Gartner’s Top Security and Risk Trends for 2021 report identified cybersecurity mesh as the “modern conceptual approach to security architecture that enables the distributed enterprise to deploy and extend security where it’s most needed.” In this blog, we’ll dig in and discuss how the cybersecurity mesh enables better visibility and security in the modern enterprise.
Why do you need another new security concept?
Gartner says that “In the past year, the typical enterprise has been turned inside out.” I think most of us can agree. The pandemic has accelerated digital transformation at an unprecedented pace. In a battle for existence, organizations adopted cutting-edge technologies to support work-from-anywhere trends. They migrated data, services, and apps to the cloud, adopted containerized environments, and invested in connected IoT and mobile devices.
Not just many, but most corporate assets are now outside the traditional security perimeters, rending legacy controls inadequate to protect them against increased cyber threats. With remote working and work-from-anywhere the new norm, enterprises have transformed into a geographically distributed environment of assets, employees, partners, and customers.
At the same time, the dependence of businesses on complex and extended supply chains for application development or running their production lines has increased.
Lack of adequate security controls to safeguard cloud deployments and supply chains against advanced and increased cyber threats creates gaps and blind spots that adversaries exploit to compromise data and disrupt operations. Ensuring reliable, flexible, and scalable cybersecurity controls is a necessity for all enterprises to secure their digital transformation initiatives.
This is exactly where the concept of cybersecurity comes in handy.
What is cybersecurity mesh?
While there isn’t an official definition for cybersecurity mesh, it is closely tied to the concept of a ‘identity control plane.’ The objective is to bring a distributed approach to network and infrastructure security, moving away from the traditional perimeter-centric approach. Instead, the security design is centered around identities of humans and machines on the network, creating smaller, individual perimeters around each access point.
The goal is to ensure that the security of each access point can be effectively managed from a centralized point of authority. In this way, the cybersecurity mesh helps to centralize security policies while ensuring enforcement is more distributed – a robust, flexible and modular approach much needed for enterprises operating from anywhere in an evolving business and risk environment.
Cybersecurity mesh becomes a building block of a Zero Trust security strategy ensuring all data, services, devices, and applications are accessed securely regardless of where they are – whether by human or machine. All connections to access the data are considered unreliable unless verified.
In fact, Gartner predicts that “By 2025, cybersecurity mesh will support more than half of all IAM requests, enabling a more explicit, mobile and adaptive unified access management model.”
What now?
Identity and access management (IAM) is increasingly centered around the protection and management of machine identities to enforce well defined, centralized levels of access. A centralized policy definition would make enforcement location-agnostic, irrespective of where the data resides.
As more and more corporate assets get digitized, and organizations increasingly migrate to cloud computing environments, the cybersecurity mesh will provide greater, more flexible and scalable level of protection than physical boundaries to secure investments on digital transformation.
