Creating Successful Cybersecurity Solutions

Digital hardware and software products represent the biggest entry door when it comes to successful cyberattacks. In a digital environment, everything is connected, from internal communications systems to IoT devices, to cloud storage, meaning that a security breach in one product can affect an entire organisation.

Even applications considered less critical by an organisation can lead to a breach of the entire system. With Statista estimating that cybercrime cost Germany €206 billion, and the global economy $8.15 trillion in 2023, the stakes are certainly high.

The Sunburst attack is a good example of why security considerations are so important for the design of software products. In 2020, malware was injected into SolarWinds’s Orion software as part of an update. This attack against a single software product managed to compromise over 18,000 customers, including the US Justice Department, which had its information stolen and its systems spied on. It demonstrates the extent to which modern connectivity has expanded the reach of cyberattacks.

New legislation is being passed to address these kinds of threats. The European Cyber Resilience Act is a legal framework that seeks to reduce the vulnerability of digital hardware and software products against cyber-attacks. It mandates cybersecurity requirements for digital products placed on the EU market and means that manufacturers are now obliged to think of security considerations throughout the life cycle of a product. This regulation will go some way to ensuring that all providers of security, communications and storage solutions provide robust technology and have backup and damage limitation plans in place to protect customer data in the event of an incident. However, for most organisations, compliance alone is not enough to ensure protection against an attack. 

To prepare and protect themselves in the battle against cybercrime, organisations must invest in greater prevention. But all cybersecurity resilient products are not made equal. So what considerations should suppliers take into account when designing software?

1: Secure From The Start

Security needs to be considered right from the start of the development process for network and connectivity solutions. The goal is to apply cybersecurity techniques as part of the secure software development life cycle (SSDLC), to ensure that applications are secure right from the get-go, i.e. security by design.

Before creating a new software product, security requirements should be mapped out and planned. 

Then, secure coding and architecture best practices should be followed, making sure that software components are isolated and that protocols such as encryption and authentication are implemented. Comprehensive testing and review will ensure that any potential vulnerabilities are detected. This process means that all features will be designed in a way where security is central to their functioning, rather than added as an afterthought.

2: Staying Up To Date 

Much like businesses are constantly investing in new security solutions, ransomware groups are consistently using the latest developments in IT to increase the sophistication of their attacks. Emerging technologies such as generative AI introduce new attack vectors, with the potential to exploit previously undiscovered vulnerabilities and self-evolving malware can often go undetected by existing security deployments. Quantum computing is also on the horizon and will create a new threat of cryptanalytic attack. Post-deployment support can monitor activity in the system and provide updates and patches that defend against new threats and keep the software secure, preventing any security incidents. For this reason, it is integral for security solutions to undergo constant development and reiteration to ensure they are protected from the latest tactics and technologies used by hackers. 

3: Flexibility Across Platforms

Most organisations operate using a patchwork of disparate third-party software which each have one, or a couple of functions. For example, there may be one system for emails, another for internal communications, and a third used for storing files and data.

This fragmentation can leave organisations at greater risk of attack because security teams lack a unified view of their IT system. Additionally, it only takes one partner with poor security to put an entire organisation at risk.

Enterprises need to look for flexible, adaptable security solutions that can be introduced to work across their applications, IoT devices and platforms to ensure water-tight protection of data across their networks. These solutions provide more thorough protection, while also being easier for a security team to manage.

Taking these three considerations into account when creating software and hardware applications will allow suppliers to go beyond compliance with EU legislation like NIS-2. 2024 will no doubt have its share of cybersecurity challenges, but by putting security at the core of their products, designers are best placed to provide their partners and customers with a secure, well-connected online environment.   

Vincent Lomba is Chief Technical Security Officer at Alcatel-Lucent Enterprise

Image: gorodenkoff

You Might Also Read: 

Under A Watchful Eye - Unified Observability:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Defending Your Supply Chain From Cyber Threats
Facing The Quantum Challenge »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Mielabelo

Mielabelo

Belgian consulting firm providing services in the security and compliance of information systems and IT service management.

Cybercom Group

Cybercom Group

Cybercom offers strategic advice, testing & quality assurance, security solutions, system development, integration, management and operation services.

Hypori

Hypori

Hypori is a virtual smartphone solution that makes truly secure BYOD a reality for organizations in healthcare, finance, government, and beyond.

KIOS Center of Excellence (KIOS CoE)

KIOS Center of Excellence (KIOS CoE)

KIOS carries out top level research in the area of Information and Communication Technologies (ICT) with emphasis on the Monitoring, Control and Security of Critical Infrastructures.

Assac Networks

Assac Networks

Assac Networks ShieldIT is an app that completely protects any BYOD smartphone from both tapping and hacking.

GM Security Technologies

GM Security Technologies

GM Security Technologies provides leading managed security services of the highest quality to every type of individual and organization in Puerto Rico, Caribbean and Latin America.

Blockchain R&D Hub

Blockchain R&D Hub

Blockchain R&D Hub's mission is to serve the needs of blockchain ecosystem as the center of excellence for technology research and development.

SafeTech Informatics & Consulting

SafeTech Informatics & Consulting

Safetech's OTShield detects, prevents and analyses cyber-attacks in SCADA and Industrial IoT systems by utilising state of the art deception techniques.

Stealth Software Technologies

Stealth Software Technologies

Stealth Software Technologies is focused on the generation of research and software products focused on applied cryptography and cybersecurity.

Tapestry Technologies

Tapestry Technologies

Tapestry Technologies supports the Department of Defense in shaping its approach to cybersecurity.

Guidehouse

Guidehouse

Guidehouse is a leading global provider of consulting services to the public and commercial markets with broad capabilities in management, technology, and risk consulting.

FortifyIQ

FortifyIQ

FortifyIQ's mission is to advance maximum security against side-channel attacks across the entire computing spectrum.

General Informatics

General Informatics

General Informatics is a team of technology enthusiasts with one mission: to make our clients even more successful through the best use of technology.

Yotta Infrastructure Solutions

Yotta Infrastructure Solutions

Yotta Infrastructure, a Hiranandani group company, provide Datacenter Colocation and Tech Services such as Cloud services, Network & Connectivity, IT Security and IT Management services.

Protexxa

Protexxa

Protexxa is a B2B SaaS cybersecurity platform that leverages Artificial Intelligence to rapidly identify, evaluate, predict, and resolve cyber issues for employees.

V2X

V2X

V2X delivers IT support, networking, and cybersecurity solutions that ensure optimal mission support and performance.