Using AWS X-Ray to Assist in Code Walk-throughs

Fancy a manual code walk-through?  Well, some assistance never hurt...

I leveraged AWS X-Ray to simplify understanding the sources and sinks.  Did it work, yes.  Is it for anything else other than microservices (e.g., ERP / EHR / EMR, trading, AI), not really.

Privileged Access Management (PAM) & Approach

There are both enterprise and point PAM solutions available to organizations.  With that said, as many organizations transition to a cloud-first and federated model, an enterprise solution may be the wiser choice.

While CyberArk, CA PAM, Centrify, etc. are expensive solutions, an organization may see a better return on investment (ROI) in the long run than an organization deploying multiple pointed (e.g., MSFT LAPS) solutions.

So, deploy PAM in a phased manner for AD, EUC, ERP / EHR, cloud, social media, etc. to make the cost palatable for the enterprise.

Identity & Access Management (IAM / IdAM) Programs

IAM / IdAM / Single Sign-On (SSO) / Privileged Access Management (PAM) / Multi-Factor Authentication (MFA) / Identity Providers (IdP) / Identity Federation are all part of a program that enterprises should focus on these days.  And, these programs need to be able to extend to multiple technologies: cloud, mobile, IoT, ERP, etc.

However, these endeavors are treated as one-offs. 

As organizations wrestle with business transactions (merges, acquisitions, divestitures), the need to have a formal, organized IAM / IdAM program grows in need.

IPS vs EDR vs NAC vs RMS

InfoSec teams have only so much budget, so how does one decide on whether to spend on the outer perimeter or inner perimeter of an on-prem network?

Well, what industry are you in?  Where are your critical systems and business processes?

If your org is not highly regulated, and you have critical systems (i.e., ERP) within your inner perimeter, then that should be your focal point.

While EDR, NAC, & RMS are all sexy technologies, they serve to protect the outer perimeter (e.g., laptops, workstations, file shares, business subnets).  And while assets themselves, hopefully your IT folks have embraced the cloud and ECM / EDM (i.e., SharePoint).

For the inner perimeter, your data center, IPS, UEBA, TI, & ATP technologies may be used to protect your financial systems, etc.  Now, these solutions aren't silver bullets, but there a start.

In this age of shadow IT, virtualization, and distributed workforces, priority should be your most critical digital assets.

Loss Expectancy & InfoSec Metrics

So when looking to make single / annual loss expectancy (SLE / ALE) as subjective as possible it helps to have some metrics (i.e., KPIs / KRIs).

While vulnerability scanning / DAST / SAST / pen test findings can help, the best examples are from either honeypots or via red team exercises, to include: social engineering, phishing, whaling, and / or compromised digital assets.

Such metrics will help with the providing the (estimated) annual rate of occurrence (ARO) needed to determine the SLE * ARO = ALE.

Finally, while subjective, annual net sales / days of expected outage always helps w/ determining the SLE for ERP / EMR / EHR / ICS / CRM / SFA systems.