There's a print shop and wine bar in my neighborhood called Two Mile Wines and on the walls they hang exquisite printed metal maps of the San Francisco Bay. Silver print, brass-colored maps from the 20th century. They immediately draw you in.
The human mind likes to visualize a landscape to better understand the nature of the world. Maps give you a sense of place; only through a map can you see yourself in relation to the whole physical world.
I've long been a sucker for these things: in libraries, people’s homes, villas in Italy. In the 1980s, we had a small globe in my house that pulled friends and family towards it. Back then the Soviet Union loomed large on the map and in the American imagination. As representations of political power, maps show us where we stand in relation to allies and adversaries, known and unknown threats. Cartographers in the old world drew images of dragons beyond the border, projections of fears both real and imagined.
Ultimately, defense strategy is about controlling terrain – and that requires a map.
Maps help us see our defenses, too: the natural barriers of oceans and mountains, the placement of defensive means like the Great Wall or forward military bases. George Kennan’s Long Telegram is a geostrategy for containing the global spread of the Soviet Empire. Likewise the goals of the counterinsurgencies in Iraq and Afghanistan were not only to control “hearts and minds,” but to secure the terrain on which those hearts and minds resided, and thus to prevent violence from spreading.
In cybersecurity, you also need to understand and control your terrain. Few understand what that means or how to do it.
Just as in the physical world, you cannot defend your terrain in cyberspace if you do not have a map.
Application dependency maps help you see the contours of your cyberworld. Only then can you take steps to secure it.
Data centers are a bit like countries; everything that matters lives within them – your cities and towns are your applications and workloads, all the key assets that power your business. Today most organizations don't know where their cities and towns stand in relation to one another. They cannot see the pathways that connect them. Without a map you can’t identify the broken bridges, plague-ridden villages, or the holes in your defenses. Nor can you see the single points of failure that that could spell the difference between feast or famine. There could be one workload in your data center that drives hundreds of applications. Without a map that shows your application dependencies, you won’t find that breakpoint until it is too late.
Cyberspace is a bit like the Bifrost in the Marvel Comic Universe.
The nature of today’s cyberthreat landscape makes maps even more important. Criminal and nation-state adversaries can cross the globe in an instant through cyberspace, rendering useless the tried and trusted barriers of mountains and oceans. Cyberspace is a bit like the Bifrost in the Marvel Cinematic Universe. Without the heroic Heimdall to stand guard, an adversary can cross the Bifrost, walk right into your vault, and steal your crown jewel applications or high-value assets, just like the Frost Giants did in Thor. No elephants, slingshots, or aircraft carriers are required for breach – just hackers and computers. In Thor, at least Odin had his cosmic sensors and the vault had its deep internal defenses. Most organizations do not.
If you don’t have a map of your applications and workloads and infrastructure, you cannot secure your cities and your towns and your country. Few companies recognize the perils of life without a map. Fewer have the tools required to find their way. Here be dragons indeed.
This is why a good micro-segmentation strategy always starts with a map. Once you pinpoint your cities and towns, you can place antennae on each and set policies to govern how they interact. Only by controlling how your applications and workloads interact can you control the interior of your network. Only then can you control your terrain.
The internet era has upended how states compete, conflict, and cooperate. But still, it all starts with a map.