Ignorance is bliss — for hackers

Imagine standing in front of the CEO and company board of directors, asking them for a cheque for an obscene amount of money to pay off hackers that are holding critical data hostage and disrupting the company business.

Certainly, many would cringe at the very thought of this. They would block the uncomfortable scenario from their mind, instead hoping that the company's current security strategy is strong enough to prevent them from being the next victim of a high-profile data breach or ransomware attack.

But while ignorance is bliss, it will not prevent this scenario from occurring. The cycle of ignorance that exists today is bad for organisations, blissful for hackers, and needs to be broken before it is too late.

During the infamous SolarWinds attack, hackers breached the company's network via a compromised laptop. They then jumped freely from the company's active directory infrastructure to the Azure active directory and ultimately took over Office 365. After this, they were granted full access.

This was because the company employed an integrated security infrastructure approach instead of a security posture comprised of independent vendors and tools.

On paper, having a single vendor for IT and security can make working life easier — for one, it prevents the need to worry about interoperability issues. But relying heavily on a single vendor infrastructure also makes life easier for the hacker.

The SolarWinds breach is a prime example of how hackers were able to ride the connected fabric of an all-Microsoft shop. This begs the question, 'will the developer of the infrastructure be able to see its own vulnerabilities?' This is akin to why quality assurance and development/manufacturing are typically separate across any industry of choice.

That said, many organisations still rely on a single vendor, thinking they have both ease-of-use and security. Such willful ignorance, if left unchecked, can have severe implications in the future.

To deal with today's evolving threats, this cycle must be broken. Relying on a single vendor for both infrastructure and security is not good for business — it's time to start making the hacker's job harder, not easier.

This can be achieved by employing best-of-breed security practices at all segments of the infrastructure via security products and services that are independent of the underlying infrastructure.

Failure to do so may result in that very uncomfortable talk with CEOs becoming a reality.

To learn how to add an extra layer of security on top of current Microsoft tools, seek a solution brief on how vendor security can complement Microsoft security.