SECURITY AT THE SPEED OF DIGITAL

INDUSTRY EXPERTS SAY DIGITISATION WITHOUT SECURITY IS A RECIPE FOR DISASTER

The fallout of the coronavirus pandemic has forced many organisations to reshape as digital businesses. However, the race to create new processes and services is not without pitfalls, with cybersecurity on top of the list. As organisations kick their digital initiatives into high gear, CISOs struggle to support ongoing transformation projects and gain visibility into their complete technology ecosystems.

The research firm Gartner says the momentum of transformation projects within the digital business will outpace the ability of organisations to accommodate changes related to security. Security teams must evolve their practices to keep pace with digital business.

How does digital transformation change cybersecurity needs?

“It starts with the underlying premise of what is ‘digital transformation’- the use of technology to change how a business delivers goods or services. Regardless of which technology is being deployed at any point in time, the common point is that technology is also an expansion of the organisation’s attack surface. This, in turn, increases exposure to malware and cyberattacks that the existing security infrastructure is not equipped to handle, exposing weak links in the cybersecurity chain,” says Patrick Grillo, Senior Director, Solutions Marketing at Fortinet.

Nicolai Solling

Nicolai Solling, CTO of Help AG, says as digital transformation becomes a necessity for business continuity and future relevance in the wake of Covid-19, the need for cybersecurity is more critical than ever before. “In a rush to innovate and shift to delivering their business models online, organisations have tended to focus primarily on functionality and features. However, the more organisations integrate systems and IT into their everyday business, the more they increase their attack surface and risk profile. This was further exacerbated by the overnight shift of millions of workers from onsite to remote work in response to the virus outbreak, luring cybercriminals to capitalise on the work-from-home disruption and the sheer volume of new target opportunities online.”

For this reason, we always recommend for security to be treated as a day-zero job and as foundational to any kind of digital transformation. Recently, the biggest problem we see is companies still playing catch-up to secure their remote access while cyber threats continue to multiply. Many businesses have failed in securing their assets because their digital transformation was focused on functionality and overlooked security, he says.

According to Maher Jadallah, Regional Director – Middle East at Tenable, the tools and processes of yesterday are being used to solve

Maher Jadallah

today’s problems – built and designed for the old era of IT when the attack surface was a static laptop, desktop or on-premises server. “As a result, organisations struggle at every step – seeing their assets, detecting weaknesses, prioritising issues for remediation, measuring risk, and comparing to peers. The digital era requires a new approach.

“Organisations need a modern, comprehensive strategy to quickly and accurately identify vulnerabilities and misconfigurations in their dynamic infrastructures, that delivers clear guidance and recommendations on how to prioritise and remediate any risks.”

Key stages in building a secure digital strategy

Building a roadmap to get your digital transformation securely can be an uphill task as it involves creating a framework and execution guidance.

“The most important step is getting together with all the stakeholders to gain a clear understanding of what new technologies are required for the transformation to be deemed successful,” says John Shier, Senior Security Advisor, Sophos. “That will then help inform the security of the new protection technologies or processes that need to be put in place to protect the environment. Part of the planning should also include a plan for what happens in the event of a failure or

John Shier Giuseppe Brizio Dr. Mike Lloyd

cyber-attack. Taken together, these plans will help steer the roadmap towards a plan that is suitable for the business and resilient against attack.” Giuseppe Brizio, CISO EMEA, Qualys, says a cybersecurity roadmap should be based on four key areas: Risk Management in order to identify and analyse cyber risks, threats likelihood, and business impact; People to ensure users cybersecurity awareness and right-sized cybersecurity professionals team; Processes in terms of IT assets visibility, prevention, remediation, detection and response to cyber threats/attacks and; technology in order to support and automate the cybersecurity processes and ensure their effectiveness.

Dr. Mike Lloyd, CTO, RedSeal, says to get the benefits from digital transformation, we have to focus on automation of basic hygiene. “This starts with inventory — it’s no small task to keep track of all the things on your part of the Internet of Things. Inventory is the bedrock, but above that, we have to map out our cyber terrain and how digital assets interact. Without that, we are like generals without a map — we’ll have no idea what is going on when the inevitable emergencies arise. We also have to learn the discipline of social distancing for our networks — keeping things apart that do not need to communicate.”

What are the key barriers to a secure digital transformation process?

Solling says in practice, the barriers that present themselves in the digital transformation journey are the inflexibility of existing systems, siloed IT systems, lack of technical resources, as well as the difficulty in defining a strategy for what needs to be achieved.

“There is no doubt we have the tools and security systems available today to mitigate the vast majority of attacks, so the risk actually lies in an organisation’s failure to implement a cybersecurity strategy through every step of its digital transformation journey as well as a failure to look at security requirements proactively rather than reactively,” he says.

Jadallah from Tenable says companies must return to the basics of cyber hygiene by leveraging vulnerability management and honest assessment of the challenges they face. This way, they can understand where the risks exist within their infrastructure and establish an efficient process to measure overall risk and secure their network.

He adds acquiring the tools, technologies, skills, and services to confidently define the boundaries of the network, the type and quantity of assets, applications, and services should be the priority for any security leader to keep up as the business adopts new technology and systems evolve.

This begs the question - How can organisations take advantage of the myriad of security tools they have invested in over many years?

Shier from Sophos says some of the already present tools in the organisation will be suitable for protecting newly transformed services or processes. This means companies can reduce the cost of deployment by leveraging existing technologies. In some cases, however, new security tools will be required, especially if the transformation introduces new technologies

Solling from Help AG concludes: “An organisation must periodically assess the effectiveness of its security systems, such as by getting endpoints tested by experts with a service such as penetration testing. Along with this, employees need to receive regular training to continue promoting their cybersecurity awareness and ensure they remain an additional line of defense and don’t detract from cybersecurity measures. Powerful bi-directional integrations between different security tools can also enable organisations to act efficiently and see true value from cybersecurity investments as they continue updating their security tools and software whenever needed.”