We’re all familiar with infamous buzzwords like circle back, touch base, hard stop, and many more. I would even go as far as to say you probably have an inherited disdain for such buzzwords. But for those outside of information security (infosec), the vocabulary soup of marketing terms for security may bring confusion or have you blindly trusting words that don’t mean anything. Let’s dissect a few of these security terms to get beyond the names and discover the naked truth.
Zero Trust
“Unlock 92% return on investment by enabling Zero Trust solutions.” That is a bold claim without a lot of context. If you’re outside of infosec, you may even be wondering what zero trust is and how it can have an ROI (Return on investment)! In short, zero trust means trust no users, no devices, no networks. With zero trust, you always authenticate and authorize for every user, on every device, from everywhere, use least privileged access (just-in-time, just-enough-access), and always assume breach.
Verdict: real!
Zero trust is very real and especially important for your security posture. Because attack surfaces are changing daily, implementing zero trust principles can protect your company on multiple fronts. Constant verification and least privileged access are critical in cases where user accounts are breached (or someone is attempting to breach). Additionally, the constant assumption of breach can help improve defenses by always looking for ways to improve.
Agentless
Definition: operations where no service, daemon, or process needs to run in the background on the machine the action is being performed on.
In layman’s terms, agentless systems don’t require the installation of an agent on the system, and instead use the push communication style. An important aside is that agentless systems are not great for highly controlled or highly regulated systems like financial data or PII (Personally Identifying Information).
Verdict: hype.
I need to clarify – agentless is real and has good use cases, but the definition has become misconstrued and misappropriated. Some companies have an “agentless solution” where the agent lives inside your application rather than alongside of your application. While that may be true for one specific product, that is not the correct definition of agentless. If you were to see that product and find a competing agentless solution, you may be in for a rude awakening. So yes, agentless is real, but our overall verdict is to not trust the term due to its ever-changing definition.
Cloud-Native
Microsoft’s simple definition is “an approach to designing, constructing, and operating workloads that are built in the cloud and take full advantage of the cloud computing model.” Even in Microsoft’s blog, they acknowledge that there are many different definitions between organizations and professionals. Cloud native is not a product, but an approach that prioritizes speed and agility. There are many assorted products from a host of vendors that claim to be cloud native.
Verdict: hype.
Are we allowed to do that? Cloud native framework, no matter the definition, is a good factor to look for when choosing products. However, just like agentless, cloud native’s definition has been changed many times to make it “fit” products. It doesn’t help that the roadmap for the cloud native landscape is incredibly broad and lacks direction.
XDR
Extended Detection and Response, aka “a SaaS-based, vendor-specific, security threat detection and incident response tool that natively integrates multiple security products into a cohesive security operations system.” That’s a lot of words to say proactive threat detection and response!
Verdict: real!
XDR has endless benefits, but one that I quickly want to focus on is avoiding alert fatigue. Because XDR has automated root cause analysis and creates a unified front, your security team only sees alerts for strong potential threats. Alert fatigue is on the rise due to a whole host of reasons, but the risk of ignoring an alert is real. Any tools you can implement to simplify your infosec team’s life will help prevent burnout and keep your systems much safer.
Buzzwords come and go, but security is forever. If all these words are too confusing or you are tired of marketing teams creating new words every day, reach out to us. We’ll help you cut through the noise and choose the products that best fit your company’s needs.
Would you like to find out more about us? Learn more how we began our cloud journey.
Comments