Moving cybersecurity upstream to achieve resilience

The traditional approach to cybersecurity—often tacked on as an afterthought—needs a serious overhaul. This was the consensus in the recent MN-ISSA sponsored fireside chat titled “Moving Cybersecurity Upstream to Achieve Resilience,” where industry experts gathered to explore the integration of security measures right from the early stages of software development and strategic planning.

Held at Metro State University, the session opened with remarks from Paul Veeneman, who set the stage for a deep dive into how application security and proactive cybersecurity protocols can align with overarching resilience strategies. Experts Clea Ostendorf from Wolfpack Security and Sean Costigan from Red Sift shared their insights, emphasizing the necessity to embed security into the software development lifecycle (SDLC) and adopt reasonable proactive measures to expand organizations’ distance from cyber threats.

Watch the full recording: 

The urgent need for a “shift left” approach

Moderated by experts in the field, the panel discussed the past and current paradigms of cybersecurity. Clea pointed out the critical need for a shift-left approach, integrating security earlier in the SDLC through engineering buy-in and alignment. Meanwhile, Sean highlighted the importance of moving cybersecurity practices upstream to not just react to threats but proactively prepare for them while raising costs on attackers.

The discussion identified common obstacles, such as integrating DevSecOps into continuous integration and continuous deployment (CI/CD) pipelines, where tooling and cultural resistance often play significant roles. Sean discussed how organizations could transform cybersecurity into a strategic advantage rather than seeing it as a cost center.

This includes the need for organizations to identify and address “technical debt” in their systems, such as legacy code, outdated protocols, and insecure configurations that often leave organizations vulnerable. This debt, as Sean described, acts as a silent enabler for cybercriminals, who exploit these weaknesses to compromise systems. Cleo also noted the importance of proactive measures and good cyber hygiene, “it’s never a zero-day that takes down organizations, it’s bad hygiene”, with the unheralded often not talked about. 

For example, the Library of Congress in the U.S. prevented a breach thanks to multifactor authentication, while Blackberry’s threat and detection team halted an infamous Russia FIN7 threat group from launching a ransomware attack.

Security, resiliency, and recovery: A triad for the future

The conversation progressed to how security measures are intrinsically linked to organizational resilience and recovery capabilities. Clea suggested strategies for designing secure systems that minimize vulnerabilities and support faster recovery, such as:

  • Incorporating threat modeling and secure architecture reviews into project lifecycles
  • Leveraging AI-driven tools and automated feedback loops to connect security incidents with development processes

These measures can help organizations quickly identify and mitigate weaknesses, even in the event of a breach.

Sean highlighted the need to understand cybersecurity resilience throughout the organization, providing examples of how proactive security measures have bolstered resilience in critical infrastructure sectors, such as water systems and transportation, and the need to align with security business goals, while further remaining compliant with new regulations like the Digital Operational Resilience Act (DORA).

Audience engagement peaked during the discussion on practical takeaways, including the use of AI and automated tools for cybersecurity, plus the creation of feedback loops between security incidents and development processes. Clea and Sean spoke on the impact of these strategies in real-world settings. The evolution of cybersecurity to empower change.

Looking to the future, the panel speculated on the next evolution of upstream cybersecurity, emphasizing the potential role of AI and machine learning. These technologies can:

  • Prioritize risks more effectively
  • Enhance security testing
  • Enable more active threat detection

Clea underscored the role of security leaders in “painting the picture” of potential risks and mitigation strategies, while Sean stressed the need for bespoke cybersecurity alignment within enterprise risk frameworks. He urged organizations to move beyond compliance and adopt proactive measures, such as robust asset management and routine auditing of exposed APIs and certificates.

The panel also addressed the looming challenges posed by quantum computing, which could render traditional encryption methods obsolete. Clea and Sean urged attendees to stay ahead of this emerging threat by exploring post-quantum cryptography standards and preparing for a future where data security will require entirely new protocols.

The session concluded with key calls to action, urging attendees to:

  1. Evaluate and integrate upstream cybersecurity principles into their operations
  2. Address technical debt and legacy vulnerabilities
  3. Adopt proactive measures to enhance resilience and recovery capabilities
  4. Leverage AI and automation to streamline security processes
  5. Prepare for quantum computing by exploring next-generation encryption standards

By rethinking and realigning their cybersecurity strategies, organizations can build a more resilient future and stay ahead of emerging threats. At Red Sift we are here to help, connect with our team today.

PUBLISHED BY

Sean Costigan

30 Jan. 2025

SHARE ARTICLE:

Recent Posts

VIEW ALL
Cybersecurity

Moving cybersecurity upstream to achieve resilience

Sean Costigan

The traditional approach to cybersecurity—often tacked on as an afterthought—needs a serious overhaul. This was the consensus in the recent MN-ISSA sponsored fireside chat titled “Moving Cybersecurity Upstream to Achieve Resilience,” where industry experts gathered to explore the integration of security measures right from the early stages of software development and strategic planning. Held…

Read more
Certificates

Six-day certificates: Here’s what you need to know

Francesca Rünger-Field

In January 2025, Let’s Encrypt announced a major step forward in enhancing web security: the introduction of six-day certificates, also known as “short-lived” certificates. This initiative aligns with Let’s Encrypt’s commitment to strengthening the Public Key Infrastructure (PKI) ecosystem and is set to roll out for general availability by the end of 2025. Why…

Read more
News

Red Sift becomes the recommended certificate monitoring service of Let’s Encrypt

Rahul Powar

We’re thrilled to announce that Red Sift Certificates Lite has become the official recommended certificate expiration monitoring service of Let’s Encrypt, the world’s most widely used Certificate Authority. Red Sift Certificates Lite is a free service that allows users to track up to 250 certificates with email notifications 7 days ahead of expiry. It…

Read more
Certificates

PCI-DSS takes aim at phishing attacks

Billy McDiarmid

The Payment Card Industry Data Security Standard (PCI-DSS) is a globally recognized framework for securing cardholder data managed by merchants and service providers. It outlines rigorous security measures to protect payment card information during storage, processing, and transmission, reducing risks of data breaches and unauthorized access.  In its latest update, the PCI Security Standards…

Read more