Traditional perimeter defenses are failing. This is evidenced by how Ransomware has increased by 37% in the past year.
Our current approach is losing the war against ransomware.
It’s time to rethink our approach. What if we could implement a way to neuter malware and ransomware to prevent it from having an impact?
This was the topic of the Fortify Experts’ CISO Forum this past month. Seasoned security executives dissected a radical approach: Deploying Secure Enclaves.
Here’s an unfiltered summary of the forum discussion and an actionable playbook on how to leverage secure enclaves to minimize data access, data destruction, and data loss.
🔒 1. Secure Enclaves: Isolation as a Strategic Imperative
The Problem: Attackers bypass perimeter defenses, leveraging compromised endpoints, credentials, and lateral movement to wreak havoc..
The Solution: Micro-segmentation and Isolation at scale. Segmentation or containerized applications can enable isolation to prevent lateral movement from hardware to applications.
“It’s isolation of users, applications, and access controls that are needed to encapsulate and protect data .” – Security Leader (Fractional CISO)
“In OT environments, enclaves limit the attack splatter. If something occurs, it filters communications instantly preventing lateral movement.” – OT Security Director
Actionable Steps:
- Deploy Containerized Enclaves: Use Docker or Kubernetes to create immutable, self-healing application environments. Reboot to purge threats.
- Isolate Critical Workloads: Spin up cloud-based or on-premises isolation enclaves using software or hardware-based solutions – the best approach is to use a combination of both.
- Extend Isolation on Endpoints: Implement browser isolation on endpoints.
Vendor Options: See further Secure Enclave comparisons here
- Cloud-based Isolation Enclaves – Create Isolated cloud VMs (e.g. AWS Nitro Enclaves, Azure Confidential Compute, Fortified Desk)
- Use Isolation Hardware – Intel SGX servers with chip-based isolation.
- Agent-Based Browser isolation – Installed on endpoints so susceptible to endpoint corruption or breaches (e.g., Talon, Island, LayerX)
- Virtual Containerized Isolation – Air-gapped browsing. No software on endpoints. (e.g. Fortified Desk) . Spin up an air-gapped, isolation browser here: https://chrome.fortifieddesk.com
🎯 2. Data-Centric Security: The Core of Defense
The Problem: Tools and firewalls won’t save you if data is unprotected.
“We’re talking about infrastructure and lateral movement, but it all comes down to the data. How are you protecting it?” – Advisory CISO
“Attribute-based access control (ABAC) is critical. Tag data to block regions or entities dynamically.”
– Security Leader
Actionable Steps:
- Classify and Tag Relentlessly: Deploy tools like Microsoft Purview and Varonis to auto-classify data. Enforce policies that prevent data from leaving enclaves.
- Encrypt data if it leaves the enclave. Tools like Actifile can auto-classify and encrypt data for unauthorized users.
- Shift from RBAC to ABAC: Implement policies like: “Only US-based engineers can access R&D data during business hours.”
- Enable Watermarking on confidential workspaces to identify and prevent exfiltration. Tools like Fortified Desk can lay a watermark across the screen to trace leaks (e.g., “User X accessed at 14:30 GMT”). See watermarking example here: Secure OSINT Watermarked Workspace
💻 3. Kill the Endpoint Attack Surface
The Problem: 85% of breaches start at the endpoint.
“Taking the endpoint out of the equation removes 85% of the attack surface.”
– Cybersecurity Expert
“Make endpoints disposable. If no data lives locally, theft means nothing.”
– Financial Services CISO
Actionable Steps:
- Adopt Ephemeral Desktops: Air gap the endpoint by streaming apps & desktops. Use solutions like Fortified Desk to create ephemeral sessions that reset post-use.
- Block Local Data Exfiltration/Execution: Disable downloads and clipboard/copy-paste between corporate and personal environments.
- Zero-Trust Endpoints: Partner with hardware vendors (e.g., Lenovo + IGEL) for hardened thin clients that access an isolation browser-based desktop.
⚠️ 4. The Overlooked Threat: Hardware-Level Risks
The Problem: Chip-level compromises make physical controls obsolete.
“Attackers now target hardware. If they own the chip, lateral movement is moot.”
– Advisory CISO
“Can you vet every chip? Impossible. Assume compromise and design around it.”
– Military Cyber Strategist
Actionable Steps:
- Demand Hardware Transparency: Audit supply chains; prioritize vendors with hardware root-of-trust (e.g., Intel SGX).
- Encrypt at the Packet Layer: Deploy military-grade network obfuscation (e.g., encrypt packet headers) for IoT/OT devices. (Tools like Invisinet can mask the data over networks.
- Air-Gap Critical Systems: Legacy systems (even Windows XP) in disconnected enclaves can still outperform vulnerable modern stacks.
⚖️ 5. The Usability-Security Tradeoff: No Free Lunch
The Problem: Frictionless security is a myth. Digital MFA is breachable.
The Solution: As attackers become more sophisticated with the use of AI and Quantum processing, we must consider moving from Digital MFA to Physical MFA. Physical MFA removes the outside world from the equation.
“We must accept stricter security over convenience. Want resilience? Reduce convenience.”
– Security Leader
“While Physical MFA may introduce fatigue, it’s better than stolen MFA tokens.”
– Energy Sector CISO
Actionable Steps:
- Step-Up to Physical Authentication: Use Physical MFA (e.g., biometrics, CAC cards, Yubikeys) for high-risk actions (e.g., wire transfers, admin access, ERPs. confidential systems).
- Educate Stakeholders: Quantify risks: “Why we must shift from Digital to Physical MFA”
- Test Response Playbooks: Assume enclaves will be breached. Run tabletop exercises for data containment.
The Bottom Line
As one leader starkly put it: “Isolation alone isn’t a golden ticket. It’s isolation + encapsulation + access control.”
“Stop adding moats; start building airtight enclaves around data.“
Fractional CISO
Your Next Move:
- Pilot an enclave for user, application, and data protection.
- Classify 100% of data – start with regulated workloads.
- Demand hardware integrity from vendors.
“This is undeclared war. Assume your infrastructure is already compromised.”
– Military Cyber Strategist
Share your experience with enclaves below. This is a collective battle.
(Forum participants anonymized)
—
Relevant Tech Mentioned: Docker, AWS Nitro, Azure Confidential Compute, Fortified Desk, Talon, Island, Microsoft Purview, Varonis, IGEL OS, Invisinet.
Further Reading: Secure Enclaves: Why Immutable Desktops are the Inevitable Future of Enterprise IT
About Tim Howard
Tim Howard is the founder of 5 technology firms, including Fortify Experts, AI Cyber Advisors & Fortified Desk. Fortify Experts helps companies simplify cybersecurity through:
- People (Executive Search and vCISO/Advisory consulting),
- Process (NIST-based security assessments and Leadership Coaching),
- Technology (Simplifying Security Solutions), check out Fortified Desk.
How I can help you:
- Join over 30,000 People Getting Free Security Leadership Improvement Advice – Follow me on LinkedIn. www.linkedin.com/in/timhoward
- If you want to hire a great security leader, download our free ebook on How to Hire a Great CISO.
- If you want to quickly assess your Cybersecurity Maturity Level or need a Strategic Improvement Roadmap, contact me.
- If you are looking to simplify cybersecurity, check out Fortified Desk. The streaming desktop that air gaps the endpoint to reduce exposure and risks.
- Come be a part of the discussion in our Monthly CISO Forums.