Firewalls, VPN appliances, and security gateways are increasingly being targeted because they provide the greatest leverage and control, he noted. As such, security teams must treat these appliances as high value assets with the same access control safeguards, vulnerability management, monitoring, and incident response rigor applied to other critical infrastructure.
This means aggressively patching internet facing systems, restricting management access, monitoring for unusual administrative activity, and looking for indications of persistence or lateral movement, he said. But patches don’t evict already established attackers, so security teams must investigate and, where necessary, rebuild affected systems from trusted images.
And with AI accelerating attacks, CISOs should consider establishing a zero trust mindset and architecture collectively across the pillars of identity, network, applications, data, and devices, he said.
