cutting edge solutions leveraging AI to keep you ahead of the bad actors. If your existing vendor is not making 1 or 2 version release a year its time to change vendors or become stale and prey to bad actors.

This practical testing phase serves as a pivotal stage in the decision-making process, providing valuable insights beyond theoretical functionalities. It empowers you to make informed choices based on real-world usage scenarios, ensuring that the selected enterprise security tools align not only with your immediate security needs but also with the dynamic and evolving nature of your organizational landscape.

Comprehensive set of core security metrics agnostic of tools used is critical to continously and comprehensively monitor security at the company. This must reflect the full portfolio of systems across every area of infrastructure and business systems in public and private clouds. It's critical the metrics have clear targets and measures to show true picture vs how good everything is.

Always question your result, sometimes you have a positive result because you didn't cover all test cases and you did consider all abnormal scenarios. Sometimes you have negative result because your test cases are incorrect. Always consider questioning and testing your result and work on improving it.

Performance monitoring involves the continuous tracking of metrics such as as vulnerability assessments, incident response times, and compliance adherence. It enables organizations to identify areas of strength and weakness within their security strategies. Always question your result and do continuous tracking of these metrics.

With the shortage of skilled resources. You need to look at the force multiplier that a platform and integrated approach will provide. Individual tools that don’t integrate create complexity and noise which is a perfect place for malicious actors to play.

The first line of defense is our employees and business partners. Tons of software and apps will help, for sure, but the most vulnerable are people and behavior. Educate them, create a simple and clear process (backup recovering snapshot files, etc.), and explain the risks to reduce the "open doors", that they may leave open accessing sites, files, USBs, cellphones, public wireless, etc. Avoid public exposition that your company may retain information that calls for those types of attacks, and your marketing/PR is key for it as well as your presentations, webinars, and conversations. If you have strategic thinking about what you are doing for your business you must consider the people as the key element, and they can help a lot.

Here are key considerations from my own experience while choosing enterprise security tools: assess security needs, prioritize vulnerable areas, choose between a specific or comprehensive tool, decide between SaaS or on-premise, ensure compatibility with existing infrastructure, prioritize ease of use, look for key features like incident response, automation, monitoring, reporting, and analytics, and consider budget. By considering these factors, businesses can choose the best tools for effective protection from cyber threats.

At my experience, an organization should adopt a holistic perspective which allows a bird eye-like view of all of it's compute environment, the endpoints and end-users etc.. Build a workflow chart, compliance checklists and use your vendors' tools to help keep up with you organizations' both ongoing an ever growing demands.

Understanding scalability of software tools & how they stay up to date, so proactively protecting your enterprise from new threats is key. Protecting against today's known vulnerabilities is one thing, but what about next week's?