The New Face of Cybersecurity
Over the past few years, digital technologies have rippled through the business world and unleashed unprecedented innovation and disruption.
Yet today's technology framework also has put businesses in the crosshairs and created new levels of risk.
No longer are cyber-threats thwarted by clearly defined perimeters such as firewalls. No longer are malware and cyber-attacks blocked by traditional security tools designed to identify specific viruses and code. "It's an entirely different landscape," observes Oswin Deally, vice president of cyber-security at consulting firm Capgemini.
Mobility, clouds, the internet of things (IoT) and the increasingly interconnected nature of business and IT systems have radically changed the stakes. There's a growing need for security transformation.
Yet, at the same time, attacks are becoming more insidious and sophisticated. Phishing, spear-phishing, whaling, ransomware, hacking, hacktivism and corporate espionage are now mainstream problems. Data breaches and DDoS attacks are a daily concern.
"Cyber-security has moved from a compliance and regulatory topic to front-page headline news," says Dan Logan, director of enterprise and security architecture for Tata Consultancy Services (TCS).
No Space Is Safe
The scope of today's cyber-security challenge is mind-boggling. Gartner predicts that more than 8.4 billion IoT devices will be used in 2017, and the number will swell to more than 20 billion by 2020. Meanwhile, 74 percent of organisations now store some, if not all, sensitive data in the public cloud, according to a February 2017 Intel Security study.
Not surprisingly, the stakes are growing, and achieving digital transformation while ensuring security is not a simple task. An October 2016 Ponemon Institute study found that the average cost of cyber-crime to a large organisation in the United States rose to more than $17 million in 2016.
An interconnected world with intertwined data means that threats can come from anywhere at any time. Business disruption, information loss, a diminished brand image and revenue, and damage to equipment are constant risks. Nevertheless, organisations are struggling to keep up.
Ponemon points out that only 39 percent of companies deploy advanced backup and recovery operations, though it reduces the average cost of cyber-crime by nearly $2 million. Similarly, only 28 percent of companies have a formal information governance program, though this typically reduces the cost of cyber-crime by nearly $1 million.
Capgemini's Deally says that a starting point for dealing with today's threat landscape is to recognize that there are two primary areas to focus on: business-driven events and threat-driven events. The former revolves around things like digital commerce, innovation, intellectual property, products and supply chains that present targets and create risks for the enterprise. The latter encompasses attack methods and vectors, including email, mobile devices, the IoT, and other systems and software.
"It is becoming more and more of a borderless world where the devices that drive productivity also represent risk," he points out.
CIOs and other enterprise leaders must understand business and technology intersection points and how they introduce risks at various levels—from application security to APIs and network design to clouds. It's also important to clearly understand business and data assets and identify priorities in terms of value, sensitivity and risk.
Not all data is created equal and not all systems require equal protection. This approach, when layered over specific industry risks, begins to deliver some clarity about how and where to focus a cyber-security strategy and select the right protections and processes.
To be sure, cyber-security must take a multilayered approach, and it must focus on defense-in-depth. One of today's challenges is that intruders may gain entry to a network through a vulnerability or breach and worm their way through systems and files over a period of weeks, months or years.
These advanced persistent threats (APTs) use multiple tools, technologies and methods to take intrusions to a deeper and more dangerous level. In some cases, the intruders may never make their presence known. They simply pull information, everything from employee or customer data to intellectual property, to perpetuate attacks that monetise their efforts.
Secure Horizons
CIOs and other enterprise leaders must ultimately focus on strategies that rely on multiple tools, technologies and methods to address the problem on several fronts. This may include everything from reviewing privileges and reexamining authentication methods to analysing coding practices and reviewing the way encryption is used for data at rest and in transit. It could also address everything from vendor relationships to coding practices.
For example, as organisations migrate to DevOps, it's possible to use automated code scanning to detect vulnerabilities before software goes live. In addition, emerging cyber-security tools use artificial intelligence (AI), machine learning or deep learning, along with analytics, to detect unusual behavior and patterns. If an employee logs in at an unusual time from an unknown device or IP address, the system may require re-authentication.
However, TCS' Logan also stresses the urgency of employee education and training. Many of today's breaches are caused by inattentive employees, sometimes even those in the C-suite, who click a link and infect a system with malware, including ransomware. In other cases, employees circumvent policies because they interfere with their work, or they turn to shadow IT and rogue applications to complete work easier or faster.
"Ongoing employee education about phishing, and the use of anti-phishing campaigns that send test emails to users and then respond to clicks with just-in-time education, is an effective addition to employee security awareness efforts," Logan says. Likewise, intelligence sharing services can help organizations identify new risks quickly.
In the end, Logan says that a simple mnemonic is useful for security transformation: ARM. This translates to assess, remediate and monitor. Best-practice organizations embed cyber-security into the foundation of day-to-day IT operations. They have robust backup and recovery systems in place to guard against ransomware and other problems. They handle basic blocking and tackling but also examine how more advanced tools, technologies and practices can boost protection.
To be sure, the road to security transformation is long and winding. "A world-class organisation must excel at the basics of identity management, vulnerability management, configuration management, incident management, incident response, backup and recovery," Logan explains.
Capgemini's Deally adds: "From a CIO's perspective, it's essential to look at what are you doing from a business perspective and build security protections from there. The most important question, and the one to work backward from in every case, is, 'How can I best mitigate risk?'"
You Might Also Read:
Stop Data Breaches, Start With Databases:
ENISA’s Threat Rankings: From Malware To Cyber Spies:
Board-level Cyber Literacy Is Low, Discomfort High:
The Cyber Security Landscape: A Frightening Picture:
