cybersecurity Archives - Page 3 of 6 - Cyber Secure Forum | Forum Events Ltd
Posts Tagged :

cybersecurity

Geopolitical risk ‘will provide CIOs with new leadership opportunities’

 960 640 Stuart O'Brien
By:
0
0

Technology governance issues emanating from cross-country politics have led to digital geopolitics rapidly becoming an issue that multinational CIOs must step up to lead, according to Gartner.

Forty-one percent of Boards of Directors view geopolitical power shifts and turbulence as one of the biggest risks to performance, according to a Gartner survey. Gartner predicts that by 2026, 70% of multinational enterprises will adjust the countries in which they operate by hedging to reduce their geopolitical exposure.

“Digital geopolitics is now one of the most disruptive trends that CIOs must address, with many now dealing with trade disputes, legislation coming from one country that impacts global operations, and government imposed restrictions on the acquisition and use of digital technology,” said Brian Prentice, VP analyst and Gartner Fellow. “They need to get acquainted with this new reality and prepare for its impact.”

Geopolitics describes the geographic influences on power relationships in international relations. The resulting competition between nations plays out in many areas, including economic, military and society. Due to the increasing importance that digital technology plays in each of these areas, digital geopolitics is emerging as its own unique category of impact.

Gartner says CIOs must play a pivotal role in assessing corporate risk and, if required, rearchitecting digital systems. They will need to manage or exploit four distinct facets of digital geopolitics (see graphic below).

1. Protect digital sovereignty

Digital sovereignty will be a primary source of complex, dynamic and expanding compliance obligations for multinational enterprises. Governments are primarily addressing it through their legislative and regulatory powers, such as privacy laws like the GDPR, and are increasingly turning to extraterritorial legislation. Companies that deal with the citizens of a jurisdiction are required to comply with its laws, regardless of where the company operates or where the citizens reside.

CIOs must be proactively engaged in ensuring that the IT organization’s operating model and practices reflect current laws and regulations in place. Their role is to be aware of the legal environment and articulate to other executives how the IT organization supports compliance across the enterprise.

2. Build a local technology industry

The technology industry is of great interest to public policymakers around the world due to its size, fast growth, strategic importance, tax revenue, employment possibilities and lack of requirement for a specific national resource advantage.

Many national governments are investing in developing a home-grown tech sector. For example, the U.S. seeks to address regional imbalance in global chip production through the Creating Helpful Incentives to Produce Semiconductors (CHIPS) for America Act, and the Australian Government’s Digital Economy Strategy 2030 includes building a dynamic and emerging tech sector as a key pillar.

Efforts to establish a domestic technology industry provide CIOs with an opportunity for proactive engagement with governments. They must localize specific initiatives into countries that have the best integration between local expertise and access to government co-innovation support.

3. Achieve necessary military capability

The growing digitalization of national military and security operations will limit the availability of some technologies within various countries. Enterprises and CIOs are impacted by the emerging sphere of cyberwarfare, as well as the digitalization of existing warfighting and security technologies.

CIOs can no longer count on the availability of technology used by the enterprise for its operations in any country in which it operates and will likely be faced with restricted and mandated suppliers. To minimize disruptions, they must establish a vendor and technology risk center of excellence, chartered with a regular assessment of the exposure of key suppliers to evolving government restrictions.

4. Exert direct control over the governance of cyberspace

National competition for control over the governance of cyberspace will impact the operations of multinational enterprises. As digital technology weaves itself through all aspects of society, nations are seeking to ensure that their own technologies reflect and support their core values and their citizens. Governments are increasingly concluding that they need a protected national digital infrastructure.

The machinations by governments for control over cyberspace governance are beyond the influence of CIOs, but they will have profound impacts on a business’ ability to operate internationally. CIOs can advance the executive team’s understanding of cross-national competition for control over cyberspace and the impacts to their enterprise’s operations by leading an annual cyberspace environmental update briefing.

COVID IT: 27,887 cyber attacks took place throughout the pandemic 

 960 640 Stuart O'Brien
By:
0
0

COVID-19 had a big impact on the number of susceptibilities being exposed by cyber actors, to the tune of nearly 28,000 attacks across the duration of the pandemic.

Cyphere has analysed the statistics, comparing the figures to pre-pandemic years to highlight the effect COVID has had on cybersecurity.

A rise in digital transformation as a result of the pandemic led to companies purchasing new tech assets to support their staff working remotely.

These new technologies led to cybersecurity oversights that could have resulted in an increase in security exposures such as a lack of security validations before introducing the product to employees.

They analysed the number of vulnerabilities by year, to visualise the rise in exposures before and throughout the pandemic.

  • 2018 – 16,509 vulnerabilities

  • 2019 – 17,307 vulnerabilities

  • 2020 – 18,351 vulnerabilities

  • 2021 – 20,157 vulnerabilities

As seen above, the number of security exposures has steadily increased over the past four years. Until 2017, the figure had never reached 10,000 but less than five years later had doubled to over 20,000 security bypasses.

It signifies a huge shift in cyber protection, with the rise in cyber risks putting users and businesses at risk of data hacks.

They also examined the severity of the susceptibilities, they did this by using the CVSS (Common Vulnerability Scoring System) to determine whether the exposures were low, medium or high risks.

2021 saw the highest total number of exposures, with 20,157 across those twelve months. The severity of these exposures can be seen below:

  • High risk: 4071 vulnerabilities

  • Medium risk: 12,903 vulnerabilities

  • Low risk: 3183 vulnerabilities

In comparison to 2021’s susceptibilities, 2020 registered a larger number of high-risk exposures with 4,379, 308 more despite having fewer total susceptibilities.

Cyphere says analysing the most common types of susceptibilities can be extremely useful in forming a response to the wave of cyber attacks, it can allow cybersecurity professionals to build a defence to counteract the breach.

Each security exposure is defined using the CWE (Common Weakness Enumeration), which is used to categorise the weakness, it serves as a baseline for exposure identification.

Frustratingly, throughout the pandemic, the highest number of vulnerability types were ‘NVD-CWE-noinfo’ meaning the security bypass was undefined.

The problem with undefined exposures is that the lack of information makes it difficult to put actions in place to avoid this reoccurring. There were over 3,000 undefined susceptibilities in 2020 alone.

The number of exposures that were undefined grew between 2019 and 2020, it accounted for 13.49% of susceptibilities in 2019 and 19.35% in 2020.

When analysing the statistics from the pandemic, examining month-specific data can allow for more context in understanding the effect of Covid on cybersecurity.

The month-specific data revealed April 2020 was the worst month in terms of the number of cyber attacks. Across April, there were a total of 2209 attacks with 939 high-risk attacks and 302 critical risks. The lowest amount was the following month, May 2020 recorded 1058 attacks.

In 2021, April and June saw the highest number of vulnerabilities, April saw 1927 exposures whilst June recorded 1965 attacks. Between March 2020 and July 2021 there were a total of 27,887 vulnerabilities

Lastly, they analysed the products being targeted by cyber actors, worryingly they found that a number of Microsoft products were the primary target. Products such as Microsoft Exchange Servers and Microsoft MSHTML were being bypassed to gain access to personal details.

Harman Singh from Cyphere said: “This analysis of the NIST NVD entries during the pandemic presents a number of useful indicators for security and infrastructure teams. Digital and advanced transformations before and during the pandemic forces businesses to adopt digital solutions, at times bypassing standard approvals and change procedures. This is one of the added factors to the rise in cyber attacks.

“Although there has been increase in total vulnerabilities year on year basis, there are two ways to look at it – good news and bad news. There has been a decrease in critical risk vulnerabilities in 2021 compared to peak Covid months in 2020. Bad news is it’s not just the numbers we need to look at, but looking at the impacted services is a worrying factor. It includes email, internal and external services of a corporate network including remote connectivity solutions such as VPN, security gateways.

“This is why organisations should look into vulnerabilities more than just a CVE. These factors include exploitation in the wild, data sensitvity levels related to the affected service and potential impact. Keeping the practical context into mind helps security teams analyse large amount of vulnerabilities in an efficient manner. This reduces the noise that sometimes consists of just CVE scores but are practically complex attacks or have complex dependencies before an exploit takes place.

“It underscores the importance of regular assessments such as penetration testing, vulnerability scanning and management and incident response preparation. Organisations should adhere to strong basics with proactive approach towards security, utilising the industry expertise to stay on top of ever changing threat landscape.”

Network protection in the hybrid era  

 960 640 Guest Post
By:
0
0

By Gary Cox, Director of Technology Western Europe at Infoblox  

Since emerging from the worst effects of the pandemic, a mix of in-office and remote work has become common practice for many organisations. Initially seen as a temporary way of easing employees back into the workplace after almost two years working from home, it appears that hybrid work is here to stay for the foreseeable future. As of May 2022, almost a quarter of UK employees worked in a hybrid fashion.

However, in an effort to accommodate the needs of their new hybrid workforce, business leaders have inadvertently increased their organisations’ security and compliance risks. This distributed way of working has dramatically increased the attack surface. It’s perhaps little surprise, then, that according to Infoblox’s 2022 UK State of Security Report, the majority of UK businesses experienced up to five security incidents in a year. The advent of the hybrid era means it’s never been more important for businesses to protect their network – or harder to achieve.

Expanded attack surface

Lockdown forced many organisations to leave their physical offices for good, while others adopted hybrid work where most of their employers worked remotely for at least part of the week. Whatever their preference, companies needed to move their applications and data into the cloud and protect them beyond traditional security solutions like firewalls and VPNs.

But employees logging in over their home WiFi networks, and using personal devices for work purposes – or work devices for personal affairs – meant the attack surface was enormous. As a result, businesses experienced a large number of attacks, many of which resulted in downtime, which can cost organisations considerable financial and reputational damage. Indeed, 43 percent of respondents cited breach damages of $1 million.

Hybrid work was found to provide bad actors with a much wider range of entry points into a company’s network, too. Insecure WiFi, for instance, was reported as being the biggest reason for data breaches, followed by insider access through current or former employees or contractors, and employee-owned endpoints, such as mobile devices and laptops.

Trust nothing

Most people today are aware of the perennial threat of cyberattack, but most can do little to protect themselves beyond just changing the password on their home WiFi router. Organisations must therefore take responsibility for security. This requires them to adopt a zero trust approach, which works on the assumption that attackers have already breached the network.

A multi-layered zero trust framework means all parties must undergo authentication checks at every point, as data flows in and out of an organisation’s network. Doing so will enable the organisation to protect everything that’s connected to that network, as well as limiting the damage in the event that an attacker breaches its defences.

Improved security posture

Organisations everywhere, regardless of industry, should consider how to leverage their existing technology to improve their security posture. For example, solutions that take advantage of DDI – a combination of DNS (Domain Name System), DHCP (Dynamic Host Configuration Protocol), and IPAM (IP Address Management) services, which are already used for device connectivity – to  gain visibility into network activities down to the device level.

In addition to this, DNS security is essential for a zero trust approach. Given that more than 90 percent of threats that enter or leave a network will touch DNS, it is ideal for detecting potential threats. DNS security can help IT teams spot threats that other security tools miss, accelerate threat hunting, and reduce the burden on stretched perimeter defences. It helps them get more value out of third-party security solutions, through real-time, two-way sharing of security event information and through automation, which lowers the costs associated with manual effort and human error.

The COVID crisis has changed the way we work – potentially forever. As long as people continue to work remotely – even only once a week – the use of home WiFi networks will continue to increase the threat of compromise. It’s essential, then, that organisations have sufficiently robust security strategies in place to meet the demands of the hybrid era. A zero trust approach, supported by DDI metadata and DNS security, will help businesses adjust.

Data security to drive IT security market to new highs

 960 640 Stuart O'Brien
By:
0
0

The global cyber security market is estimated to record a CAGR of 10.5% between 2022 and 2032, driven by surging awareness among internet users about the sensitivity of their private data and impending legal actions prompting businesses to secure their online data by following the best practices.

That’s according to a report from Future Market Insights, which says increasing complexities associated with manual identification of vulnerabilities, frauds and threats encourage organisations to fool-proof their data. Owing to these phishing and data threats, the adoption of cyber safety solutions is estimated to grow at a ‘remarkable’ rate.

Key Takeaways

  • The demand for cyber-security solutions has increased over the past decade due to a surge in online threats such as computer intrusion (hacking), virus deployment and denial of services. Due to the expansion in computer connectivity, it has become of utmost importance to keep your data safe from intruders and impersonators.
  • Increased government regulations on data privacy are one of the key drivers of the cyber security market. In addition to that, accelerating cyber threats and an increasing number of data centers are the biggest revenue generators for the cyber security market.
  • There are various benefits offered by the cyber security market such as improved security of cyberspaces, increased cyber safety and faster response time to the national crisis. Backed by these benefits, the cyber security market is projected to showcase skyrocketing growth over the forecast years (2022-2032).
  • All in all, the cyber security market across the globe is a multi-billion market and is expected to show substantial growth in CAGR, from 2022 to 2032. There is a significant increase in the cyber security market because cyber security solutions increase cyber speed and offer a number of options to save data.
  • Large investments in the global cyber security market by various countries such as the US, Canada, China and Germany are witnessed owing to the expansion in computer interconnectivity and dramatic computing power of government networks.

IBM International, Booz Allen Hamilton, Cisco, Lockheed Martin, McAfee, CA Technologies, Northrop Grumman, Trend Micro, Symantec, and SOPHOS are some of the key companies profiled in the full version of the report.

Key players in the cyber security market are consciously taking steps concerning their information security, which is inspiring other businesses to follow in their footsteps and stay updated with the latest IT security strategy.

The adoption of cyber safety solutions is anticipated to grow impeccably as businesses look at curbing their steep financial losses arising from cyberattacks.

UK university students at risk from email scams, says report

 960 640 Stuart O'Brien
By:
0
0

Research has found that none of the UK’s top 10 universities actively block fraudulent emails from reaching recipients.

Proofpoint has released data identifying that 97% of the top universities in the United Kingdom, the United States and Australia are lagging on basic cybersecurity measures, subjecting students, staff and stakeholders to higher risk of email-based impersonation attacks.

The research found that 97% of the top ten universities[1] across each country are not taking appropriate measures to proactively block attackers from spoofing their email domains, increasing the risk of email fraud. This figure rose to 100% amongst the top 10 UK universities, with none actively blocking fraudulent emails from reaching recipients.

These findings are based on Domain-based Message Authentication, Reporting and Conformance (DMARC) analysis of the top ten universities in each country. DMARC[2] is an email validation protocol designed to protect domain names from being misused by cybercriminals. It authenticates the sender’s identity before allowing a message to reach its intended destination. DMARC has three levels of protection – monitor, quarantine and reject,[3] with reject being the most secure for preventing suspicious emails from reaching the inbox.

With a record 320,000 UK sixth-formers applying for higher education places this summer, students will be eagerly awaiting email correspondence regarding their applications when A Level results are announced on the 18th of August. The uncertainty and unfamiliarity with the process, as well as the increase in email communication provides a perfect storm for cybercriminals to trick students with fraudulent phishing emails.

“Higher education institutions are highly attractive targets for cybercriminals as they hold masses of sensitive personal and financial data. The COVID-19 pandemic caused a rapid shift to remote learning which led to heightened cybersecurity challenges for educationinstitutions opening them up to significant risks from malicious email-based cyber-attacks, such as phishing,” says Adenike Cosgrove, Cybersecurity Strategist at Proofpoint. “Email remains the most common vector for security compromises across all industries. In recent years, the frequency, sophistication, and cost of cyber attacks against universities have increased. It is the combination of these factors that make it especially concerning that none of UK top ten universities is fully DMARC compliant.”

Key findings from the research include:

  • None of the UK’s top 10 universities have implemented the recommended and strictest level of protection (reject), which actively blocks fraudulent emails from reaching their intended targets, meaning all are leaving students open to email fraud.
  • Whilst 80% have taken the initial steps by publishing a DMARC record, the majority (75%) only have a monitoring policy in place for spoofed emails. This policy freely allows potentially malicious spoofed emails into the recipient’s inbox.
  • 2 out of the 10 top UK universities (20%) do not publish any level of DMARC record.

The World Economic Forum reports that 95% of cybersecurity issues are traced to human error, yet according to Proofpoint’s recent Voice of the CISO report, Chief Information Security Officers (CISOs) in the education sector underestimate these threats, with only 47% believing users to be their organisation’s most significant risk. Concerningly, education sector CISOs also felt the least backed by their organisation, compared to all other industries.

With the shift to remote (and more recently, hybrid) learning, Proofpoint experts anticipate that the threat to universities will continue to increase. The lack of protection against email fraud is commonplace across the education sector, exposing countless parties to impostor emails, also referred to as business email compromise (BEC).

BECs are a form of social engineering designed to trick victims into thinking they have received a legitimate email from an organisation or institution. Cybercriminals use this technique to extract personal information from students and staff by using luring techniques and disguising emails as messages from the university IT department, administration, or a campus group, often directing users to fake landing pages to harvest credentials.

“Email authentication protocols like DMARC are the best way to shore up email fraud defences and protect students, staff, and alumni from malicious attacks. As holders of vast amounts of sensitive and critical data, we advise universities across the UK to ensure that they have the strictest level of DMARC protocol in place to protect those within their networks.

“People are a critical line of defence against email fraud but their actions remain one of the biggest vulnerabilities for organisations. DMARC remains the only technology capable of not only defending against but eliminating domain spoofing or the risk of being impersonated. When fully compliant with DMARC, a malicious email can’t reach your inbox, removing the risk of human interference,” concluded Cosgrove.

Best practice for students, staff and other stakeholders:

  • Check the validity of all email communication and be aware of potentially fraudulent emails impersonating education bodies.
  • Be cautious of any communication attempts that request log-in credentials or threaten to suspend service or an account if a link isn’t clicked.
  • Follow best practices when it comes to password hygiene, including using strong passwords, changing them frequently and never re-using them across multiple accounts.

This analysis was conducted in May 2022 using data from QS Top Universities.

Cybersecurity insurance market ‘worth $29.2bn by 2027’

 960 640 Stuart O'Brien
By:
0
0

The global Cybersecurity Insurance Market size in the post-COVID-19 scenario is projected to grow from $11.9 billion in 2022 to $29.2 billion by 2027, equivalent to a CAGR of 19.6% during the forecast period.

The report by ResearchAndMarkets says SMEs are majorly adopting cybersecurity insurance solutions and services to secure from cyberattacks and due to the growing instances of fraud.

It cites the insurance enterprise, Beazley, revealing that 60% of ransomware attacks were targeted toward SMEs, while Emsisoft, an anti-virus software firm, stated that businesses paid a ransom of $1.3 billion to cyberattackers in 2019.

SMEs are more vulnerable to cyberattacks as it is easier to gain access to their servers than larger networks, the report says. SMEs are expected to earmark more budgets for cybersecurity insurance in the coming years due to the soaring cases of cyber-induced attacks and the increasing mandatory legislation during the pandemic.

Asia Pacific countries are highly concerned about the increase in security spending due to the ever-growing threat landscape. For the report, the region comprises emerging economies, such as China, Japan, ANZ, and Singapore.

With effective government regulations and technological advancements, cybersecurity insurance is witnessing high growth opportunities in this region. Various developments are taking place in Asia Pacific, concerning the adoption of technologies, such as BI tools, cloud, analytics, and rapid infrastructure development.

The reports says an increase in regulatory developments, with surge in fines and penalties from non-compliance, is expected to uptake the demand for the Cybersecurity Insurance Market in Asia Pacific in the future.

For example, Zurich Insurance stated that the Cybersecurity Insurance Market is set to grow significantly in Asia Pacific. AIG, Allianz, Chubb, and Zurich are among the prominent players for cybersecurity insurance in the region currently

NCSC: Prepare for the long haul on Russia-Ukraine

 960 640 Stuart O'Brien
By:
0
0

Cyber security experts have urged UK organisations to prepare for an extended period of heightened threat in relation to the Russia-Ukraine conflict as they published new guidance aimed at supporting staff resilience.

The guidance from the National Cyber Security Centre (NCSC) – a part of GCHQ – is the latest in a series of interventions which began in January with advice to help organisations bolster their cyber defences in response to the developing situation in and around Ukraine.

It sets out eight steps for sustaining a strengthened posture when systems, processes and the workforce remain under pressure, focusing on staff welfare as a direct contributor to maintaining an organisation’s resilience.

The NCSC assesses the cyber threat to the UK as a result of the conflict remains heightened and organisations are urged to not let their guard down and to consult the new guidance to prepare for longer-term resilience.

Paul Maddinson, NCSC Director for National Resilience and Strategy, said: “From the start of the conflict in Ukraine, we have been asking organisations to strengthen their cyber defences to help keep the UK secure, and many have done so.

“But it’s now clear that we’re in this for the long haul and it’s vital that organisations support their staff through this demanding period of heightened cyber threat.

“We have produced new guidance to help organisations do this, and I would encourage them to follow our advice to help sustain their strengthened cyber posture.”

The guidance is designed to be applicable to any period of sustained heightened cyber threat, including the one arising from events in and around Ukraine. A blog post, published today, sets out how the advice relates to the current geopolitical situation.

It advises that increased workloads for cyber security staff over an extended period can harm wellbeing and lead to lower productivity, with a potential rise in unsafe behaviours or errors.

The recommended actions in the guidance include:

  • Getting the basics right by following our ‘actions to take when the cyber threat is heightened’ guidance;
  • Revisiting risk-based decisions taken during the initial phase of heightened threat;
  • Empowering cyber staff to make day-to-day decisions about the threat response without requiring additional oversight;
  • Ensuring workloads are spread evenly across individuals and teams and that frontline cyber staff can take breaks to recharge;
  • And accelerating planned action to harden networks and boost defence capabilities

It also points to other NCSC guidance and resources to help organisations improve their longer-term resilience, including the 10 Steps to Cyber Security collection and Cyber Security Toolkit for Boards.

The four biggest mistakes in IT security governance

 960 640 Guest Post
By:
0
0

By Atech

Intelligent IT security and endpoint protection tools are critical components of security governance, and the stakes within today’s threat landscape have never been higher.

A lapse in identity protection or zero trust networks could spell financial disaster for a company. We know that attacks are increasing in sophistication and frequency, and in cost with research showing the average cost of a data breach at an eye-watering $4.24 million.

But what about the other end of the spectrum? How can companies identify and rectify issues in their security governance before they become a problem?

#1 Not realising you are a target with less-than-perfect cloud IT security

Many business leaders using cloud data storage mistakenly believe they are not vulnerable to security breaches from outside attackers. However, this is not the case.

The barriers to entry in becoming a cybercriminal are incredibly low, yet the cost to a brand’s reputation is staggeringly high. Furthermore, fines issued to businesses for not adequately managing customer data are also extremely costly.

Therefore, IT leaders need reliable security governance systems and full visibility over user data, secure identity and access management protocols, encryption, and more.

Businesses can update their IT security playbook by partnering with managed security service providers. By understanding the distinct accreditations that service providers display, solution specialisms can be distinguished from operating procedures, to build a real picture of how the service aligns with your business’ needs. You need to receive timely guidance on the latest cloud security threats and how to mitigate them and how to remediate fast. This can only come with in-near-real-time insights of behaviours and attacks and with the expert support of a security operations centre, carrying an industry recognised accreditation such as CREST.

We outline the biggest mistakes in IT security governance and provide a comprehensive view of today’s cloud security challenges and how best to tackle them as an organisation. Read on to identify the other critical mistakes you could be making.

Just Say Yes – Why CISOs must now embrace SD-WAN

 960 640 Stuart O'Brien
By:
0
0

Digital Transformation has become a business imperative, yet rather than pulling together to enable essential change, the friction between network and securityteams is increasing. The business needs to move away from data centres and traditional Wide Area Networks (WAN) to exploit the cost, flexibility and agility provided by the cloud and Software Defined WANs (SD-WAN).

Chief Information Security Officers (CISOs), especially those working in regulated industries, insist the risks associated with public infrastructure are too high. Stalemate.

Until now. Organisations are pressing ahead with Digital Transformation plans and excluding the CISO from the conversation. But at what cost? Who is assessing the implications for regulatory compliance? At what point will the Chief Risk Officer prohibit the use of the SD-WAN for sensitive data, leaving the business running legacy and new infrastructure side by side, fundamentally undermining the entire Digital Transformation project? A new attitude is urgently required, one based on collaboration, understanding and a recognition that a Zero Trust security posture can safeguard even the most sensitive data, while unlocking all the benefits associated with SD-WAN.

As Simon Hill, Head of Legal & Compliance, Certes Networks insists, it is time for CISOs to take a lead role in the Digital Transformation process – or risk being side-lined for good.

Accept Change

CISOs need to face up to the fact that Digital Transformation is happening – with or without them.  Organisations need to embrace the agility, flexibility and cost benefits offered by the cloud, by Software as a Service and, critically, the shift from expensive WAN technology to SD-WAN. For CISOs, while the migration to SD-WAN extends the attack surface, adding unacceptable data vulnerability, saying no is not an option any more. CISOs risk being left out of the Digital Transformation loop – and that is not only adding significant corporate risk but also compromising the expected benefits of this essential technology investment.

Network and IT teams are pressing ahead, insisting the risk is acceptable. How do they know? For any organisation, this is a dangerous compromise: critical risk decisions are being taken by individuals who have no understanding of the full implications. For those organisations operating in regulated industries, these decisions could result in an exposure to $10s millions, even $100s millions of penalties.

Failure to embed security within the initial Digital Transformation strategy is also compromising progress. What happens when the CISO or Chief Risk Officer discovers the business is in the process of migrating from the old WAN to a new SD-WAN environment? Suddenly the brakes are on, and the call is for sensitive data to be encrypted before it hits the network. Adding Internet Protocol Security (IPsec) tunnels will degrade performance – so the business is then stuck using the legacy WAN for data connectivity while still paying for the SD-WAN and failing to gain any of the agility or cost benefits.  More frustration. More friction between teams that should be working together to support business goals.

Drive Change

Security is a fundamental component of Digital Transformation – indeed of corporate operating strategy. Rather than avoiding change, CISOs have a responsibility not only to secure the organisation but proactively advocate change, with security as the key enabler of Digital Transformation.

Digital Transformation does not by default create an inherently insecure environment – but it will require organisations to, somewhat belatedly, embrace a Zero Trust model.  It has been clear for many years that there is no correlation between ownership and trust. Just because a company owns infrastructure and assets does not automatically infer total trust over data security. Similarly, infrastructure outside the business is not inherently untrustworthy. The key is to build trust into a secure overlay to protect data that will allow a business to operate across any infrastructure whether it is owned or public.

A High Assurance SD-WAN overlay, for example, uses crypto-segmentation to protect and ensure the integrity of sensitive data. With this Zero Trust approach, High Assurance SD-WAN means whether the network is public or private, trusted or untrusted, is irrelevant: the data security team simply needs to define the policy and, with ownership of the cryptography keys, can be confident that data is protected at all times wherever it goes.

Working Together

Adopting a Zero Trust security posture changes the outlook for CISOs – and provides a foundation for vital collaboration with the networking and IT teams. With confidence that the data is secure regardless of network location, everyone involved in Digital Transformation can achieve their goals: IT and network teams can embrace the flexibility and agility of the cloud, SaaS and SD-WAN, while the securityteam still has control of the security posture.

This can only be achieved if the business embraces a different mindset. It is essential to think about security by design from the outset – and to break down the barriers between network, IT and security. The introduction of the Secure Access Service Edge (SASE) framework provides clear guidelines for the convergence of these teams to drive additional business value but the onus – and opportunity – lies with the CISO to ensure the entire organisation truly understands the Digital Transformation objectives.

This also demands an essential shift away from a regulatory compliance focused security posture – something that is inherently flawed due to the impossibility of creating regulations that keep up with the ever changing security threats – towards a truly business driven approach. Working together to plan the Digital Transformation process may take a little more time up front but it will result in a secure foundation that will remove any constraints to innovation and agility.

Conclusion

It is time for CISOs to change. There is no value in endlessly blocking essential new technology projects; and no upside in being excluded from vital plans as a result. By taking a proactive stance and driving Digital Transformation strategies, CISOs can redefine the role, become a key strategic player within the business and act as an enabler, rather than a constraint, to operational success.

It is time to find a way to say yes to secure Digital Transformation – without compromise.

SAVE THE DATE: CIISec Live returns this September

 960 640 Stuart O'Brien
By:
0
0

CIISec Live will make a comeback as a physical event on the 7th of September 2022. This year the event will be situated at Edinburgh Napier University and will take on the overarching thematic of ‘inspiring the next generation of cybersecurity professionals’.

We believe this concept along with the event being positioned at Edinburgh Napier really aligns with their values of nurturing talent and creating knowledge to shape communities all around the world.

The day will be content driven with an array of subject matter experts presenting on current trends in the field, the corporate perspective, and an academic standpoint on how to prepare for the profession.

The event will provide the opportunity to engage with our members in person again after 2 years of online meetings, but to also harness and explore interesting viewpoints from all levels of CIISec membership and practitioners in cyber security.

To register your interest in attending before the registration site goes live, please email the team at live@ciisec.org who will be in touch with registration details in the near future.

So save the date in your diary for the 7th September and we hope to see you there!