If you want to lead a security transformation, elegance is a virtue to keep in mind. This does not mean overly permissive policies. Elegance is nimble – but strong and controlled as well – and our security stacks should be the same.
Cybersecurity enforcement policies should adopt the elegance of microservices design. Not focusing on how to implement our tools efficiently is an industry failure and a risk to our organizations.
By breaking my own rules, I proved I was right about Entitlement Based Policies – especially when it comes to IAM and user provisioning.
EDR deployments are often undermined by policy sprawl – too many policies that conflict or are unclear. Moving to an Enforcement Based Policy model can not only simplify deployments – but puts the focus back on the security posture of the organization – not its dynamic structure.
Security teams need to think like developers to more efficiently protect microservice based architectures. Trying to create security enforcement policies organized around monolithic applications flows will not only make it harder to keep up with dynamic releases – it could undermine the advantages of microservices and zero trust networking altogether.
Security policies should not be organized around “communities” – they should be built around the entitlements they grant. These entitlements should be “service provider” focused – not based on membership in a point-in-time organizational structure. Developers realized the value of object oriented design years ago – security policies should do the same.