In the world of network security, the old adage “out of sight, out of mind” simply doesn’t cut it anymore. The rise of multi-cloud architectures and remote working have shifted the security goalposts, making 360-degree network visibility harder to attain, and even harder to maintain. Security teams need to build for a world that never stops – we now have an “always on” mentality when it comes to technology, and network footprints are expanding, creating an increasing number of vulnerabilities for the threat actors to capitalize on. Workers are distributed, endpoints are no longer localized, and the sheer number of devices we use day-to-day, are all adding to this ever-expanding footprint. Even prior to the pandemic, the average number of devices connecting to a network per employee was 4.9 – that’s likely to have increased with the sudden boom in remote working. According to Infoblox’s Global State of Cybersecurity report, nearly a third (29%) of remote devices are employee owned, and Wi-Fi access points and cloud platforms have been prime sources for organizational breaches in the past year, accounting for 34% and 33% respectively. What’s more, a 2023 study found that almost 9 in 10 (87%) of businesses actually rely on their employees to use their personal mobile devices to access company apps and send emails. Businesses need better performance and protection, and that can only be achieved through uniting networking and security.
Company networks are expanding at a time when data breaches have become an occupational hazard. Exposure to risk is simply the cost of doing business in 2023, and how businesses manage that risk and deal with threats as they arrive is a measure of their resiliency. Seeing and stopping critical threats earlier has become a top boardroom priority – the same Infoblox report referenced above also found that the average cost of a data breach is around $2 million. Among the organizations that experienced breaches, most said their attackers were most likely to steal data or hijack credentials, while others experienced system outages and data manipulation.
However, in order to mitigate and remediate threats, real-time visibility and control are key. No matter how focused a network security team is on firefighting threats as they emerge, they will always be on the back foot without proper end-to-end network visibility. That’s because the majority of network firefighting is spent trying to figure out what’s happening, where threats originate, who instigated them, and how long the network has been compromised. For even the most advanced security teams, figuring these things out is an incredibly time-consuming endeavor. Of course, prevention is better than remediation, so network discoverability and uncovering rogue endpoints before they become a problem will always be preferred.
All of this boils down to a need for shared real-time visibility, and businesses know it. A recent Forrester research report, showed a significant correlation between visibility and security, with 81% of surveyed decision-makers agreeing that better network visibility would improve their organisation’s security posture. Nearly two-thirds (61%) of respondents also agreed that investing in network discovery infrastructure was the best way to boost their security capabilities. These are non-negotiable requirements if businesses are to maintain control of a constantly changing environment.
The synergy between visibility and security
Visibility has become the central pillar of network security in recent years. Visibility helps to plan network availability, assess bandwidth utilization, and predict when network capacity might fall short of future requirements – all of which are crucial to managing a network safely and effectively. Visibility also affords network security teams a way to identify anomalous patterns in traffic activity that could point to a potential threat, or uncover rogue endpoints or devices that have no business being on the network. Comprehensive, end-to-end network visibility reduces the time security teams need to spend firefighting because it provides contextual awareness. Instead of manually scanning the network for threats and identifying vulnerabilities, they can jump straight into the remediation phase. By reducing the mean time to detect (MTTD) in this way, threats can be isolated and taken care of far more quickly, reducing dwell time and increasing the overall resilience of the network. This is now critical as Infoblox’s Global State of Cybersecurity report highlights that only half (52%) of global organisations have accelerated digital transformation with remote workers in mind.
The importance of integration and visibility as a philosophy
Having end-to-end network visibility tools in place doesn’t count for much if areas of the business, including security teams, remained siloed and separate from one another. According to the Forrester report, 79% of business decision-makers see a fully integrated network visibility solution that benefits their overall networking and security objectives as “appealing” or “very appealing”.
Siloed visibility is not enough. The integration of network visibility across an organisation is critical, because it allows for a holistic view of the entire network infrastructure, allowing security teams to monitor, analyse, and manage network traffic in real time and ensure that any threats are identified and addressed quickly. Businesses should be looking to unite networking and security by providing real-time application, user and device context so they can detect and respond to who and what connects to their network. This joining of forces between networking and security will be critical in the coming years, allowing businesses to share context-rich data in real-time and deliver a faster, safer user experience.
When visibility is siloed across departments or locations, it’s virtually impossible for security teams to identify threats that put day-to-day operations at risk before it’s too late. With a fully integrated network visibility solution, however, all network traffic can be monitored from a centralised location, providing a complete view of network performance and security, vastly reducing the need to firefight. If all relevant network data is readily available, security teams have what they need to not only chase threats reactively, but get ahead of them proactively.
There are business performance gains too. Integration of network visibility allows for better collaboration across departments. When all teams have access to the same network data, they can unite to resolve issues more efficiently. This collaboration can lead to better decision-making and more network uptime, as all parties have a comprehensive understanding of the current state of the network.
Fully integrated security and visibility solutions are becoming the preferred choice for organizations, but there is still work to be done. As detailed in the Forrester report, only 24% of organisations are confident they have a fully integrated network security solution in place. Teams responsible for buying security solutions are also quite often siloed, with only 29% of organisations reporting that there is a strong, integrated relationship between their network security and solutions procurement teams.
In today’s security landscape, fully integrated network visibility solutions are no longer a luxury, but a necessity. Expanding network footprints, remote working, and activity across multiple networks and multi-cloud environments mean that manual network firefighting or siloed solutions simply won’t cut it. A unification of networking and security is needed. What you can’t see can hurt you, so it’s vital that security teams are able to monitor, analyse and manage network traffic in real-time from a centralised location.
Gary Cox is currently the Technical Director for Infoblox in the UK and Ireland. He joined Infoblox in 2010 and has held a variety of roles over the years. He often speaks at industry events and on webinars and has over 25 years of IT experience working across multiple verticals including finance, public sector, media and service providers. Gary is an active member of ISC2² and held a CISSP since 2016.