Partner Content: “We've forgotten this really critical space” - Why on-prem security remains crucial

Securing systems, especially Critical National Infrastructure, Manufacturing and Healthcare; that cannot connect to the public internet creates unique challenges, often beyond the reach of traditional security applications.

Organisations may need to comply with legislation or internal data protection policies that dictate that data must be kept within a particular country or cannot leave their four walls. This means that security solutions that run in the public cloud are a no-go, with organisations instead storing their data in the private cloud or entirely on-prem.

Regardless of where this data is stored, the issue of keeping it safe from bad actors remains. To find out more, CRN heard from Greg Day, Vice President and Global Field CISO for Cybereason in EMEA on how Cyberreason is approaching the issue of hardware-based security.

Security without the public cloud

Today, numerous security solutions rely on cloud compute, with many vendors leaving the on-prem EPP space. But hardware security is still an important area for those required to store everything away from the public cloud, particularly in industries handling and securing highly sensitive data.

Day explained why securing systems that cannot connect to the public internet creates unique challenges:

“Today cybersecurity typically uses a lot of very expensive Hyper-scaler cloud compute. If you find something that looks suspicious it gets sent up to your security vendor to do real-time analysis, often using AI to then give you the answer. So the challenge is how do you do that when you can't actually connect to the Internet?”

He explained that keeping up with threats can be compute-intensive, and finding ways to conduct the necessary analytics without the use of the cloud is key:

“More and more today, things get through traditional prevention controls. So in this world of detection and response, the need to go find the things that got past your prevention controls has really grown.

“But that's typically very compute intensive, so historically it has almost been a no-go in this space because there just wasn't the resources to gather all of this and do the computational analytics to figure out what’s going on.

“I feel like this is almost a bit like the IT land the world forgot to secure. It's becoming more and more of a growing need, but as we've advanced cybersecurity, leveraging cloud computing and high speed capabilities, we've forgotten this really critical space since Critical National Infrastructure and Manufacturing accounts for nearly 70% of all attacks.”

In hardware-based security, Day explained that traditional security appliances can struggle to protect sensitive systems, largely due to not having the horsepower. This can mean that threats are overlooked.

“[Organisations may use a very lightweight agent to do the prevention side and then an appliance to do some of the detection and response. This creates a couple of challenges. When you hit capacity, you either have to make a decision on what gets analysed. Sadly through experience either the threat was too low risk so it never got scanned or it was sat in the queue and it never got scanned.

“The other problem is every six to twelve months there is a great new method of detection. Maybe it's a new way of looking for ransomware or a different way of looking for command and control. And when I've got an appliance that was specced two years ago and I've added in four new layers of scanning, it hasn't got the horsepower, so you end up buying more and more of these black boxes. It’s really hard to keep pace with that change in demand. The other challenge is how do I add in the new features as they come out?

“Hardware is a slow-moving beast for a very high paced problem.”

Overcoming shortcomings

In this context, Cybereason has worked to address all of the shortcomings of traditional hardware-based security appliances through its use of containers.

“When Cybereason was founded ten years ago, it was founded on this premise of wanting a very lightweight agent to be able to do prevention and gather telemetry” said Day. “Just like everyone else, we wanted to take that telemetry and aggregate it. But that was historically done in the cloud. As we developed this technology from day one, all of those cloud capabilities were built in containers.

“It's given us a really easy way to effectively take what was your private cloud compute space and move it anywhere. The great thing I find is just about every company I talk to has got spare tin, spare servers, spare bits of hardware that they're struggling to find a use for. Effectively anything that can be used to set up containerised virtualised environments, we can then use to build that replica of what would normally happen in the cloud either in the company's private space or completely as an on-prem solution addressing the needs of Critical Infrastructure sectors.”

This approach offers several key advantages over traditional appliances. Containerisation technology offers the flexibility and scalability traditionally associated with cloud computing, meaning security systems can better protect against evolving threats.

“Firstly you're not constrained by the hardware” said Day. “If we come out with some great new detection capabilities, because it's virtualised, it's easy just to add that new software update and it can run on whatever hardware you've got. You don't need another box to be able to do this.”

This Article is sponsored by Cybereason