Business Can Minimise Cybersecurity Risks And Drive Profit

An astonishing 70 percent of the companies on the Fortune 500 a decade ago are no longer listed. The reason is simple: digital disruption.

There's not a CIO on the planet today that isn't expected to deliver on the promise of digital technologies to transform customer-facing services and internal processes. This means supporting new cloud and mobile-led ways of working while controlling risk in a digital world full of menacing new threats.

To make this a reality, IT and security must come together to harmonise the twin aims of profit and risk management. Their secret weapon is none other than that frontline IT stalwart the service desk, supported by automation and endpoint management.

Adapt or Die

The cautionary tales of Blockbuster, Kodak and BHS on the one hand, and the success stories of Airbnb and Uber on the other, are perfect examples of the power of digital transformation.

It's true that the US and Europe have approached this from opposite sides: the former focused on profit and the latter on protecting consumer privacy and improving security. The post-Brexit UK sits somewhere awkwardly in the middle, depending on whether or not it harmonises its laws with Europe after the split.

Whatever the nuances, enabling new digital ways of working has undeniably led to an explosion in the number of endpoints organisations need to manage – especially mobile devices.

And this is leading to an increased risk of data loss and/or theft. The Ponemon Institute recently polled over 18,000 US IT professionals and 69 percent claimed BYOD had significantly increased endpoint risk.

Whether we're talking about enterprise mobility or other parts of the organisation, new digital ways of working introduce new risks, both from external malfeasance and insider negligence. Some 18 million new malware samples across the board were recorded in Q3 2016 alone.

Financially motivated cyber-criminals, sophisticated state-backed cyber spies and publicity seeking hacktivists all represent a major threat today.

Unpatched vulnerabilities remain a bountiful attack vector for them, and the impact of resulting breaches or service outages can be massive. TalkTalk was breached last year via a simple SQL injection bug which should have been patched. The firm has admitted that the total cost after remediation, along with the impact on trading and customer retention, could be as high as £80 million.

The insider risk can be malicious, but most often it's accidental. Something as simple as clicking on a malicious ransomware link in an email, losing a BYOD device in a bar, or downloading an unapproved app could expose the organisation to unnecessary risk. A FoI request revealed 62 percent of data breach incidents reported to the ICO in the first few months of 2016 came as a result of human error.

Arming the Service Desk

A median post-breach dwell time of 146 days in 2015 tells us that security and IT teams still don't talk to each other enough. CIOs and CISOs will have to collaborate far more closely if they're going to support digital transformation strategies effectively.

The answer is to tool up the service desk with unified endpoint management covering multiple layers of protection, to deal with the varied threats facing organisations.

This approach should include: automated patch and configuration management to enhance stability and close down attacks exploiting known bugs; app whitelisting to mitigate the risk of zero day threats; encryption to protect data if it gets into the wrong hands; tools to automatically apply security policies to removable media and all corporate and staff-owned devices; and AV to deal with ‘background noise' malware.

Automation is key here, enabling the IT team to extend security right out to all endpoints and free up individuals to focus on more critical tasks. And it's the perfect role for a service desk which has unrivalled visibility into ‘incidents', which means it's often the first to acknowledge events which may herald a serious breach/attack. It's in the right place to escalate to security teams, but on the other side, security needs close communication lines into the service desk.

The service desk is also in a great position to monitor and report on ongoing efforts, supporting compliance and even fostering a security-first culture among staff.

In the end, effective digital transformation needs to balance agility and speed on the one hand with security and compliance on the other. This won't just require automated endpoint management led by the service desk.

It will require a cultural change, an IT team willing to listen to staff and ensure any changes don't block productivity. Fail on this front, and the creeping hand of shadow IT will undo all its hard work to support the business.

SC Magazine:                    CIOs Are Neglecting Process & Most Efficient Options:

Company Boards Need To Get A Grip:

 

« Spanish Police Arrest Banking Malware Suspect
Stuxnet, Secrecy & The New Era of Cyber War »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Professional Information Security Association (PISA)

Professional Information Security Association (PISA)

PISA is an independent and not-for-profit organization for information security professionals, with the primary objective of promoting information security awareness and best practice.

CERT-PY

CERT-PY

CERT-PY is the national Computer Emergency Response Team for Paraguay.

Cybercrowd

Cybercrowd

Cybercrowd is a cyber security specialist offering technical services, cyber security assessments, guidance and security thought leadership.

CommuniTake

CommuniTake

CommuniTake builds security, enablement, and management solutions to provide people and organizations with better, and more secure mobile device use.

Entreda

Entreda

Entreda offers a unified platform to automate cybersecurity and compliance policy enforcement for your devices, users, networks, applications.

Comarch

Comarch

Comarch is a provider of IT business solutions to optimize operational and business processes. Cyber security solutions are focused on Identity Management and Security Assessment services.

Hunters.AI

Hunters.AI

Hunters is the world's first autonomous hunting solution that leverages top-tier cyber expertise and AI to uncover hidden cyber threats.

Innovation Cybersecurity Ecosystem at BLOCK71 (ICE71)

Innovation Cybersecurity Ecosystem at BLOCK71 (ICE71)

Innovation Cybersecurity Ecosystem at BLOCK71 (ICE71) is Singapore's first cybersecurity entrepreneur hub.

Red Points

Red Points

Red Points protects your brand and content in the digital environment.

StrikeReady

StrikeReady

StrikeReady have developed CARA, an advanced technology solution that offers personalized and proactive assessment and remediation of future and current risk in real-time.

Client Solution Architects (CSA)

Client Solution Architects (CSA)

Client Solution Architects (CSA) is a leading digital transformation consulting firm focused on the U.S. Defense Department and all U.S. Federal enterprise information technology service areas.

vCISO Services

vCISO Services

vCISO Services is a small, specialized, veteran-owned firm focused on the needs of SMBs only.

LimaCharlie

LimaCharlie

LimaCharlie gives security teams full control over how they manage their security infrastructure. Get full visibility, build what you want, control your data, get the security capabilities you need.

AdronH

AdronH

AdronH is a company of Cyber Security consultants. We support companies and public institutions with their digital transformation to new and secure business platforms.

StrongBox IT

StrongBox IT

Strongbox IT provides solutions to secure web applications and infrastructure.

Dynamic Networks

Dynamic Networks

Dynamic Networks provide Managed Cloud Services; Unified Communications; Security & Compliance Services and Network & Infrastructure Services for both Public Sector and Private sector businesses.