Our dependence on IT platforms and the need to secure them creates a non-stop challenge. This challenge compounds as organizations encounter the complexities of hybrid work, cloud migrations, and an explosion of SaaS licenses.
All of this has increased the demands on both IT and Security teams. Yet, these teams are already overworked and under resourced. Add to that the current economic headwinds and the push to do more with less is understandable. At the same time, it can't go on like that forever. There's always a breaking point.
As decision makers continue to push the boundaries of their teams' capacity, something will have to give. Over time, all the rush jobs, the split focus, and the shortcuts will take a toll. Mistakes will be made, systems will go down, bad actors will take advantage, and operations will be impacted.
Can the chaos be avoided?
One thing's for sure. The push for greater efficiency isn't going anywhere. So where does that leave business already at risk of being overstretched? Can efficiencies be improved without opening gaps and adding risk?
The answer is yes and with the right tooling and automation, it doesn't need to be too difficult either.
Take configuration management as an example. While it might not command a lot of attention from business higher ups, it's critical to the operation and consumes a lot of resources. In that sense it makes for a great testing ground and something of a looking glass for the business a whole. If meaningful efficiency improvements can be achieved in configuration management, it portends similar uplift potential for other business units.
Inefficiencies as a natural byproduct of complexity
When it comes to configuration security and device hardening, it's important that IT and Security teams be aligned. Security needs continuous visibility on all devices to identify gaps in the security of their configurations. IT needs to identify the best path to remediation and see whatever changes are required through to completion. Then they need to validate the changes and confirm that the device or service is now properly configured.
These tasks are usually organized and managed as projects. Such projects typically run a few months and require an interdisciplinary team to serve as a sort of change advisory board. Project Managers, Architects, SecOps, and IT Admins need to work through the fine details of the project - discussing not only the expedience and effectiveness of the available options, but any potential knock-on effects.
A common project of this sort would be PrintNightmare remediation. This remediation relates to a high-risk vulnerability in the Windows Print Spooler service that allows hackers to remotely take over the device. Microsoft released several security updates to address the vulnerability, but (for a number of reasons) they've been sparsely applied. Instead, to remediate operators typically resort to the workaround of directly disabling the Print Spooler service. Of course that presupposes that business does not rely on the service.
Simple, right? In theory maybe. In practice, not so much. Such a project requires the team to first determine which Windows PCs and Servers have the Print Spooler service enabled. Then they'd need to determine when, if at all, that service is called upon by the business or by any required component of the business' tech stack. If other processes depend on Print Spooler, the team will need to disentangle and replace or isolate those functionalities. Finally, they'll need to reconfigure the affected device to disable the service.
Sound good? But wait, there's more. Some of the more nuanced considerations include:
- When the Print Spooler service is required for core functionality, how can that device and the wider network be protected?
- If the reconfiguration is remotely executed 1 by a script, by GPOs 2, or by InTune, how can you validate that it actually worked? (Validation is not available in SCCM or InTune.)
- What about new devices being added? 3
- What happens when an existing device has the service re-enabled by someone trying to print something?
- This simple example shows how a seemingly simple remediation project can quickly be so prolonged and costly.
Solving the nothing is ever simple problem
So how can automation be called on to improve efficiencies and improve the productivity of overstretched IT and Security teams? The key is transforming complex projects into simple operational tasks.
For this to happen, configuration management solutions need to offer security assurance, including the following key functions:
- Continuous monitoring of all devices at all times. Security operations need full visibility to identify configuration risks, see the limits of their policy reach, validate remediations, and get alerted to new and re-offending.
- Dependency mapping. Both security and IT need to know ahead of time if the changes being pursued for security will bear any unintended impact of the business.
- Push-button remediation. A mechanism to apply hardening measures at a click, no matter the device type or OS. No need for scripting and no chance for human error.
- Rollback on demand. Giving users the confidence to act decisively, knowing that they can easily revert any changes if needed.
- A central gather point. IT, Security and any other stakeholders must have a single source of truth and frame or reference around which to align their goals and actions.
The GYTPOL platform provides all of the above functionality and more, paving the way with automation that helps IT and Security teams harden more devices more quickly and with zero risk of operational disruption. Organizations using GYTPOL are able to do more with less and achieve massive efficiency gains - on average:
- Boosting labor productivity by 20+%
- Cutting mean time to repair (MTTR) in half
- Shrinking the attack surface by 35+%
Imagine replicating that sort of uplift across the whole organization. The impact would be absolutely transformative. And rather than adding strain and introducing new risks, it actually does the opposite. It makes life simpler and easier for all involved while eliminating human error from the operational equation.
A new era of efficiency
The journey towards operational excellence undeniably starts with improved efficiencies. Unfortunately, the pursuit of those efficiencies often becomes counter-productive; veering toward unrealistic expectations, unreasonable demands, and ultimately operational chaos.
But it doesn't need to be that way. There's a safer, smarter alternative, the key to which is finding ways to de-complicate projects and processes with automation. The GYTPOL platform exemplifies how advanced automation can be leveraged to deliver comprehensive configuration management and security assurance. Having that sort of automation in place and integrated into everyday workflows transforms complex projects into simple task, saving a huge amount of time and resources.
By integrating continuous monitoring, dependency mapping, push-button remediation, and robust rollback capabilities, GYTPOL not only enhances the productivity of IT and Security teams but also fortifies the overall security posture of the organization. It's a great case in point of how the embrace of smart automation strategies not only mitigates risks but allows businesses to thrive even under the pressures of limited resources and increasing demands.
_____
1.
Of course if it's not being remotely executed, the biggest task involved in the project would be the reconfiguration itself, going from device to device in a large distributed network.
2.
While this may be the preferred method of policy application, in actual fact at least 10% of GPO policies aren't successfully applied to the endpoint.
3.
On average, it takes 3-9 months before hardened configuration policies make it into the Golden Image and are automatically applied to new devices.
Contact us for a demo and a free fully functional trial.
Comments