“Here be Dragons!” Providing a Perimeter to Keep the IT Dragons at Bay

In the early days of map making, cartographers would use the phrase ‘hic sunt dracones’ (‘Here Be Dragons’) and pictures of monsters and sea serpents in areas outside of the known world to illustrate the concept of ‘we don’t know what’s beyond this, but it’s probably dangerous’. In today’s IT environments we have the same concept – everything that’s outside of our known and managed perimeter is probably dangerous. However, we have the same problem that early map makers did – the world isn’t static, and every major shift in technology changes what we know and what we think we know about trust (security, integrity & availability). About the time we think we’ve got a handle on what’s where and how it’s used, something new comes along and discombobulates our notion of a perimeter.

In the earliest days of IT technology the concept of a perimeter was easy – anything not directly connected to the mainframe was considered ‘outside’. Then networking and distributed computing came along and we were forced to expand the concept of a perimeter to encompass all of those systems, applications, data and users; but even then, defining what was ‘ours’ (inside our perimeter) and ‘not ours’ (outside our perimeter) was pretty straightforward. Fast-forward a decade or so and things like supply chain automation, B2B and outsourcing started forcing us to stretch that perimeter even more, as well as poke some more holes in it. Even our physical perimeter started crumbling a bit, since we could have other organization’s hardware in our data center and our laptops leaving our buildings.

In the last few years technologies such as cloud computing and mobile devices are pretty much obliterating the traditional concept of a perimeter and forcing us to look at how we ensure trust in new and sometimes novel ways. Remember, while users want to enjoy the flexibility of sitting in a coffee shop and working on their tablet, we (IT & Security) are still ultimately responsible for ensuring the security, integrity and availability of everything behind their screen. From a business perspective the organization  doesn’t care if things are unavailable because our cloud provider’s power went down and their backup UPS failed, or if data was stolen because of a nasty new piece of malware that targets iPads – their ultimate concern is the correct operation of the business. To that end we still need to provide our environment with perimeters to keep the dragons at bay – we just need to change the way we think about and implement those perimeters.