Guest Editorial by Ben Smith, CTO, Netwitness

Cyberattacks and cyber warfare have only worsened as geopolitical tensions rise and digital proxy battles rage.

But while these threats have remained ubiquitous for more than two decades, the COVID-19 pandemic accelerated them at such a pace that federal agencies have struggled to plug holes and keep up.

As workforces distributed and security policies became progressively more difficult to manage, a once-in-a-century pandemic not only threatened our physical world but our digital one as well.

With this reality in mind, government agencies looking to modernize and course-correct should lean into a Secure Access Service Edge (SASE) architecture – a cloud-centric model combining network and security services within a single offering.

Proponents for SASE adoption within the federal community point to several key aspects, such as adherence to the Office of Management and Budget’s (OMB) “Cloud Smart” strategy, as indicators of a need for this innovative, flexible architecture.

Practicing Cloud Smart & Zero Trust

Following the regulations under the Federal Risk and Authorization Management Program (FedRAMP), Cloud Smart laid a foundation for today’s post-pandemic cloud-based solutions throughout government agencies.

The strategy is built on three pillars: security, procurement, and workforce, all of which are directly supported by a SASE-based model.

The SASE framework, along with its corresponding components, checks off many of the Cloud Smart requirements because it can reduce the complexity of cloud-based services, optimize orchestration, and create seamless access points for remote and headquarters-based users at a reduced cost compared to similar models.

And let’s not forget about another major government security initiative, the concept of Zero Trust, a model that limits the implicit trust a cloud-based system has for users both inside and outside of a government organization’s network.

To enhance the security of cloud-based services in a SASE-supported Cloud Smart strategy, trust is never implied and is only granted when absolutely necessary.

Within the broader Zero Trust definition is the closely related concept of Zero Trust Network Access (ZTNA), a core component of today’s SASE model.

The Zero Trust architecture – the subject of the National Institute of Standards and Technology’s (NIST) Special Publication (SP) 800-207 – provides the framework from which ZTNA is drawn and represents a roadmap for achieving an effective and efficient Zero Trust strategy without stalling the advancement of cloud-based services.

(Learn More about Zero Trust from 2022 ‘ASTORS’ Multiple Homeland Security Awards Champion, Sophos. Courtesy of Sophos and YouTube.)

Secure Accelerated Modernization

Information technology is in a perpetual state of motion, and SASE serves as a base framework to allow it to keep progressing forward.

The major components of SASE, including not only ZTNA but also Software-defined WAN (SD-WAN), Cloud Access Security Broker (CASB), Next-generation firewall (NGFW) along with Firewall-as-a-service (FWaaS), and Secure Web Gateway (SWG) can be collectively leveraged to empower government organizations to safely adopt cloud-based services with unified management of all these capabilities and real-time oversight.

The modernization of government cloud-based technology has to move at a rapid pace to keep up with potential security threats, especially as more and more agencies shift to the now-familiar remote workforce model. Further driving ongoing improvement of the federal government’s cybersecurity posture is Executive Order (EO) 14028.

Per this presidential executive order, issued in May 2021, federal agencies are expected to follow several guidelines that set formal criteria to evaluate software, developer, and supplier security.

As security is at the very core of the SASE model, and the model’s purpose is to encourage and accelerate modernization of cloud security, a SASE implementation is a natural, fundamental and obvious consideration for agencies covered by this presidential order.

A Matter of National Security

As more and more of the federal government shifts to cloud-based services, the need for strong and nimble security increases.

This is the cornerstone for federal concepts like Zero Trust, Trusted Internet Connections (TIC 3.0), and FedRAMP, and the SASE model can directly fit within these and other requirements, all in the name of combating today’s (and tomorrow’s) security threats.

SASE is a foundational solution to the quandary of distributed federal employees, disparate and sometimes poorly-enforced policies, and technology stacks which have been inelegantly bolted together.

Its inclusion of the popular and effective Zero Trust concept makes it a front-line defense against potential threats, especially as both of these models will continue to evolve over time to further enhance security, simplify networking in a highly distributed environment, and combat threats both internal and external.

Look for further innovation from today’s SASE providers, especially those which integrate cleanly with threat detection and response offerings, which naturally complement SASE by expanding its overall value and effectiveness.

One essential capability from these related offerings is the ability to see and act on packet-level visibility of network traffic in real-time.

The combination of SASE’s centralized networking and security capabilities, along with security-driven visibility into the network traffic flowing through the SASE infrastructure, promises to deliver better security and risk management outcomes as well as more reliable cloud-based security postures that directly align with the needs of federal agencies in adhering to directives like Executive Order 14028 and OMB’s Cloud Smart strategy.

It’s a fast-moving space, so don’t be left behind.

About the Author

Ben Smith is Field CTO with NetWitness.

He brings more than 25 years’ experience in the information security, risk management, networking and telecommunications industries; he holds industry certifications in information security (CCISO, CISSP), risk management (CRISC), and privacy (CIPT); he is a patent holder and a published author.

 

Sophos Earns Four Platinum ‘ASTORS’ in 2022 Homeland Security Awards Program

American Security, Today’s Annual ‘ASTORS’ Awards, is the preeminent U.S. Homeland Security Awards Program, and now in its Eighth Year, continues to recognize industry leaders of Physical and Border Security, Cybersecurity, Emergency Preparedness – Management and Response, Law Enforcement, and First Responders as well as federal, state and municipal government agencies in the acknowledgment of their outstanding efforts to Keep our Nation Secure.

AST is pleased to announce that the Police Commissioner Keechant L. Sewell for the City of New York has agreed to participate in the 2023 ‘ASTORS’ Homeland Security Awards Ceremony and Banquet Luncheon as a guest speaker.

Please join AST in Welcoming Commissioner Sewell to the 2023 ‘ASTORS’ Homeland Security Awards Ceremony Luncheon on Thursday, November 16, 2023 in New York City.

Go to https://americansecuritytoday.com/product/awards-luncheon/ to secure your Seat or reserve a Table and Receive a Special Early Bird Discount.

***Limited space available. There will be No On-Site registrations.

The continually evolving ‘ASTORS’ Awards Program will carry on highlighting the trail of Accomplished Women in Leadership in 2023 and the Significance and Positive Impact of Advancing Diversity and Inclusion in our Next Generation of Government and Industry Leaders. #MentorshipMatters

So be on the lookout for exciting upcoming announcements of Speakers, Presenters, Book Signing Opportunities, and Attendees at the 2023 ‘ASTORS’ Awards Presentation Luncheon in November of 2023 in New York City!

Sophos (First of Four)

Best Anti-Malware Solution

Sophos Intercept X Advanced with XDR

• As organizations worldwide adopted remote work and increasingly managed globally distributed networks and cloud-based applications, the incidence of cyberattacks increased significantly. The statistics are alarming.

• According to Sophos’s 2022 State of Ransomware Report, Ransom attacks are more frequent (66% of organizations surveyed were hit with ransomware in 2021, up from 37% in 2020); Ransom payments are higher (In 2021, 11% of organizations said they paid ransoms of $1 million or more, up from 4% in 2020); and the average cost to recover from the most recent ransomware attack in 2021 was $1.4 million.

• To defend against such threats, organizations require an anti-malware solution that provides next-generation anti-exploit and anti-ransomware technology and root cause analysis. Sophos Intercept X Advanced with XDR (Extended Detection and Response), the first and only endpoint security solution built for IT managers and cybersecurity experts, addresses each of these criteria.

(Sophos Intercept X is the world’s best endpoint protection – combining ransomware protection, deep learning malware detection, exploit prevention, EDR, and more in a single solution. Courtesy of Sophos and YouTube.)

• Intercept X Advanced with XDR revolutionizes endpoint security, turning traditional reactive defense on its head with a proactive approach. It assesses the threat landscape, processes limitless samples, and makes more accurate predictions faster than traditional machine learning solutions for a more intelligent response to cybersecurity risks.

• Furthermore, Intercept X Advanced with XDR is the industry’s only extended detection and response solution that synchronizes native endpoint, server, firewall, and email security, including Sophos MDR, a fully managed threat hunting, detection, and response service, that fuses machine learning technology and expert analysis for improved threat hunting and detection, deeper investigation of alerts, and targeted actions to eliminate threats with speed and precision.

 

Sophos (Second of Four)

Best Cyber Managed Threat Response

• Sophos MDR

• Sophos Managed Detection and Response (formerly Managed Threat Response) is a fully-managed threat hunting, detection, and response service that provides a dedicated 24/7 security team to rapidly identify and neutralize sophisticated and complex threats targeting your computers, servers, networks, cloud workloads, email accounts, and more.

• Sophos MDR protects more than one million devices and has seen more than 500% growth since August 2020. It now protects over 8,500 customers and is one of the industry’s most widely used managed detection and response services.

• Sophos MDR fuses machine learning with human analysis for an evolved, innovative approach to proactive security protection, combining Sophos’ top-rated endpoint protection and data-driven Extended Detection & Response (XDR) with a world-class team of experts to neutralize the most complex threats.

• By leveraging proprietary investigation techniques to differentiate attacker tactics, techniques, and procedures (TTPs) that can appear normal and go undetected, Sophos MDR can better anticipate attacker behavior and identify new indicators of attack and compromise. Sophos MTR is customizable with service tiers and response modes to meet organizations’ evolving needs, providing them control over how and when incidents are escalated and what response actions are taken.

• Sophos MDR stands apart from top competitors with its ability to proactively take action to mitigate threats, and unlike competing services that stop at notifications, Sophos MDR neutralizes active threats, by highly trained teams of world-class experts remotely disrupt, containing and neutralizing threats with speed and precision. 

(The next time you have an active incident, remember that Sophos Rapid Response is available 24/7 with a team of incident response experts to provide the fastest relief available. Courtesy of Sophos and Vimeo.)

• Other services have complex hourly pricing structures, whereas Sophos MDR provides cost predictability with fixed-fee services, and enables responders to cut through red tape that could delay precious time to neutralize an active attacker that could potentially destroy businesses.

 

Sophos (Third of Four)

Best Endpoint Threat Solution

• Sophos Intercept X Advanced with XDR

• Sophos Intercept X combines anti-exploit, anti-ransomware, deep learning AI and control technology it stops attacks before they impact your systems, using a comprehensive, defense in-depth approach to endpoint protection, rather than relying on one primary security technique.

• Cyberattacks threaten not only the security but also the financial health of organizations. According to Sophos’s State of Ransomware 2022 report, the average cost to recover from a ransomware attack in 2021 was $1.4 million. Intercept X not only reduces these costs significantly; it also provides substantial help in preventing the cyberattacks in the first place.

• Customers report an 85% decrease in cyberattacks since they began using Intercept X with Advanced XDR and say that the reduction in time spent on remediation has made them twice as efficient at day-to-day tasks.

• Such efficiencies have propelled Intercept X with Advanced XDR’s market share to an all-time high. Sophos expects the momentum to continue as cybercriminals keep finding new methods of threatening organizations across multiple endpoints.

 

Sophos (Fourth of Four)

Best Network Security Solution

• Sophos Firewall

• The average cost to recover from the most recent ransomware attack in 2021 was $1.4 million. To defend against such threats, organizations require a network security solution that delivers advanced protection against cyberattacks without sacrificing performance or flexibility. Sophos Firewall does exactly that.

• In April 2021, Sophos upgraded the product’s hardware with XGS Series appliances that provide the industry’s best zero-day threat protection, with native support for TLS 1.3, which is up to five times faster than other models available on the market today. The TLS capabilities are critical tools in battling cybercrime: nearly half of the malware Sophos detected in January through March 2021 used TLS to conceal malicious communications.

• Sophos Firewall’s recent advancements for software-defined wide area networks (SD-WANs) and virtual private networks (VPNs) enable organizations to address the complexities and risks of the modern encrypted internet without compromising speed or efficiency, and the ability to integrate Sophos Firewall with other Sophos offerings under one unified management umbrella enhances the scalability, efficacy, and efficiency of the product.

(Discover why more and more organizations are switching to the all-new Sophos Firewall.  Courtesy of Sophos and Vimeo.)

• One of the key integrations is with Sophos ZTNA, a zero-trust network access offering, which micro-segments networks to protect against intrusions, lateral movement, and data theft.

• Furthermore, users of Sophos Firewall gain access to the Sophos Adaptive Cybersecurity Ecosystem, an open architecture that constantly learns and improves through automation and analytics as well as the collective input of Sophos products, partners, customers, and developers.

• *Sophos is a new competitor to the 2022 ‘ASTORS’ Homeland Security Awards Program.

Nominations are currently being accepted for the 2023 ‘ASTORS’ Homeland Security Awards at https://americansecuritytoday.com/ast-awards/.

Comprehensive List of Categories Include:

Access Control/ Identification	Personal/Protective Equipment	Law Enforcement Counter Terrorism
Perimeter Barrier/ Deterrent System	Interagency Interdiction Operation	Cloud Computing/Storage Solution
Facial/IRIS Recognition	Body Worn Video Product	Cyber Security
Video Surveillance/VMS	Mobile Technology	Anti-Malware
Audio Analytics	Disaster Preparedness	ID Management
Thermal/Infrared Camera	Mass Notification System	Fire & Safety
Metal/Weapon Detection	Rescue Operations	Critical Infrastructure
License Plate Recognition	Detection Products	COVID Innovations
Workforce Management	Government Security Programs	And Many Others to Choose From!

Don’t see a Direct Hit for your Product, Agency or Organization?

Submit your category recommendation for consideration to Michael Madsen, AST Publisher, at: mmadsen@americansecuritytoday.com.

AST strives to meet a 3 STAR trustworthiness rating, based on the following criteria:

• Provides named sources
• Reported by more than one notable outlet
• Includes supporting video, direct statements, or photos

Subscribe to the AST Daily News Alert Here.