The 2021 RSA Conference got underway on May 17, with RSA CEO Rohit Ghai explaining what resilience is all about and what that means for cybersecurity.
Resilience is the theme for the 2021 RSA Conference, which is being held as a virtual event as the ongoing global pandemic continues to restrict in person gatherings. Ghai opened the conference and his keynote with an acknowledgment that this year's conference follows a year of trial and tribulations for everyone. The path and the way forward in his view was summed up in one word - resilience.
"Resilience isn't just about getting up when you fall," Ghai said. "To be good at it, we must fall less often, withstand the fall better, and rise up stronger every time."
The Intersection of Chaos and Resilience
Ghai commented that the concept of chaos is a good way to describe the cybersecurity landscape. He noted that in cybersecurity, defenders are dealing with multiple, connected technology stacks across different cloud providers. On top of that, Ghai said that there is the added randomness of malicious actors trying to disrupt operations and instil fear.
"How can you secure chaos?" Ghai asked rhetorically. " You can't, you don't - you focus on resilience by embracing chaos."
Embracing chaos in Ghai's view is about expecting the unexpected, trusting no one and compartmentalizing failure zones. Going a step further, he suggested that cybersecurity reliability engineering teams should constantly assess and test their responses to different types of risks and attacks.
"If you don't have visibility, then you don't know what to defend," Ghai said. "Once you do have visibility, use threat intelligence to understand your vertical's likeliest antagonists, including their methods."
Zero Trust and Resilience
The concept of zero trust is also critical to enabling resilience.
"Zero trust was always important, but in the post COVID work from anywhere, always on world, it is an imperative," Ghai said.
By prioritizing based on risk and protecting what matters most, we will ensure that when we fall, we will withstand thatRohit Ghai
He added that zero trust is a mindset as well as an architecture. With zero trust organizations make use of microsegmentation to divide up a network, as well as providing application layer threat prevention. Zero trust also involves the use of risk based, continuous multi-factor authentication as a critical component.
"Most important of all is to limit trust to what is absolutely required, and never elevate trust based on unreliable factors," Ghai said. "By being prepared for chaos, we will fall less often."
Taking a Risk Based Approach to Resilience
Resilience is also about understanding and managing risk.
"We have to protect the address that represent the greatest risks, not where we see the most holes," Ghai said.
There are a number of different ways that organizations can take a risk based approach to resilience. Ghai pointed out that the NIST cybersecurity framework does an excellent job of proposing a risk based approach to cyber security. In his view, every organization needs to deploy an integrated risk management solution and implement methods to quantify all risk, including cyber risk.
"By prioritizing based on risk and protecting what matters most, we will ensure that when we fall, we will withstand that," Ghai said.
Kintsugi: Rising up Stronger
Ghai also emphasized the need for the cybersecurity community to be inclusive and diverse, in order to help grow the overall community.
"We need to recruit better than the adversary," Ghai said.
While the past year has been challenging, Ghai emphasized that there is need to remain vigilant and to build back up after failure. Building back after being broken, is what the Japanese art of Kintsugi, also known as golden repair, is all about as well. Ghai explained that in Kintsugi, gold lacquer is used to help fix and restore broken pottery and ceramics. For Ghai, Kintsugi is the perfect metaphor for what resilience should be.
"Kintsugi does more than restore - it transforms, it doesn't hide faults and breaks, it highlights them," Ghai said. "The golden wound becomes a celebration of the hand that put things back together, a celebration of the purposefulness and learning from the process, a celebration of resilience."