Blog Leveraging Decentralized Intelligence & Security: Cybersecurity Mesh Architecture
By Jeremy Nelson / 22 Nov 2022 / Topics: Zero Trust Cybersecurity
During our recent Mastery tech summit, my colleague Rob Parsons and I presented on the topic of Cybersecurity Mesh Architecture (CSMA). Mastery is an annual event where Insight teammates gather to exchange the latest trends and best practices in the tech space to better serve our clients. After Mastery, Rob and I continued our discussion about CSMA in this video.
Cybersecurity mesh, or cybersecurity mesh architecture (CSMA), is a collaborative ecosystem of tools and controls to secure a modern, distributed enterprise. It builds on a strategy of integrating composable, distributed security tools by centralizing the data and control plane to achieve more effective collaboration between tools. Outcomes include enhanced capabilities for detection, more efficient responses, consistent policy, posture and playbook management, and more adaptive and granular access control — all of which lead to better security.
Gartner IT Glossary, “Cybersecurity Mesh," as of 28 September 2022. www.gartner.com/en/information-technology/glossary/cybersecurity-mesh.
What is cybersecurity mesh architecture?
Cybersecurity mesh architecture is the term used to describe a new, holistic approach to cybersecurity. This approach is composable, scalable and a great fit for companies with widely distributed assets (such as hybrid and multicloud environments). CSMA provides flexibility and resiliency to a security ecosystem, rather than running security tools in a silo.
The reality is, no single vendor holds the number one spot for every cybersecurity need, and companies leverage a variety of tools to cover all their bases. What CSMA does is close the gaps between these platforms and try to establish harmony among them, so clients have a sturdy but flexible cybersecurity ecosystem.
Validating CSMA within the current cybersecurity landscape
The world of cybersecurity is growing more complex as attacks become more sophisticated. Organizations increasingly need more automatic, predictive and dynamic security decisions to be made in real time, which can be difficult with widely distributed security tools. Additionally, many organizations are managing these cybersecurity tools in silos, which is time-consuming and requires cross-monitoring. A layered approach is needed to increase those response times and recapture the current amount of manpower needed to monitor multiple tools. Overall, the current dispersed approach to cybersecurity leaves organizations in the dark by not allowing visibility into all their intelligence at once and does not provide a swift response to threats. CSMA can tackle all these challenges by connecting the dots across numerous cybersecurity tools.
Unpacking the benefits of CSMA
In concrete terms, CSMA can be viewed as a way to consolidate information, analytics and responses. Data across security tools can be combined, intelligence can be integrated, and a more complete analysis of threats can be established to respond to threats in real time.
Furthermore, dashboards can be consolidated to allow for a composite view of the entire security ecosystem, allowing for quick and effective handling of cybersecurity events. CSMA also allows organizations to translate their central security policies across all their tools, allowing for better conformity and fewer cracks.
Moreover, organizations can ensure their distributed identity protocol is implemented with fidelity across their users and endpoints with things like directory services, adaptive access, identity proofing and robust entitlement management.
How does this fit in with other security measures?
Zero Trust is widely known as the practice of only trusting a user/device after explicitly confirming their identity or status. As a philosophy, Zero Trust focuses on providing as little access to important assets to users as possible. What does that have to do with CSMA? Think of CSMA as an extension of our Zero Trust strategy: It ensures that across all platforms, access is limited to the most-necessary users and allows for a stronger distributed identity fabric. Secure Access Service Edge (SASE) on the other hand is a cloud-first security approach that unifies siloed networking and security services with a single management point. The purpose of SASE is similar to CSMA, but CSMA goes further by tackling siloes across all environments and solutions, not just cloud.
But of course, CSMA does not stop there. As outlined above, there are plenty of additional benefits to closing the potential gaps across multiple cybersecurity solutions that go beyond the Zero Trust philosophy and SASE.
Putting it all together
Cybersecurity mesh architecture is going to become critical as cybersecurity challenges grow in scale and complexity. CSMA is the best solution for modern organizations looking for more visibility and better responses across widely distributed assets. Additionally, CSMA intelligently builds upon the existing best practices, allowing organizations to seal potential cracks in their security landscape.
Achieve your digital transformation goals. Explore our capabilities to architect, implement, manage and secure innovative IT solutions.
Jeremy Nelson
North America CISO, Insight
Jeremy Nelson is a multidisciplined solutions architect with extensive experience in networking technologies, including projects in network design and implementation for international enterprises. He leverages his experience in cross-discipline technology fields to ensure Insight services and solutions deliver effective, efficient results for our clients and drive value for the business.
