The continued existence of significant infrastructure blind spots is difficult to rationalize. You cannot protect, control, or quarantine what you can’t see. Data governance, risk management, and compliance leaders live under the shadow of security and breach implications. Chief information security officers know the gap is always there. Access by unauthorized endpoints is clearly dangerous and means that advanced security measures can be for naught, if they regulate only the visible endpoints.
The persistence of blind spots – despite the major advances in “post-logon” security – is the paradox of corporate IT this year, last year, and for the past decade. What appears to be inexplicable complacency about unknown endpoints is more likely to be grim awareness that failure to see every port in real-time puts a greater burden on other security measures.
Paradox-Buster #1 – Bar the Door
The best way to stop a rogue endpoint intrusion is to never let it onto the network. Don’t rely on the layers of post-logon protection that you have in place. While they are good, they aren’t good enough… nor fast enough, every minute, 24 X 7. Instead of banking on remediation after bad behavior is detected, intercept every unauthorized endpoint using either Layer 2 MAC-based or 802.1X, and switch off the port being used, before any tainted traffic can touch the network.
This “Bar the Door” approach requires that you can also discover and persistently monitor all ports and links. Without the ability to see them all in real-time, there will be serious gaps.
Paradox-Buster #2 – Replace Discovery Tools That Aren’t Fully Vendor-Independent
Endpoint protection must start from awareness of every router, switch, and port on the network, plus real-time discovery of any endpoint attempting access. That requires discovery covering all brands, models, and versions. Realistically, your infrastructure is heterogeneous or will be soon. With the Internet of Things, and to give you negotiating leverage, you require fully vendor-independent discovery. It will help keep you out of costly traps.
Paradox-Buster #3 – Study Vendor Claims and Customer Testimony Carefully
Read vendor claims attentively. Do they state unequivocally “We find every port and endpoint and detect/block every new endpoint and device, in real-time, regardless of vendor, even on huge networks?” For compete discovery, your vendor should be willing to commit unequivocally to near-100 percent discovery effectiveness.
Earlier this year, a major technology publication conducted a test of several network access control (NAC) products, using a [very] small test network. Not one was successful in recognizing typical devices on even a tiny network. One can reasonably ask whether they could recognize everything on a network as large as yours.
Paradox-Buster #4 – Eliminate the Paradox and Bask in Higher Productivity
Establish 100 percent visibility of every IT asset, including ports and endpoints, to achieve efficiency, order, and higher operator productivity in security and other aspects of running a data center or network.
Insist on hearing customer testimony that a vendor solved their discovery issues “completely.” Discovery that is successful only 99 percent of the time is inadequate; if a breach occurs on the one percent it can cost tens of millions of dollars. There’s only microscopic wiggle room on the need for 100 percent discovery on big, heterogeneous networks.
Find Everything, Miss Nothing
This will give your other investments in security and ITOM applications the full and correct picture needed to work across the entire infrastructure. Wipe out the blind spots, and you can be confident that your other security solutions will become more effective. With absolute 100 percent discovery comes freedom from the pervasive, 100 percent unacceptable paradox of modern IT: network blind spots.