Cybersecurity increasingly sits at the centre of how organisations operate, from protecting critical financial systems to managing identity across cloud environments. For Ben Hanson, the challenge has never been purely technical.
Ben Hanson is Global Field CTO and Director of Field Engineering at Zenity, and a former Senior Security Strategist and Advisor at Microsoft. A 25-year industry veteran, Ben previously served as Senior Security Strategist and Advisor at Microsoft, working with security and transformation leaders across some of the world’s largest financial institutions.
In an interview with the IT Security Guru, conducted by the Cyber Security Speakers Agency, Ben discusses why cybersecurity work carries such responsibility, what separates strong security practitioners from purely technical ones, and why identity has become one of the most important areas of modern cyber defence.
Cybersecurity often operates behind the scenes. What makes the work so consequential, and why is it a meaningful career to pursue?
Ben Hanson: “What we do in cybersecurity enables the whole of society to flourish. In this day and age, that is absolutely true.
“Recently, I was working in a coffee shop in the village that I live in. It was early in the morning, and outside the window I could see mums and dads walking with their kids through the village square to school. I was working on my laptop with a very large bank, helping them through a particular security challenge they were having.
“I remember thinking, as I looked outside at these folks walking across the square, what we’re doing matters to every one of those people, but none of them know it.
“If you lose a global systemic financial institution, like a large systemic bank, it doesn’t just affect cities and nations. It affects the financial systems of entire continents, which undermines the fabric of society in a very tangible, practical way.
“So this, for me, is both the great responsibility of working in cybersecurity, but also the privilege of working in cybersecurity. You can invest yourself in something that really matters.
“If you have a North Star in your career and you want to invest yourself in work that’s meaningful and consequential, you can’t find an industry to work in that’s more consequential than this one.
“That’s what I love about it the most.”
For someone building a career in cybersecurity, what separates the strongest practitioners from those who remain too narrowly focused on technology?
Ben Hanson: “I’d give two pieces of advice.
“First of all, remember who you work for and why. Security and risk management are not ends in themselves. They both exist to enable your business, your organisation, to achieve and sustain its goals and objectives.
“For a very long time, security organisations, and also IT organisations, have defined themselves as separate from their business. You’ll actually hear technology people and security folks refer to the rest of their organisation as “the business”, as though they were not a part of it.
“So we’re over here in the security ivory tower doing what we do, and all the business people are over there doing whatever it is they do.
“The problem with that is two things. Number one, that business signs our paycheques, which leads to number two: the only reason that anyone in security even has a job is because we work for growing, successful, innovative businesses.
“If you can remember that security’s job is to enable your business to achieve and sustain its business goals and objectives, it will help you not to bias towards security controls that are overly or unnecessarily risk-averse.
“It will help you to prioritise business enablement over stopping bad things happening, because those are two very different things.
“So remember who you work for and why.
“A second piece of advice I would give is to be careful about being overly technology-centric in security. That might sound like a weird thing to say, but security practitioners tend to have technology backgrounds. I include myself in this, networks and infrastructure.
“That is a good thing, but it also has some consequences if you’re not careful. One of those is that we tend to look at problems through technology lenses, and we tend to see solutions through technology lenses.
“This predisposes us to what I would call silver bullet syndrome, which is: technology is the answer, whatever the question.
“That is not true.
“Technology can enable transformation, but it cannot sustain it. All sustainable transformation is a transformation of culture.
“So the three Bs: the beliefs, the biases, the behaviours of your organisation, and the way that you think about and approach security in your organisation.
“If you don’t also transform the way that you think about and approach security, the non-technical dynamics, any success you make in the short term you can’t sustain. You will find yourself drawn backwards towards where you were.
“Many of you will have experienced this. The status quo has an incredible gravitational pull associated with it, and it takes a lot of energy to escape that gravitational pull.
“Organisations may make some progress by deploying new technology. We do this all the time in security. But inevitably, over time, the gravitational pull of that status quo, the culture as we’ve known it which did not evolve, pulls us back to the world that we’re trying to move on from.
“Many people will be familiar with Peter Drucker’s famous quote that culture eats strategy for breakfast. I would just like to say that culture eats everything for breakfast, including that shiny new security toy that you just bought.”
Why has identity become the new security perimeter, and how has the shift to cloud changed the way organisations need to defend themselves?
Ben Hanson: “It’s the central role of identity in security. It’s the idea of identity as the modern perimeter.
“Attackers are becoming more identity-centric. The industry is still trying to catch up with the implications of identity becoming essentially the central focus of what we have to protect.
“If you go back to the early 1990s, this is when enterprise firewalls came to the fore. This was before widespread cloud adoption, so it was very easy for organisations to draw a very stark dividing line delineating their traditional network perimeter and what was inside versus outside, what was trusted versus untrusted, what was us versus them.
“If you fast forward to the early 2000s, with widespread adoption of the internet and also adoption of cloud, you had organisations like the Jericho Forum talking about de-perimeterisation.
“The traditional network perimeter was eroding and was now contracting around assets themselves. This is where we got the “endpoint is bastion” idea. This is what led us into very advanced endpoint protections and EDR platforms.
“We’ve now taken another step towards the central role of identity in security. I think there are three reasons why this is happening.
“First of all, if you look at modern access scenarios, often the user’s corporate identity is the only common factor across all of the various domains.
“You have people using networks that you can’t control, at their house or at the coffee shop. You have people using endpoints, depending on your bring-your-own-device strategy, that you can’t control or control as well as you might like.
“They’re accessing data on systems that you don’t control, accessing SaaS applications that are run by someone else.
“Almost out of necessity, because it’s the only common unifying factor across all of those components, identity becomes the fulcrum around which all of these other pieces balance.
“A second reason why this is happening is attacker behaviour. Attackers have always been identity-focused.
“Effectively, every attack is an attack on identity. At some point around the middle of the attack chain, attackers try to get control of privileged identity so that they can get access to the data they want.
“Even though that’s true, it’s shifted even further.
“Very common attacks involve compromising cloud-native identities, moving to cloud-native applications, compromising application service principals, connecting via API to cloud-native services and extracting data out of those services.
“Nothing about that attack sequence touches your endpoint.
“So if you’re still focusing most of your attention on your devices, you’re going to miss a lot because those kinds of attacks don’t trigger any endpoint controls. And if they do, by that point it’ll be far too late.”
