Cyber Sentinels April 2022 by GEC Media Group

VOLUME 0 8 | ISSUE 25 | APRIL 2022 SPECIAL SUPPLEMENT BY APPROACH TO SECURITY NEEDS AVANT-GARDE AMNA AL-BALUSHIISHAQ Chief Information Security Officer, Leading Islamic Bank in Oman

We shall be bringing a thorough coverage of the same in our next issue of Cyber HappySentinels.Reading! all readers,

EDITORIAL Wishing

Welcome to 2022’s second edition of The Cyber Sentinels. Once again we bring to you some intriguing thoughts and opinions from our leading security practitioners and deci sion makers. In this issue of Cyber Sentinels we take a closer look into the challenges and opportunities that our CISOs face in their organizations and how they are evaluating the skill sets and newer technologies to sail through them. We have featured our Top 10 CISOs/Security Heads for the month who divulge into the details of how digital transformation is impacting their roles and responsibili ties and affecting the security posture of the business.

a very happy and peaceful Eid Mubarak! PRINTED BY AL GHURAIR PRINTING & PUBLISHING LLC. MASAFI COMPOUND, SATWA, P.O.BOX: 5613, DUBAI, UAE SUBSCRIPTIONS INFO@GECMEDIAGROUP.COM ANUSHREE DIXIT Anushree@gecmediagroup.com MANAGING DIRECTOR TUSHARTUSHAR@GECMEDIAGROUP.COMSAHOO CEO RONAKRONAK@GECMEDIAGROUP.COMSAMANTARAY GLOBAL HEAD - CONTENT AND STRATEGIC ALLIANCES ANUSHREEANUSHREE@GECMEDIAGROUP.COMDIXIT ASSISTANT EDITOR REHISHAREHISHA@GECMEDIAGROUP.COMPE COMMUNITY COMMUNICATIONS GURLEEN JENNEFERGURLEEN@GECMEDIAGROUP.COMROOPRAILORRAINEMENDOZAJENNEFER@GECMDIAGROUP.COM SALES ANURADHA PRODUCTION,PH:ANURADHA@GECMEDIAGROUP.COMBASU+971555120490CIRCULATION,SUBSCRIPTIONSINFO@GECMEDIAGROUP.COM DIGITAL TEAM IT MANAGER VIJAY BAKSHI DIGITAL CONTENT LEAD DEEPIKA CHAUHAN SEO & DIGITAL MARKETING ANALYST HEMANT BISHT PRODUCTION, CIRCULATION, SUBSCRIPTIONS INFO@GECMEDIAGROUP.COM CREATIVE LEAD AJAY ARYA DESIGNER RAHUL ARYA ASSISTANT DESIGNER VIKAS CHANDRA DESIGNED BY # 203 , 2ND FLOOR G2 CIRCULAR BUILDING , DUBAI PRODUCTION CITY (IMPZ) PHONE : +971 4 564 8684 31 FOXTAIL MONMOUTHLAN,JUNCTION, NJ - 08852 UNITED STATES OF AMERICA PHONE NO: + 1 732 794 5918 A PUBLICATION LICENSED BY INTERNATIONAL MEDIA PRODUCTION ZONE, DUBAI, UAE @COPYRIGHT 2013 ACCENT INFOMEDIA. ALL RIGHTS WHILERESERVED.THEPUBLISHERS HAVE MADE EVERY EFFORT TO ENSURE THE ACCURACYOF ALL INFORMATION IN THIS MAGAZINE, THEY WILL NOT BE HELD RESPONSIBLE FOR ANY ERRORS THEREIN.

An exclusive article by Vimal Mani on ‘Firing up Cyber Security Mojo in achieving Resilience during future pandemic’ talks about how Business need to rearrange their priorities on technology projects to manage the change of working model and the related crisis triggered by Covid 19. We also have interesting reads from Cohesity in which Gregg Petersen, Regional Director - MEA at Cohesity talks about how Organisations should look for next-gen data management solutions that are capable of recovering critical systems and processes fast while also helping to decrease downtime significantly. We also have a quick read on GBM’s 9th Cybersecurity report where Hani Nofal, Vice President of Digital Infrastructure Solutions at GBM talks about the annual report examines the evolving role of cybersecurity and its impact on mitigating cyber crime as Middle East businesses accelerate their shift to a data-led digital economy. This and much more in this issue of the magazine. As we talk, Global CISO Forum is gearing up for the 6th edition of GCC Security Symposium. On May 17th, the Conrad SZR will witness the gathering of over 150+ lead ing CISOs, Risk and Compliance Officers, Head of Information Security etc to explore the modern cyber security challenges and security landscape. With over 30+ Speakers and Panelists, 4 critical panels, 3 interesting boardrooms and much more, the event is all set to create new benchmarks in the security industry.

PRESENTS CONRAD HOTEL DUBAI MAY 202217 SEC _ RITY IS NOT WITHOUTCOMPLETEU! OFFICIAL MEDIA PARTNERS BROUGHT TO YOU BY REGISTER NOW

03 EDITOR’S PAGE EXPERT BYLINECISO OPINION CORNER 14-15 RANSOMWARE IS EVOLVING. SO SHOULD YOUR DEFENCE STRATEGY 40-41 76% OF DATASUFFEREDORGANIZATIONSDOWNTIMEANDLOSSIN2021 42-44 3 REASONS WHY SMBS SHOULD CONSIDER BUILDING THEIR OWN FILE SERVER — NOW MORE THAN EVER 46-47 MEETING THE CYBERSECURITY JOBS CHALLENGE 48-49 EVERY DAY SHOULD BE WORLD BACKUP DAY 3206-38 DIGITIZATION AND CYBER DATAHOWCHANGESCSOSPROMINENCETHESECURITYEMERGINGFUTURERESILIENCEMOJOFIRINGANDCYBERSECURITYCHALLENGESCURBINGANDTECHNOLOGYVULNERABILITIESFUTURECHANGESTHESECURITYTRUSTSUPCYBERSECURITYINACHIEVINGDURINGTHEPANDEMICCYBERATTACKSINCREASINGOFISOSENCOUNTERINGANDCHALLENGESIOTENDSINBREACHES? CONTENTS APRIL 2022 THOUGHT LEADERSHIP APPROACH TO SECURITY NEEDS AVANT-GARDE COVER FEATURE 36-38 05APRIL 2022

DIGITIZATION AND VULNERABILITIESCYBER

I have two roles: In my role as head of the "CISO as a Service" depart ment, I gather the daily experience that is an important driver for my second role, leading the development of our SAAS internal control solu tion 360inControl.

06 APRIL 2022

CISO OPINION CORNER

"With increasing digitization, cyber vulnerabilities are naturally on the rise. That's why we need a digitization strategy that manages the risks."

What are the most important and critical aspects of your job role for your organization?

I relate this question to my role as a CISO service provider. Putting my fingers where it hurts and identifying blind spots. Finding the right reasons why Governance, Risk, Compliance (GRC), and Secu rity topics are business topics and not just something you have to do. Most people, except those who do it professionally, don't like these topics. But it is the same as with finance topics. The only difference is that in finance, people have realized that if you do it well and do it right, it will

ANDREAS VON GREBMER CISO, CISS Ltd – The Provider of 360inControl® Please describe your job role in the organization.

07APRIL 2022

CISO OPINION CORNER

over a wired or WIFI connection. Many Sub ject Matter experts often forget this.

For me, digital transformation requires optimal digital support and interaction of all business processes. So, the question must be “how can we do it better”, not “how can we digitize the existing”.Itisan organizational opportunity project that should be set up and managed as such. HR, for example, must be on board to help shape the change effects. According to you, how does digital transformation affect the security posture of any business? With increasing digitization, cyber vulnerabili ties are naturally on the rise. That's why we need a digitization strategy that manages the risks. The necessary security requirements should also be taken into account in tenders and con tracts. And last but not least, disaster recovery and business continuity scenarios need to be adapted. How is digital transformation impacting your job role and department respon sibilities in the organization? My job is to protect information as a corporate asset. If this asset is increasingly only available digitally, then protection naturally also focuses on it. Analog threats such as theft in physical form remain, however. It is not a paper file that is stolen, but the corresponding information on a USB stick, for example. Not every cyber-attack is initially launched help you to succeed. GRC is years behind. The collaboration of the individual GRC functions (data protection, risk management, cybersecurity, compliance, etc.), which also often use their own tools, also often leads to data silos. The consequences are obvious. What are the typical challenges faced by a chief security officer in large and medium enterprises? What we encounter again and again is that security is seen as overhead, as a necessary evil. It is not an integral part of the business. There is almost no pressure from Top-Down to change the situation. And I have never expe rienced successful and sustainable bottom-up change.Consequently, this setup often leads to secu rity managers retreating to purely technical security aspects. That's where their experience lies. They can explain the technical dangers plausibly. This is a retreat into their comfort zone.And thus nothing ever changes in the GRC setup of the companies while the legal and threat situation changes rapidly. What are the key skills required for an ideal chief security officer in this age of digital transformation? He/she must be a good communicator and an engaging personality with marketing skills to promote the topics. There also needs to be a good understanding of the business.

Specifically, what are the challenges and opportuni ties created by digital trans formation including IoT, cloud and mobility, for chief security officers? The chain is only as strong as its weakest link. As the environment becomes more complex, the risk of overlooking a weak link also increases. You must be aware of this and develop counterstrategies. Our solution allows the users a holistic Risk Management approach connecting IT and the Business, we call it “From the Port to the Board”.

At present, what are your expectations from cyber security solution vendors, channel partners, and consultants? Being in this industry myself, I have to say that these market players are doing exactly what is expected of them. They are working in the market.Irather have expectations from the custom ers of these services and solutions. Namely that they "own" the topic. Only pieces can be outsourced or delegated, the accountability remains with the organization.

In general, looking at the present and future technology landscape, what are the upside and downside of cyber security solutions? No matter how the landscape develops, for me, housekeeping remains the most important instrument to set the security bar high. This is something that many neglects. That is, I don't need a sophisticated security program if weak or default passwords are used. Ideally, of course, I have good housekeeping and a mature cybersecurity program.

At present, what advice or feedback or recommenda tion would you give cyber security solution vendors, channel partners and consultants? There are two approaches to getting people to implement something. Fear and persuasion. Far too often, cybersecurity experts use the tool of fear instead of taking the harder but more sustainable path of persuasion. ë How does your organiza tion or how do you define digital transformation?

CISO OPINION CORNER ANDTECHNOLOGYFUTURECHANGESHESHAMSAAD ALY Sr. Regional Cybersecurity Specialist, Microsoft 08 APRIL 2022

"It is fair to say that technology will change the world, yet, once again."

Digital transformation is a technology proposi tion. There’s no doubt that the impact of tech nology is unprecedented in terms of things like unlimited compute power and unlimited stor age that is becoming a reality today, as well as possibilities offered by disruptive technologies like IoT, artificial intelligence, deep learning, mixed reality, and so on. Therefore, it is fair to say that technology will change the world, yet, onceWeagain.alsoknow that the ability to connect and manage all assets, products, Employees, and customers globally has not really ever been pos sible or feasible, as well. Why is this important? I believe in the notion that optimizing parts will sub-optimize the whole. For the first time ever, large enterprises will be able to optimize their businesses at the global level in a way that was not possible before.With these thoughts as a back-drop, let me share some of the fundamen tal thoughts and observations regarding digital transformation.

l Implement security by design Consolidate security vendors and security solutions Increase measurement, analytics, and reporting capabilities

continue to digitize processes, security teams must contend with an increase in attack vectors and more complicated man agement, all while keeping pace with increas ingly sophisticated attackers. In the face of this massive challenge, security teams must evaluate and refresh their legacy security procedures, tools, and skillsets to accommodate a new and adaptable approach to enterprise security.

l Converged

Digital transformation is a critical shift under which businesses are using data-powered plat forms and applications to improve nearly every aspect of their business operations. New open ecosystems and the democratization of data means more users in varied locations sharing data across more applications, devices, plat forms, and environments—both internally and externally.Asbusinesses

CISO OPINION CORNER Please describe your job role in the organization. Global black belt Sr. Cybersecurity technical specialist focusing on advanced security analyt ics, DFIR, SIEM, SOAR, Threat Protection & Management, Cybersecurity Architecture, and Advanced Hunting for CISO, SecOps, SOC, InfoSec Architectures, Analysts, IR & admins. What are the most impor tant and critical aspects of your job role for your organization? Architect, Design, develop, and implement advanced DFIR, SOAR, and SIEM security sys tems, modules, and workflows l Build security system infrastructure l Cybersecurity Consulting & Design Patterns. What are the typical chal lenges faced by a chief security officer in large and medium enterprises? l Modernizing SOC Operations l Monitoring, governing and securing OT/ IoT l Reduce knowledge and fix gaps l

According to you, how does digital transformation affect the security posture of any business?

Specifically, what are the challenges and opportuni ties created by digital trans formation including IoT, cloud and mobility, for chief security officers?

In general, looking at the present and future technology landscape, what are the upside and downside of cyber security solutions?

Discover and manage shadow IT, Mod ernize SOC across IT, IoT & OT Adapt security to users

At present, what are your expectations from cyber security solution vendors, channel partners, and consultants? Complying with regulators Hybrid-Cloud governance, securing and monitoring recommendations Security measures do the vendor currently have in place Implementing context-based security awareness training for your employees Having a formal incident response plan in case of a cyberattack Conducting risk management services such as scanning for vulnerabilities or per forming penetration tests

09APRIL 2022

Sophisticated attacks, Ransomware, and advanced threats What are the key skills required for an ideal chief security officer in this age of digital transformation? Building modernized SOC and security first approach Cybersecurity awareness, hygiene, and secure score and consolidated security environment (IT, IoT, OT) Automation and layered security response strategy and plan l Insider risk and threats management How does your organiza tion or how do you define digital transformation?

How is digital transforma tion impacting your job role and department responsibilities in the organization?

As businesses continue to digitize processes, security teams must contend with an increase in attack vectors and more complicated man agement, all while keeping pace with increas ingly sophisticated attackers. In the face of this massive challenge, security teams must evaluate and refresh their legacy security procedures, tools, and skillsets to accommodate a new and adaptable approach to enterprise security.

At present, what advice or feedback or recommenda tion would you give cyber security solution vendors, channel partners and consultants? Same previous #10 points in addition to Improve and provide MDR (Managed Detection and Response) Security services/ offerings.ë

Automated threat detection and response Modernizing SOC and improving compliance Reducing the risk of business disruption Increasing Cyber Defence Constant needs to update the security l Patching may back-fire

FLAVIO CARVALHO CISO GroupIberia,Crédit Agricole

I´d say to find the right balance in properly managing Security Risks, com plying with all European Banking Regulations, while enabling the business to grow.

What are the typical challenges faced by a chief security officer in large and medium enterprises?

CISO OPINION CORNER

I´m the head of Information Security for the Iberia region at Group Crédit Agricole. Currently Banco Credibom is in Portugal and Banco Sofinco is in Spain. What are the most important and critical aspects of your job role for your organization?

First, to keep up with all regulatory aspects without becoming a pain for the business. I strongly believe that Security’s main reason is to enable business, so my teams work hard to provide innovative solutions, find secure solutions and minimize risk providing space for the business to accelerate. What are the key skills required for an ideal chief security officer in this age of digital transformation?

"I strongly believe that Security’s main reason is to enable business."

Please describe your job role in the organization.

More and more it´s becoming an interesting mix: a solid technical forma CHALLENGESSECURITY

CURBING THE

10 APRIL 2022

KSA 9 th JUNE ASIA 19 th AUGUST UAE 23 rd JUNE TRANSFORMATION ITTRANSFORMATIONBUSINESSTRANSFORMATIONNETWORKINGTRANSFORMATIONSECURITYINININAPPLICATIONSIN&COMPUTING

The downside to me is the wide number of technologies to manage. It´s amongst the mis sions of a CISO to push for simplification – in a classic “less is more” way. The more technolo gies we have to manage, the largest the attack surface will be – not to mention the cost in money and people to keep up.

At present, what are your expectations from cyber security solution vendors, channel partners, and consultants? I believe that is part of my job to know the existing technologies, alternatives, etc. Of course, there´s a limit and it´s better to explore in a deep the ones that make more sense to your company in your maturity level. As a CISO in Portugal and Spain, I´ve got the opportunity to explore lots of solutions in the region as well as in France, the HQ of our Group. But clearly, other regions may bring to the equation new and interesting solutions.

tion, fed by constant updates well mixed with inter-personal abilities to make sure Security is pervasive in the whole business. With a touch of a lawyer, I´d say that so many regulations, compliance standards, and specialized litera ture require that. How does your organiza tion or how do you define digital transformation? In my case, we are consumer financing banks in the Iberia region. So digital transformation accelerated enormously with covid pandemic: our time-to-yes KPI (how long a customer needs to wait to receive a positive answer in his/her credit request) needed to consider only remote customers, and that pushed digital transformation – how we digitally onboard new customers, verify AML (anti-money laun dry), KYC (Know your Customer), etc.

According to you, how does digital transformation affect the security posture of any business? Digital transformation adds many new risks – of course, as always happens with new tech nologies and processes. The key is to adapt security processes accordingly. So I´d say that digital transformation doesn´t change the way we´ve been managing security – it´s more a matter of also transforming security processes into more agile, cloud-based, elastic ones. How is digital transforma tion impacting your job role and department responsibili ties in the organization?

At present, what advice or feedback or recommendation would you give cyber security solution vendors, channel partners and consultants? No cold calls, for sure. Seriously, to approach and try to detect what are the interests and needs we have at that time. If it´s not the case, keep the contact close, it might be in the future. Never push too much. I can tell for sure I have so much on my plate that I won´t consider a vendor, partner, or consultant that steals my time when I´m not interested. ë

Specifically, what are the challenges and opportunities created by digital transformation including IoT, cloud and mobility, for chief security officers? The challenges, as I described are agility and new processes. As opportunities, I believe that a change so big that was accelerated by the pandemic crisis teaches us how to improve our response, our resilience, and our ability to be agile while keeping all important information security concepts.

Digital transformation is changing the skills I need in my teams, and pushing more for pro cess oriented agile methods. As a traditional bank, we had old, well-established processes that are being replaced fast, due to the digital transformation acceleration.

In general, looking at the present and future tech nology landscape, what are the upside and downside of cyber security solutions? The upside to me is integration, working more and more in cooperation with other entities, helping each other to secure our companies.

CISO OPINION CORNER 12 APRIL 2022

"Organisations that protected their data with solutions like Cohesity could utilize capabilities designed to not only help them quickly respond to attacks, but rapidly recover without paying any

RANSOMWARE IS EVOLVING. SO SHOULD YOUR DEFENCE STRATEGY GREGG PETERSEN Regional Director - MEA at Cohesity EXPERT BYLINE 14 APRIL 2022

WHAT’S NEXT? If the evolution of ransomware has taught us anything, it’s that cyber criminals will constantly keep evolving their tactics. Next-gen data management technology is therefore paramount for organisations’ pre ventive efforts. Capabilities of a next-gen data management platform, such as immutable backups and encryption, combined with a robust recovery strategy, and the implementation of multi-factor authentica tion, offer a path for organisations to combat the threat of ransomware 3.0 and beyond.

To help reduce the blast radius of such ransomware, leading next-gen data management vendors such as Cohesity go beyond zero-trust principles in their underlying threat defence architectures. This is being achieved by providing strong multi-factor authentication technologies and encryp tion of data in transit and at rest and immutability by design. This archi tecture provides a holistic approach to threat detection and rapid recovery every step of the way and can play a key role in enabling organisations to converge data security and data governance.

Ransomware attacks are generally disruptive, but data exfiltration takes the threat to whole other level. According to IBM Security, the average cost of data breaches is nearing $4.24M. In addition to the direct cost of remediating the impact, regulatory penalties, and victim outreach and penalties, this cost includes the damage a data breach would cost to a business’s brand and reputation with customers, suppliers, partners, and employees.

ë EXPERT BYLINE15APRIL 2022

In the era of ransomware 3.0, there are a number of proactive measures organisations can take mitigate the threat. For example, making sure the foundation of your security posture is solid. This means having processes in place to quickly patch known vulnerabilities, while ensuring your pro duction and backup data is encrypted, and follows least privileged access management.Socialexploitation remains a key way in which cybercriminals propagate ransomware attacks so investing in regular employee training and awareness programs will help build a ‘security-first’ mindset and strengthen what would otherwise be the weakest link in the cyber defence chain.Itshould go without saying that protection needs to cover both your production and backup systems and this is why immutable backups –which are designed so they can’t be tampered with y – are now a necessity rather than a nice to have. And, in addition to taking measures to defend against an attack, investments need to be made to reduce the impact if breached. In the case of ransomware, this includes having the ability to detect an attack as early as possible. This can be done by monitoring source-side data in production with the help of AI and ML to identify anomalies in near real-time. It is also essential to recover critical systems and processes with aggres sive recovery time and recovery point objectives and provide automated failover and failback orchestration, so organisations can reduce down time of critical systems significantly in the event of a successful cyberattack. Organisations would also be well served by testing these critical recovery processes. This needs to include the recovery of systems and environments and rehearsing with the individuals required to execute the whole process.

MITIGATING THE THREAT

Abusiness falls victim to ransomware every 11 seconds and attacks by cybercriminals continue to grow in frequency and sophistication. Ransomware has a ‘real world’ impact as evidenced by a variety of high profile attacks. To reduce the blast radius of such attacks, organisations should look for next-gen data management solutions that are capable of recovering critical systems and processes fast while also helping to decrease downtime significantly. Today’s sophisticated cyber-attacks impact our everyday lives - from attacks on hospitals to disruptions to fuel and food supplies. Cybercrimi nals are becoming more aggressive and have changed their tactics over time. To try and guarantee a monetary payout, cybercriminals are going beyond encrypting production and backup data. They are now stealing (or more technically “exfiltrating”) sensitive data from organisations and threatening to expose it on the dark web, in so-called “double extortion” schemes.

The rise of ransomware attacks can be attributed, in part, to the increased adoption of cryptocurrency, some argue that cryptocurrency enabled cybercriminals to accelerate their criminal enterprise by allowing them to launch their attacks virtually anonymously, demand untraceable payments, and in many cases easily collect the ransom. This anonymity fuelled the first generation of ransomware, “ransomware 1.0” so to speak — the WannaCry era. Ransomware 1.0 variants like WannaCry targeted and encrypted pro duction data. Backup systems quickly became the de facto solutions to address ransomware 1.0 threats. Organisations that protected their data with solutions like Cohesity could utilize capabilities designed to not only help them quickly respond to attacks, but rapidly recover without paying anyInitially,ransom.attackers were happy to focus on the lowest hanging fruit. But as restoring data from backup tools to avoid paying the ransom became more of an industry standard practice, it forced cybercriminals to change their tactics. In addition to user and production data, cybercriminals evolved to also start targeting the backup data and systems, leading to the rise of “ransomware 2.0”. Cybercriminals used ransomware 2.0 variants like DarkSide and Ryuk to aggressively attack the backup data sets stored on various legacy backup providers. Upon analysing DarkSide’s source code, security researchers found code was utilized to disable or delete the data on various backup solutions, security services, and critical Microsoft services like VSS, SQL Server, prior to unfolding an attack on production copies of data. Fortu nately, leading next-gen data management solutions such as Cohesity help organisations protect their backup data against ransomware 2.0 variants. But what about the threat of data exfiltration? According to Covewave’s research, 80% of ransomware attacks in Q2 2021 involved claims of data being stolen by cybercriminals. And, unfortunately, nearly two thirds of the impacted organisations confirmed that they paid a ransom to stop their sensitive data from being leaked. This represented the next evolution of attackers’ tactics, leading to the emergence of “ransomware 3.0” – the most disruptive variant yet.

HOW DID WE GET HERE?

Leading Alef’s Information Security Function, where Alef is an Edu-Tech cloud service provider company with AI & ML-powered for individual (students) diagnosis and empowering the teachers. It enables teachers, parents, and the UAE’s Ministry of Education to track individuals and take data-centric decisions for the long term.

Developed Cyber Security strategy and provided strategic leadership to Information Security related projects & initiatives ;

"Cybersecurity becomes a major topic between board members and company stakeholders to maintain the competitive edge and trust in customers."

Justifying the Return of investment on security services is largely debat able. Getting a $ value to assign to this is a big concern for CISOs across

CYBERSECURITYANDTRUSTS

What are the most important and critical aspects of your job role for your organization?

CISO OPINION CORNER

FINTO THOMAS Head of Information Security, Alef Education Consultancy (a SaaS Provider)

What are the typical challenges faced by a chief security officer in large and medium enterprises?

Bake-in Security into Alef’s cloud platform was the prime objective.

- Developed the framework for People, Process, and Technology to build the Cybersecurity team from scratch and build the capabilities with prioritization and better ROI

But information security does not exist in the early stages hence was forced to set up the information Security function first, therefor looked into the overall tools – process – people’s side from a security perceptive to set the current baseline and a target state in the next three years.

- Align security initiatives with enterprise programs and business objectives, ensuring that information assets and services are adequately protected;-Build relevant security policies and brought Risk management and focus on Cultural shift and awareness programs;

16 APRIL 2022

Please describe your job role in the organization.

Later stages aligning between departments that use different frameworks for their deliveries such as Agile- DevOps – ITIL raises concerns. And there are no best–proven methods to adopt at the industry level. Then incorporate Security into this mega-complex running system. This is a time-consuming process and people’s awareness improvement iterations. Stakeholder awareness improvement is key along Board and C-level sponsorship is best for timely action and avoiding departmental conflicts.

l Shift on Cyberattack and Cyberwars due to the smartification of cities and industries Cloud era and agile business delivery with the help of DevOps are still in transformational phases even after years it started the momen tums, and reflected that opportunism and –changes waves across events and discussions.

Many cities started becoming smarter and smarter - Smart city transformation on the other hand is the only viable option for humankind to overcome the massive urbaniza tion currently taking over globally. 54% of the current population lives in Functional Urban Areas … And estimated to grow rapidly to 63 % by 2035 along with the population growth expected to around 9 billion. Based on their major challenges, the cities transform into better smart services … these can be traffic, water management, energy efficiency, and so on. Ultimately to grow the maturity level in the smart cities, it is required to address these listed areas … it will be an ongoing process as we grow in technologies and address new challenges rising...

Transformation nowadays represents cloud migration, and it have its own opportunities and challenges starting with architecture and security. Cloud transformation is cost-effective if we adopt a cloud nature, simple lift and shift may not be beneficial in the long run.

DevOps -Agile has to adopt the best practices from ITSM. In general, looking at the present and future technology landscape, what are the upside and downside of cyber security solutions?

Smart cities and IT- OT convergence with industrialization 4.0 are very visible trends across global transformation, and it raises new challenges and unique opportunities.

l IT-OT convergence, AI, and Cloud service impact on industrialization 4.0 l Smart city transformations due to massive urbanization

CISO OPINION CORNER

At present, what advice or feedback or recommendation would you give cyber security solution vendors, channel partners, and consultants?

As cities become smarter and smarter, their digital footprint increases, and I prefer to call it a “Digital Twin City”. Technology standpoint for digitization need three pillars to work together - IT – OT – Telecoms providers.

Business transformations using AI, Cloud, and Big data demand better cybersecurity and safe guards from the organization. Cybersecurity becomes a major topic between board mem bers and company stakeholders to maintain the competitive edge and trust in customers. This leads to showing the impotence of cybersecu rity investments, now as a security profession als and solution providers our responsibility to show value on each investment with ROI. If we cannot show value, it may not be the right investment.Thecurrent market’s main issue is maintain ing the trust with customers, as each solution providers run on the short term – quarterly target than long term customer relationship with trust in the solution’s ROI. ë enterprises regales of the size. We may be able to map the organization’s public risk level and industrial standard comparison at a high level to connect those dots. What are the key skills required for an ideal chief security officer in this age of digital transformation? Always understand the business objectives and adopt security safeguards accordingly. Spend quality time on Risk and Compliance to understand the real risk of an organization, do not blindly follow security compliance and standards available in the industry, adopt those best practices and build your policies.

How is digital transforma tion impacting your job role and department respon sibilities in the organization?

OT – IT convergence along IoT & 5G expan sion is key along with AI and Cloud for current industrial revolutions 4.0. It’s also alarming from a cyberattack perceptive, are we prepared for new threat landscapes in this fast-growing transformational technological development era. Government need to foresee the challenges on international and national policy enforce ment requirements. OT has to adopt the lesson learned from IT and adopt those best practices. We have OT breaches in front of us like gas pipeline attacks and Ukraine power grid attacks in the last few years.

At Alef bringing together the old and mature ITSM method of service delivery (ITIL) and relatively new methods of software to market (“DevOps – Agile – Container”) is our trans formation. Traditional ITSM, Auditing mind set has to change to fully adopt the agile and DevOps, same way Developers mindset on

Smart cities and Smart Industrialization leads us to the next big question on shift of cyberwar nature in the near future?

17APRIL 2022

ITSM – ITIL is a proven and mature system where DevOps is the faster agile method required for business.

Alef Education is a cloud-born technology company, we do not have any traditional architecture or systems & services. Hence the definition of transformation is about better optimization and adoption between DevOps and ITIL frameworks together for the long run.

FIRING UP CYBER SECURITY MOJO IN ACHIEVING RESILIENCE DURING THE FUTURE PANDEMIC

18 APRIL 2022

CISO OPINION CORNER

VIMAL MANI Head of Information Security, Bank of Sharjah Due to the prevailing COVID-19 pan demic, Healthcare organizations are overwhelmed with remote consulting, and business organizations have to scale up their technology backbone to support the increasing number of staff who have started adopting the WORK FROM HOME model. This has put the businesses under tremendous pres sure to take significant measures towards plan ning technology transformation to step up to help address the COVID-19 triggered crisis around. Due to the sudden surge in the virtual working model, organizations have to manage challenges from People, Processes, and Technologies. Busi nesses need to rearrange their priorities on tech nology projects to manage the change in working model and the related crisis triggered by COVID19. But as an outcome of these suddenly planned Technology & Working Model Transformations, the cyber threat exposure of organizations has become multi-folded which has become a real challenge for organizations in achieving resilience during the current and future pandemic. The dynamics of the Cyber Threat landscape have significantly changed post-arrival of the COVID19 pandemics. Particularly Middle East Region

GISEC 2022 FLICKR EXPLORE THE UNSEEN ON 2022 FOLLOW USSCAN FOR LINK

CARRYING

PHISHING

RDP (Remote Desktop Protocol) allows one computer to connect to another or a network without direct contact which is widely used to log into Windows by connecting to remote desktop services. RDP attack is a cyber-attack that occurs via a user’s remote desktop pro tocol (or RDP). The phenomenal increase in staff working from home has provided cybercriminals with a greater opportunity to target networks accessed using legitimate login credentials. By stealing legitimate login details using various techniques such as social engineering attacks and hackers launch RDP attacks. CAMPAIGNS SPAM & MALICIOUS

RDP ATTACKS

CISO OPINION CORNER Figure 1 – Key Business Risks during COVID-19 Pandemic Figure 2 - Biggest data breaches happened during the COVID-19 pandemic 35.4%42.9%48.4%50.1%50.1%52.7%66.3% Economic Societal Tech Geopolitical Environmental Prolonged recession of the global economy Surge in bankruptcies (big firms and SMEs) and a wave of industry consolidation Cyberattacks and data fraud due to a sustained shift in working patterns Failure of industries or sectors in certain countries to properly recover Protracted disruption of global supply chains Tighter restrictions on the cross - border movement of people and goods Another global outbreak of COVID-19 or different infectious disease 35.4%42.9%48.4%50.1%50.1%52.7%66.3% Company Impact MGM Data Dump 142 million compromised accounts CAM4 11 billion records leaked Easy Jet 9 million compromised accounts and 2,200 stolen credit cards Marriott 5.2 million compromised accounts Zoom 500,000 passwords leaked Magellan Health 365,000 patients' records compromised Nintendo 160,000 compromised user accounts Twitter 130,000 public figures and profiles targeted by a spear phishing attack Antheus Tecnologia 76,000 compromised unique fingerprints, emails, and personel data is facing some real cyber security challenges after the COVID-19 triggered pandemonium around. The following diagram from the report of World Economic Forum depicts the top business risks as identified by which Cyber Threats have also earned an important place. The following diagram depicts the biggest data breaches that happened in 2020 during the COVID-19Accordingpandemic:toCybersecurity Ventures Special Report states that cybercrime costs to grow by 15 percent per year over the next five years, reaching USD $10.5 trillion annually by 2025. Let’s examine in detail the various cyber secu rity challenges that are triggered as an outcome of transformations happened after the arrival of COVID-19 pandemic and how to overcome them and achieve quick resilience from any threat event to which organizations may get exposed.Thefollowing are the Cyber-attacks that were targeted the end-users and organizations with significant impact during COVID-19 1.Pandemic:Theexploitation of vulnerabilities of sys tems, networks, and applications used in the Work From Home Model 2. RDP Attacks 3. Phishing Campaigns carrying SPAM & Malicious e-mails 4. Credential Harvesting malware attacks 5. Data-harvesting malware attacks 6. Ransomware attacks 7. DDoS attacks 8. Sponsored attack campaigns 9. Pharming attacks The exploitation of vulnerabilities of sys tems, networks, and applications used in the Work From Home Model. Any vulnerability that exists in the systems, networks, and appli cations used by staff doing work from home which was not identified earlier shall be easily exploited by hackers and will become the target for cyber-attacks.

20 APRIL 2022

Phishing campaigns are aimed through SPAM e-mails sent to users with the objective of acquiring the login credentials of users for planning and executing cyber-attacks on them.

11. Device virtualization can make life much easier for staff to work from home because virtualization can be implemented more quickly than on-premises solutions.

7. Ensure that anti-virus and anti-malware solutions are activated in all devices that are part of working from home infrastructure.

RANSOMWARE ATTACKS Ransomware attacks will encrypt the data stored in the compromised systems and will lock the it. To unlock and decrypt the data, ransom amount will have to be paid to hackers.

These are cyber-attacks planned and carried out by militaries and government authorities from global countries. These cyber-attacks will aim to exploit vulnerabilities present in the strategically important critical infrastructures as well gathering significant intelligence.

DATA-HARVESTING MALWARE ATTACKS

15. Secure email gateways to prevent attacks via SPAM e-mails.

21. Conduct Red Teaming engagements on a periodic basis to test the Incident Response capabilities of the organization.

19. Plan for Improved IT Capacity supporting Working From Home Infrastructure 20. Provide adequate security Awareness to staff and suppliers who will work from home on potential threats targeting them and the infra structure used by them for working from home.

DDoS attacks are cyber-attack attempts tar geted at online services to make them unavail able by putting the critical servers which are offering the online services.

CONCLUSION

12. Implement DDoS attacks prevention solutions. For example, deployment of Firewalls, IDS kind of solutions will help in analysing the traffic-scanning barriers between networks.

16. Implement robust Mobile Device Manage ment (MDM) solutions.

6. Periodically patch/upgrade the Routers, Modems, and other equipment supporting the working from home infrastructure.

CREDENTIAL HARVESTING MALWARE ATTACKS

18. Enhance threat-intelligence monitoring & management capabilities around infra structure used by them for working from home.

SPONSORED ATTACK CAMPAIGNS

2. Provide secured internet access to remotely working staff which will be secured with threat prevention, SSL inspection, etc.

DDOS ATTACKS

10. Secure Video Conferencing Solutions to be used (Zoom, MS Teams, WebEx)

Data-harvesting malware are used for cyberattacks that will try to utilize data collected from users for monetizing purposes. These attacks will be generally launched with the help of malware such as key loggers, spyware, adware, and Trojans.

5. Carry out periodic vulnerability analysis, and risk assessment for remote connection infrastructure used by staff & suppliers working from home and apply the neces sary hardening baselines.

4. Implement robust Endpoint Security, EDR & MDR Solutions.

8. Ensure that monitoring solutions such as IDS/IPS, Firewalls are implemented as required into the working from home infrastructure.

17. Make the staff understand the risks of Working from Home and get an under taking form signed by them if they have to work from home. The objective of staff signing this undertaking form is to acknowledge the potential of cyberattacks targeting their devices connected to the office network and the security measures that they should adopt to pre vent their devices from being the target of cyber-attacks.

PHARMING ATTACKS Pharming attacks are the classic form of social engineering attacks in which criminals will redirect internet users trying to reach a spe cific website to a different fake website. Let us discuss the various controls that will fire up the cyber security mojo of an organization. We should plan to have the following ICT & Process controls to effectively fire up our Cyber Security Mojo to have enhanced Cyber Resil iency during the future pandemics:

There are exclusively developed cyber resilience framework practiced in certain countries which gives a very focused approach towards achiev ing better cyber resiliency in an organization.

14. Implement robust DLP, e-mail and DNS Security solutions.

22. Improve the Cyber Security Posture of the organization by setting up a rainbow team which will help in defending the organiza tion in preventing the cyber-attacks that may emerge during the next pandemic.

A fool proof ICT control environment is critical which will be a critical component in achieving cyber resilience in any organization. Organiza tions should consider taking continuous efforts to evolve and improve their ICT control envi ronment, cyber resilience capabilities, policies, and procedures. This will help in ensuring that the Cyber Security Mojo of the organization is always kept at its peak so that adversaries will find it very difficult to plan and carry out any cyber-attacks on critical business operations of the organization. Also, organizations should consider implementing appropriate Opera tional & Cyber Resilience Models and Rainbow teams which will help in improving the Cyber Resilience capabilities of the organizations to much better status.

CERT RESILIENCE MANAGEMENT MODEL (CERT - RMM)

23. Implement an appropriate Resilience Model that will fire up the Cyber Mojo of the organization and help in improving the Cyber Resilience capabilities of the organization.

13. Improve the existing Backup Practice and conduct backup restoration tests and fullblown IT DR Tests on a periodic basis.

These are the cyber-attacks such as Man in the Middle (MITM) attacks, DNS poisoning, and Phishing kind of cyber-attacks which are aimed to collect a large volume of user credentials in a stealthy manner.

ë 21APRIL 2022

9. Establish & update remote access and bring-your-own-device (BYOD) policies, procedures, and guidelines in place.

CISO OPINION CORNER E-MAILS

3. Implement Multi-Factor Authentication for VPN Channels.

CERT – RMM is a capability maturity improve ment model for managing and improving oper ational resilience by converging Cyber Security, BC/ IT DR, and IT operations activities under one umbrella. It’s a comprehensive framework that guides organizations in achieving opera tional resilience using an integrated approach to plan, assess, manage, and sustain IT Disaster Recovery, Business Continuity, Crisis Manage ment, Cyber Security Operations, IT Opera tions and ICT Supply chain Management, etc..

1. Establish remote connection channels con nected by a secured VPN (Secured by SSL/ IPsec).

LEADINGCISO

"Preventing the data from external threats is the top concern of each one in an organization."

Please describe your job role in the organization. am the head of Cyber Security (CISO) who is responsible for: Conducting security awareness training Developing secure business and communication practices Identifying security objectives and metrics Choosing and purchasing security products from vendors Ensuring that the company is in regulatory compliance with the rules for relevant bodies (SAMA, NCA), and enforcing adherence to security practices. the company's data privacy is secure, managing the Com puter Security Incident Response Team, and conducting electronic discovery and digital forensic investigations.

CISO OPINION CORNER

Multiplying Threat and Growing Frequency of Cyber Attacks

MOHAMMED ALSHAMRANI FINANCE COMPANY

What are the most important and critical aspects of your job role for your organization? Governance, Risk, and Compliance Technical operations Internal and vendor communication Also, I constantly check with my team members, about how we solve any cyber security issues and if there’s any level of risk that has recently come up that needs to be addressed, and I am respon sible for reporting on cybersecurity to the relevant committees.

l Ensuring

EMERGING CYBER SECURITY ATTACKS

What are the typical challenges faced by a chief security officer in large and medium enterprises?

It is generally the top concern for each and we need to work harder than ever to make sure that company data stays secure.

22 APRIL 2022

At present, what advice or feedback or recommendation would you give cyber security solution vendors, channel partners and consultants?

What are the key skills required for an ideal chief security officer in this age of digital transformation?

How is digital transformation impacting your job role and department responsibili ties in the organization? With digital transformation, CISOs must pre empt new initiatives and make it possible to bring services and applications to make market faster, taking into account the security controls.

Still it can be difficult to get important cyberse initiatives properly funded, it’s a lot like insurance you may not see the desperate need for it unless you don't have it and something catastrophic happens Shortage

To ensure that business puts the right systems in place to comply with all regulations

l Resource

curity

In our organization, we focused on two areas (customer experience and improving internal processes by leveraging digitization and auto mation) to define the digital transformation. According to you, how does digital transformation affect the security posture of any business? I think more systems connect to the Internet, so we need more effort to manage and secure these systems.

CISO OPINION CORNER l Budget Constraints

The upside is the shift from cybersecurity to cyberDownsideresilience.inshort words: l Hackers are getting smarter l Cybercrime is expensive l Everything is automated l Vulnerabilities are everywhere

In general, looking at the present and future technol ogy landscape, what are the upside and downside of cyber security solutions?

At present, what are your expectations from cyber security solution vendors, channel partners, and consultants? At this time, I expect them to work from down to the top and introduce their products based on the environmental needs and new regula tions, and keep abreast of changes in the region.

l Focus on understanding the new regula tions & help the clients to comply with them. l With a limited lack of resources, must try to automate processes, monitor, and respond to threats. ë

24 APRIL 2022

As demand for security professionals has increased in greater proportion than the avail able, positions can be hard to fill. Human Error These errors increase the risk of the data breach and let hackers bypass the strong security systems Compliance Requirements

In my opinion, here are some skills: Change management skills Creativity, adaptability, and learnability with new aspects (Big Data and Machine Learning) High-Level background in business processes How does your organization or how do you define digital transformation?

Specifically, what are the challenges and opportunities created by digital trans formation including IoT, cloud and mobility, for chief security officers? The main challenge is the different channels of threats which means more cost, time, resources, skills, and more elevate and empower CISOs to drive these changes.

Any Cyber Security threat doesn’t differentiate between enter prises like the COVID didn’t between humans. The challenge for ISOs especially the medium ones is to convince management to

Sr Information Security Officer, Finance House

What are the typical challenges faced by a Information Security Officer in large and medium enterprises?

26 APRIL 2022

To oversee and protect the institution’s Information, the core responsibilities are to determine risk, implement control strategies, identify threats, help end-users understand their role in Informa tion Security, and assuring compliance. The main goal is always to provide a secure customer experience. Due to the constant evolu tion of cyber threats, it’s critical to be prepared for these threats.

THE PROMINENCEINCREASINGOFISOsSHOEBADHONI

CISO OPINION CORNER

ISOs are responsible to secure the data, ensure business advancement, protect the organization from external threats and create compelling narratives.

Please describe your job role?

deploy resources to mitigate these threats be it a form of people or technology. At the same time, Compliance levels across the globe have become more stringent, and regulatory and compliance authorities/bodies are increasing on day to day basis. Ensuring adherence has become a main challenge to ISOs. It is hard to put a tangible, measurable return on security investment for cybersecurity posture, and inte grated risk management, for many higher-level executives, these are not the sorts of problems that will pop up on their desks multiple times a day. ISOs need to ensure the data remained secure in an environment that wasn’t constantly monitored for secure API integrations, and dozens of other issues. What are the key skills required for an ideal Information Security Officer in this age of digital transformation?

There is a high reliance on third-party ser vices, and the ease with which business units outside of IT can implement new technolo gies that has led to an increase in shadow IT, making assessing the organization’s risk profile exponentially more difficult. While third-party products and services can greatly improve digital businesses, without a strong third-party/vendor risk management program in place, the new risks can be more concerned than the benefits are worth. While third-party collaboration offers a host of benefits such as increased speed, high efficiency, and greater agility, several risks surround this relationship.

All the time new device changes the way we conduct business, communicate and live our personal lives. The transformation promises efficiency and ease for the user, it promises better outcomes. With instant data collec tion, companies can foster a better value for their customers and improve services that meet their consumer’s needs. Each device can be a potential security risk and a com promised device could lead to a domino effect of consequences. A compromised IoT device puts consumer and corporate infor mation at risk. Due to the mass production of the IoT devices, their security features and weaknesses are widely known which makes it easier for threat actors to infiltrate and manipulate the devices. IoT devices receive fewer software updates and are unable to store anti-virus software. An IoT device, more or less, remains the same through its life cycle. Continual internal audits and vulnerability assessments are necessary to ensure that all endpoints, throughout the supply chain, are secure and up to date. Multi-factor authen tication for all devices should be mandated and devices should be used on secure internet networks.Cloud adoption introduces complexity to most IT operations. Handling and inte grating data, employees, and systems across cloud applications can easily overwhelm cybersecurity professionals who are already dealing with downsized teams and budgets. When transferring data and services over cloud providers, organizations lose some of the visibility and control of those assets. Part of the responsibility of data security manage ment is shifted to the cloud service provider and it can be difficult to see where the gaps in security controls are. ë

ISOs need to create compelling narratives that help the other executives understand the significance of secure digital transformation for both consumers and the business.

The key skill remains to have an open chan nel of communication with IT and business, understanding the business needs has become more important before designing any controls. ISO needs to synergize with businesses, make a stronger business case and get adequate budget approvals from the management. In the age of digital transformation, the management tends to focus more on the delivery of digital plat forms, ISOs need to help understand that due to evolving digital era threats have also evolved significantly. Pandemic has brought focus on Cyber Security due to WFH and management of organizations are now more aware and understand the value of time and money spent on Cyber Security.

According to you, how does digital transformation affect the security posture of any business? Change always affects the security posture and Digital Transformation just surges it. The evolution of digital currencies and the cloud has made businesses explore and invest in new technologies. This has even made the business hunt for talent who possess the relevant skills. Implementation of the right technologies with skilled staff enables the business to maintain its security posture.

CISO OPINION CORNER27APRIL 2022

How is digital transforma tion impacting your job role and responsibilities? It has thrown up many challenges right from getting accustomed to new terminologies to enhancing the understanding of new tech nologies. This change has forced the thought process of the traditional approach toward security, even though the core concepts remain theThesame.adoption of digital transformation has changed cybersecurity. This is predominantly because data breaches and cyberattack events are increasing as the threat surface grows and businesses adopt more digital technologies. This is true across various areas of the industry due to the pursuit of new business models and enhanced customer experiences. As digital transformation processes are embraced across diverse industries, you must implement secure digital practices to stay ahead of the crowd.

Specifically, what are the challenges and opportunities created by digital transformation including IoT, cloud and mobility, for Information Security Officer?

l Showing deep knowledge to illustrate how attackers could gain access to the company’s information or jeopardize corporate systems and operations. What are the most important and critical aspects of your job role for your organization?

Chief Security Officers (CSOs) are becoming more and more impor tant to keep business operations running smoothly, and to achieve their primary objectives of safeguarding and sustaining essential enterprise assets, CSOs are being tasked with a wide range of respon sibilities, including everything from cybersecurity to data privacy and information security. The most typical challenges faced by CSOs

Please describe your job role in the organization.

l Dealing with security issues on an organizational and technical levels.

28 APRIL 2022

CISO OPINION CORNER

YAZEED ALTHOBAITI Senior CapgeminiManager,

Identify the gaps in the client’s control visibility and make recommen dations including implementation of solutions that close the gaps and remove blind spots.

"Chief Security Officers (CSOs) are becoming more and more important to keep business operations running

l Provide information to the business teams and management regarding the value at risk to the business from threats to networks, infrastructure, applications, and databases. What are the typical challenges faced by a chief security officer in large and medium enterprises?

CSOs CHANGESENCOUNTERINGANDCHALLENGES

In general, looking at the present and future tech nology landscape, what are the upside and downside of cyber security solutions? When technology evolves, we must evolve. Once that is achieved, then we are on the right track. Cybersecurity solutions need continuous fine-tuning and hardening. However, threat intelligence plays an important role in this process. It will significantly aid into strengthen those security controls by mapping the tactics, techniques, and procedures (TTPs) of adver saries into the organization’s security controls.

At present, what are your expectations from cyber security solution vendors, channel partners, and consultants? Artificial intelligence and machine learning are going to be the most two hot buzzwords right now and appear to be used interchangeably rather frequently.

29APRIL 2022

At present, what advice or feedback or recommendation would you give cyber security solution vendors, channel partners and consultants? Attackers are becoming more innovative. My advice is to narrow down the circle on them by embedding both the intelligence-driven defense methodology developed by Lockheed Martin Corporation and MITRE ATT&CK Framework into current and future security solutions. ë one internal and one external. Internally, the vulnerabilities introduced via DevOps are the biggest impact on any organization’s security posture. Externally, attacks that evade detection is so-called “polymorphic threats”.

How is digital transformation impacting your job role and department responsibilities in the organization? Digital transformation requires a change in its culture. Employees must be able to adjust to new roles and responsibilities. Moreover, digi tal transformation requires the involvement of the entire organization, it will never be success ful if only a single department is involved. So basically, cultural shifting is crucial for digital transformation.

What are the key skills required for an ideal chief security officer in this age of digital transformation? Successful CSOs are those who are willing to embrace the change. Beyond just protecting the organization, the priorities of modern CSOs are to drive development through multiple projects and make this development as smooth as possible from a security point of view, not just removing obstacles, but creating business opportunities. One of the most required skills for CSOs is addressing security issues earlier in the software lifecycle. Another crucial principle is that security should always focus on possible remediation or mitigation that will allow the application to proceed forward while decreas ing contextual risk, rather than attempting to eliminate it entirely. How does your organization or how do you define digital transformation?

CISO OPINION CORNER

Digital transformation is simply taking advantage of digital technologies and making them more efficient and scalable. But we must remember that technology is accelerating trans formation and not causing the transformation.

Specifically, what are the challenges and opportuni ties created by digital trans formation including IoT, cloud and mobility, for chief security officers? The Digital transformation enables businesses to modernize legacy processes, accelerate efficient workflows, strengthen security, and increase profitability. On the other hand, the challenges created by the digital transformation for CSOs are many, but the most challenging ones are: l Lack of change management strategy l Lack of a digital transformation strategy l Complex software and technology l Adoption of new tools and processes l The continuous evolution of customer needs in my opinion are the growing frequency of cyberattacks, organizational issues, and human errors.

According to you, how does digital transformation affect the security posture of any business? Two main risks affect the security posture of any business adopting digital transformation,

30 APRIL 2022 THOUGHT LEADERSHIP

Increased use of technology does, however, create

From zero-trust model to recovery strategies, the future of cybersecurity will be anchored on open conversations on ‘digital trust’, suggests report G

BUSINESSSAFEGUARDINGTRUSTFOSTERINGWILLBEKEYTO-GBMSECURITYREPORT2022

HANI NOFAL Vice President of Digital Infrastructure Solutions at GBM

ulf Business Machines (GBM) recently revealed top insights from the 9th edi tion of its cybersecurity report where it explored the growing significance of ‘digital trust’ for businesses, governments, and consumers in a digital-first world. The annual report examines the evolving role of cybersecurity and its impact on mitigating cybercrime as Middle East businesses accelerate their shift to a data-led digital economy. The pandemic has accelerated the shift to a “digital-first” world with the disruption over the past year adding new consumer habits and creat ing new segments of “digital-first” consumers.

“We strongly believe remaining relevant in a digital-first world is as much about evolving mindsets and practises as it is about incorporating the latest technologies. A strong risk management process will help orga nizations identify areas that can be managed externally, thereby allowing employees to focus on driving results that really matter,” added Nofal.

The report also draws attention to organizations’ need to better under stand the motives and tactics of hackers and suggests reprioritization of risks to thrive in a digital-first world. Finding the right talent to address these risks, however, has become critical. Nearly two-thirds (64%) of the Gulf respondents from last year’s GBM Security Report faced challenges in tackling skill gaps.

a rich playground for cybercrime. Today, with sophisticated and powerful cyberattacks compromising businesses at an unprecedented rate, there is a growing urgency for trust to take centre stage in the digital architecture of the future economy. Consequentially, redesigning security for the digital-first world and protecting it from external and internal threats has become a key priority for organizations. From zero-trust model to meticulously devised cyber recovery strategies, the latest GBM security report reveals ‘digital trust’ has become a basic necessity in today’s hyperconnected era. According to a recent World Economic Forum article, the “never trust, always verify” zero-trust approach could potentially be a turning point for mitigating data breaches.

ë 32 APRIL 2022

These insights mirror findings from last year’s GBM Security Report which reported that securing data had become essential to building trust with customers, with 84% of those surveyed wanting to invest in data security this year. The study further advocates transparent and open com munication across all levels of society and businesses to combat malicious attacks. This involves close collaboration between governments, individ uals and business entities where all parties are engaged and instrumental in safeguarding cyber security.

THOUGHT LEADERSHIP

“Trust underpins all economic activities and is central to our digital future”, says Hani Nofal, Vice President of Digital Infrastructure Solutions at GBM. “As the region, bolstered by its ambitious growth plans, moves into a digital-first era, organizations will need to leverage effective tech nology that not only delivers compelling benefits but is also conducive to fostering a secure global digital marketplace.”

"The arrival of the Internet of Things (IoT) is another reason for sleepless nights."

Cyber Security Officer , Group of Companies

Please describe your job role in the organization.

CISO OPINION CORNER

What are the most important and critical aspects of your job role for your Working with business process owners to identify risks to systems and proper implementation of security controls to remediate any

Maintaining and developing the governance, risk, and performance frameworks, across IT and within the group of the company. Responsible for providing assurance that all key risks are identified, mitigated, and monitored with oversight to ensure the effectiveness of control frameworks and remediation plans. Responsible for the development, implementation, and mainte nance of information security within the organization, including annual information security risk assessments, policy governance, compliance with regulatory requirements, information security train ing, and awareness initiatives. Monitor the security of critical systems and changes to highly sensitive computer security controls to ensure appropriate system administrative actions, investigate and report on noted irregularities.

HOW IoT ENDS IN DATA BREACHES?MANOHARANMUDALIAR

Truebell

34 APRIL 2022

35APRIL 2022

Many software development teams work with systems of agile and continuous improvement, and with that comes a faster and more interde pendent software development lifecycle. The downside is that in the push towards speed and flexibility, the software can be less secure. Plan and coordinate the testing of recovery support and business resumption procedures while ensuring the recovery and restoration of key IT resources and data and the resump tion of critical systems within the desired timeframe. What are the key skills required for an ideal chief security officer in this age of digital transformation?

Traditional company simply sells products according to what customers order. After The transformation, company uses a steady flow of real-time data and insights on which prod ucts are being consumed, and where and how quickly inventory is depleting. This informs the supply chain team to maximize efficiency in the here and now, but also helps the company predict what customers want for

CISO OPINION CORNER

In the rush to release, security can become an afterthought. Specifically, what are the challenges and opportuni ties created by digital transfor mation including IoT, cloud and mobility, for chief security officers? Securing company networks from threats wasn’t already difficult enough, the arrival of the Inter net of Things (IoT) is another reason for sleep lessTalknights.ofthe IoT usually extends beyond objects traditionally used to access the internet like computers and smartphones, now encompass ing objects ranging from scanners to security systems and even to toasters. The widespread adoption of such IoT devices certainly makes our lives more convenient, but those working in cybersecurity are the most susceptible to draw backs to this trend. The downside to these expanded capabili ties is that every additional IoT-enabled device brings potential security risks. Sensitive com pany information is gradually being shifted over to cloud storage, meaning that such networks are ripe for attacks from malicious actors. Each additional access point to this information cloud represents another possible route for hackers to gain unwanted access and wreak havoc on the data integrity of the organization. ë months or even years into the future.

Temperature monitoring in shipping ensures perishable items maintain safe temperatures en route across the "cold chain" from warehousing andTransparentdistribution.monitoring not only supports supply chain management on an organizational level but can also improve its function across an entire industry. According to you, how does digital transformation affect the security posture of any business? Every Organization/Companies are in the race and working hard and fast to beat their com petitors and get a handle on new technologies.

The CISO’s role goes beyond expertise in information security. It relates technology and security needs to the overall vision and busi ness goals of an organization. A CISO is one of the most visible IT positions in an organiza tion. CISOs must work closely with operations teams, designers, and developers to achieve security objectives. How does your organization or how do you define digital transformation?

Using IoT technology, retail stores could instantly submit orders to distribution cen ters as soon as their inventory hit a minimum threshold.Products often rely on multiple modes of transportation to reach their destination. IoT provides real-time data that allows logistics sys tems to update routes for maximum resource efficiency and faster delivery.

CISO OPINION CORNER APPROACH TO SECURITY NEEDS AVANT-GARDE 36 APRIL 2022

I’m leading the IT Governance and Security Department and responsible to develop and implement a comprehensive information secu rity strategy for our bank, Real-time analysis of immediate threats, and triage when something goes wrong, keeping abreast of developing security threats, and helping the management and board to understand potential security problems that might arise from acquisitions or other big business moves. I also make sure that internal staff doesn't misuse or steal data, plan ning, buying, and rolling out security hardware and software, and making sure IT and network

"Between 2019 and 2020, the number of global Ransomware attacks increased by almost 25 percent."

AMNAAL-BALUSHIISHAQ Chief Information Security Officer, Leading Islamic Bank in Oman

37APRIL 2022

CISO OPINION CORNER

What are the most important and critical aspects of your job role for your organization? Keeping the bank safe from cyber threats and protecting the bank’s digital assets. What are the typical challenges faced by a chief security officer in large and medium enterprises? Make sure the bank’s data remain secure, as demand for information security professionals infrastructure are designed with best security practices in mind, ensuring that only autho rized people have access to restricted data and systems.Moreover, I am keeping ahead of security needs by implementing programs or projects that mitigate risks regular system patches, for instance, determining what went wrong in a breach, dealing with those responsible if they're internal, and planning to avoid repeats of the same crisis, making sure all of the above initiatives run smoothly and get the funding they need and that corporate leadership under stands their importance.

Please describe your job role in the organization.

Despite the challenges, there is a promise to reduce human dependence and strengthen the capacity for cybersecurity. A myriad of evolving cognitive technologies can help us improve cybersecurity and navigate the increasingly malicious and disruptive land scape of cyber threats. They cover: l Artificial Intelligence l Machine Learning l Supercomputing l Adaptive Networks

At present, what advice or feedback or recommen dation would you give cyber security solution vendors, channel partners and consultants? l Provide an easy and scalable solutions. l Predictable costing (predictable revenue) they have to explain their costing strat egy and involve every possible scenario.

In general, looking at the present and future tech nology landscape, what are the upside and downside of cyber security solutions? The future of cybersecurity is difficult to fore see, as the market is continuously changing in response to cybercriminals’ shifting activities and the new attacks they are creating. For instance, between 2019 and 2020, the number of global Ransomware attacks increased by almost 25 percent, causing cybersecurity developers and businesses to build new appli cations to combat the phenomenon.

Challenges: Competency related to digital transformation Organizational cultures where trials and learning approaches start becoming the leading way of thinking about processes Supports and expertise Right technology Opportunities: Enhanced data collection Stronger resource management Data-driven customer insights A better customer experience Encourages digital culture (with improved collaboration) Increased profits Increased agility Improved productivity has increased in greater proportion than the available supply pool of talent, positions can be hard to fill and retain talented employees. What are the key skills required for an ideal chief security officer in this age of digital transformation?

How is digital transformation impacting your job role and department responsibilities in the organization? It’s not impacted the role nor the department but it enables digital business by driving critical initiatives that secure and protect the bank. Specifically, what are the challenges and opportunities created by digital transformation including IoT, cloud and mobility, for chief security officers?

Business pursues digital transformation and adopts new technologies and business pro cesses; security issues are on the rise. In fact, 85 percent of CISOs said security issues during digital transformation had an extremely large business impact. Likewise, the rapid adop tion of new technologies, especially IoT and

In my opinion, here are some skills: l Creativity, adaptability, and learnability l Capable of navigating uncertainty l Excellent communication l Capable of cultivating a culture of collaboration How does your organization or how do you define digital transformation?

From my perspective Digital Transformation is an integration of digital technology into all areas of a business resulting in fundamental changes to how the business operates and how it delivers value to customers, partners and employees.Moreover, it covers three key areas of the enterprises: customer experience, operational processes, and business models.

CISO OPINION CORNER multi-cloud environments, has dramatically increased the attack surface and the number of entryways into a network. This is especially true if organizations do not have integration across their security solutions and incomplete visibil ity into user, system, and network behavior.

l To be trustworthiness. l Provide a product that can be easily inte grated into an existing environment. l Provide niche solutions that will improve security, answer the ad-hoc needs per fectly, and have low adoption barriers due to low complexity. ë

According to you, how does digital transformation affect the security posture of any business?

At present, what are your expectations from cyber security solution vendors, channel partners, and consultants? Before we engage with a cybersecurity vendor, we need to ensure the following Are they reputable? Are they qualified? Are they accessible? Do they understand our business? Are they offering a deal? What is their plan if something goes wrong?

38 APRIL 2022

cronis recently released its annual Cyber Protection Week Global Report 2022. The report which surveyed over 6,200 IT users and IT managers from small businesses to enterprises across 22 countries, including the United Arab Emirates (UAE), exposes some of the most critical shortcomings appearing in cyber pro tection practices today, examines why they’re appearing, and offers guidance on how they can beOnefixed.of our key findings last year was that 80% of organizations ran as many as 10 solu tions simultaneously for data protection and cybersecurity — yet more than half of them suf fered downtime because of data loss. According to the report findings, the UAE performed dis mally with 18% of the organizations claiming to use between 11-15 different solutions while a further 8% of companies use over 15 solutions simultaneously. Clearly, more solutions do not translate into more protection. This year, we see that trend getting worse: while 78% of organizations globally run as many as 10 different solutions, 76% of organi zations experienced downtime due to data loss — a 25% increase from 2021. This downtime stemmed from a number of sources, including system crashes (52%), human error (42%), cyberat tacks (36%), and insider attacks (20%). As a result, 61% of global organizations’ IT teams now report a preference for integrated solutions that replace their complicated stacks of cybersecurity and data protection tools with a single, unified console. “As the entire world is increasingly at risk from different types of attacks, accelerating to universal all-in-one solutions is the only way to achieve truly complete cyber protection. And that’s precisely the problem Acronis has set out to solve,” says Candid Wuest, Acronis V.P. of Cyber Protection Research. “Attackers don’t discriminate when it comes to means or targets, so strong and reliable security is no longer an option, it’s a necessity.”

Acronis Cyber Protection Week Global Report 2022 reveals growing threats and the need for integrated cyber protection solutions

OVERCONFIDENCE AS A TREND: IT TEAMS ARE OVERSELLING THEIR READINESS The report also unearthed another worrying trend that is responsible for cyberdefenses lowering and increasing IT security budgets: l 71% and 70% of Saudi Arabia and the UAE companies respectively are looking to replace their complicated stacks of cybersecurity and data protec tion tools with a single, unified console.

EXPERT BYLINE 40 APRIL 2022

76% OF DATASUFFEREDORGANIZATIONSDOWNTIMEANDLOSSIN2021

l 20% claimed to be testing backup restora tion weekly. Again, not consistent with any other industry-issued data.

USERS SHOW CONCERN OVER CYBERTHREATS, BUT BACKUP HABITS REMAIN UNCHANGED

PANDEMIC-DRIVEN SPIKE IN AWARENESS PROVES TEMPORARY Frequent backups that were fuelled by the shift to remote work are over: a third of IT managers only back up weekly, while another 25% back up monthly. The use of backup best practices is declining across the board — only 15% of orga nizations’ IT teams adhere to them. In the UAE, only 33% of companies are still using local stor age for Samebackup.aslast year, 10% of IT managers still aren’t sure if their company is subject to any data privacy regulations — proving that IT managers, like IT users, get stuck in their ways. In the UAE, only 15% of internal IT teams are unsure if their companies are subject to data privacyAccordingregulations.toour research, 86% of organi zations globally are also concerned about the threat of increasing politically-driven cyberat tacks caused by the worsening geopolitical climate — but their concern does not translate into improvements to their cyber protection. The bottom line, the outdated approaches that professional IT teams have relied on for years are now actively failing them. A compre hensive, easy-to-follow approach is essential to achieving a more reliable, holistic protection for data, applications, and systems – one that combines cybersecurity, data protection, and management into one solution.

Only one in ten users back up daily, while 34% of users back up on a monthly basis — a stag gering 41% of users back up rarely or never. Still, 72% of users had to recover from backup at least once in the past year (33% — more than once). Meaning that some of the users who chose not to back up have permanently lost their data: l 43% of users update a week or more after an update release — of those, 7% take more than a month to perform these recom mended updates. A decline in response time compared to 2021.

l While only 12% of users are following the recommended hybrid model of cloud and local backup storage, users have doubled down on cloud backup: for 4 years, we saw local backups shrinking from 62% in 2019 to 33% in 2022 — at the same time cloud backups jumped from 28% to 54%.

l 79% of IT users in the UAE reported per manently losing data from a computer or mobile device in the last year. Data was lost due to accidental deletions, app or system crashes, malware attacks, and other common causes What we see here is a massive gap in how organizations and individuals approach cyber protection in theory — and in practice. Acronis provides a number of solutions that are able to bridge that gap — among them Acronis Cyber Protect, used by over 20,000 service providers to protect more than 750,000 businesses.

l 70% of organizations’ IT managers claim to have automated patch management. However, based on any reliable industry research, only a handful of companies follow the 72-hour “golden time” for patch management.

l 82% also claim to have ransomware protection and remediation. Yet, success ful attacks occur weekly and the size of ransom demands grows each year.

It seems that IT managers are trying to appear better prepared than they are; but that is, in turn, misleading their managers, boards of directors, industry analysts, and customers.

The report findings prove that organizations are spending more on IT security this year, but when compared to their overall IT budget, it becomes clear – organizations are still treating cyber protection as a “nice-to-have”, not as a “must-have”: l Half of the organizations globally allocate less than 10% of their overall IT budget to IT security. l Only 23% of organizations globally are investing over 15% of their overall IT budget in security — even despite the increasingly threatening cyber landscape.

l 66% of users would not know or be able to tell if their data had been modified.

l 43% of users are not sure if their antimalware solutions could protect against new and emerging cyber threats.

ë EXPERT BYLINE41APRIL 2022

However, if the overwhelming majority of IT managers indeed have these solutions, they aren’t using them right: they have simply stocked their IT stacks with all of the recom mended cybersecurity technologies — spend ing more money in vain.

EXPERT BYLINE 42 APRIL 2022

THAN—OWNBUILDINGCONSIDERSHOULDTHEIRFILESERVERNOWMOREEVER

Synology explains why consolidating data in one place makes it easier for SMBs to comply with evolving data protection regulations, as all data is stored on a single platform within company premises.

REASONS WHY SMBS

EXPERT BYLINE43APRIL 2022

The pandemic has forced organizations of all sizes to adopt hybrid or fully remote work arrangements. With these in place, storing, protecting, and sharing data can become a challenge, especially for SMBs that often have to deal with insufficient IT workforce and infrastructure financing. Dealing with scattered data and with increased vulnerability to cyberattacks are two common struggles many businesses faceTotoday.navigate these uncertain times, SMBs need a comprehensive data management solution. One that lets them provide multi-user access for employees to collaborate, encrypted file sharing and syncing to allow smooth productivity without impacting security, reliable data protection tools to prevent data loss, and flexible expansion options to accommodate future growth.

Retrieving, editing, and sharing files, and synchronizing them across all types of devices is essential to sustain a productive workflow. While cloud services are renowned for their anytime, anywhere approach, NAS takes remote collaboration to a whole new level with a host of purpose-built applications at no additional cost. From full-fledged cloud office suites to multiplatform communication tools, these devices offer an all-in-one solu tion that is always within reach.

EXPERT BYLINE

Subscription fees for cloud services are usually based on the size of data stored. As your business grows, your monthly data storage costs may increase exponentially. In the long run, recurring fees can become a burden, while the features included in more basic plans tend to be reduced over time. Meanwhile, with a one-time investment in NAS, teams can equip themselves with a host of useful applications from day one and simply expand their storage incrementally when more capacity is Consolidatingneeded.datain one place also makes it easier for SMBs to comply with evolving data protection regulations, as all data is stored on a single platform within company premises.

Data management has never been more crucial in maintaining office productivity. Since all data management solutions share the same goal of helping businesses store, share, and protect their digital assets, it comes as no surprise that cloud services and NAS provide similar functionalities. However, while the cloud can be a good first solution for startups at the beginning of their journey, NAS remains a longterm and cost-effective solution for SMBs throughout all stages of their growth. ë

FILE ACCESS AND SHARING

out of the box. IT admins can implement efficient backup strategies by scheduling backups or configuring triggers, enabling deduplication to optimize space consumption and encryption to prevent data breaches, and analyzing insightful statistical reports — all from a single, intuitive interface. Even when using cloud services, businesses can make sure they always have access to local copies of their important files by syn chronizing all their data to their NAS.

EXPANSION AND OWNERSHIP

44 APRIL 2022

FINAL THOUGHTS

Both cloud services and NAS have the potential to deliver future-proof data management — but how do they compare against each other, and which one is the ideal choice for SMBs looking to keep their data safe and sound without breaking the bank?

Certain NAS solutions come with comprehensive data protection services Image II. Synology All-in-one solution for SMEs

BACKUP AND RECOVERY

THAILAND GRAND FINALE HongGhanaGermanyFranceEstoniaEgyptChinaCanadaBOTSWANABahrainAlgeriaKong NigeriaMoroccoMalaysiaMauritiusKuwaitKSAJapanIvoryItalyIndonesiaIndiaCoast SrilankaSpainSouthSouthSloveniaSingaporeRussiaQatarPhillipinesPakistanOmanKoreaAfrica VietnamUSAUKUgandaUAETurkeyTunisiaThailandTanzaniaSwitzerland 2022 ROADSHOW JULY-NOVEMBER 2022 TOBROUGHTYOUBY

ALLEN MCNAUGHTON Systems Engineering Director for Infoblox Public Sector

t’s no secret that the cybersecurity industry is in something of a talent crisis. The need for cybersecurity experts greatly outpaces theThesesupply.professionals underpin the security and integrity of net works and data, manage a company’s security stack, and have the skills to identify, react to and remediate security risks.

EXPERT BYLINE 46 APRIL 2022

The novelty of this situation has forced organizations to rethink how they attract talent, train employees, and educate those inside and outside the organization to better understand the different threats they face. Organizations are raising pay, recruiting from underserved com munities, and making cybersecurity careers more accessible to students without a traditional degree. These solutions are helping but not filling the entire gap. This chal lenge did not arise overnight and will require long-term strategic think

Over the past year, this talent pool has faced unprecedented demands as the pandemic forced understaffed cybersecurity teams to extend security to cover the blending of corporate and home technolo gies as millions of employees worked remotely—all while adjusting to the challenges of remote work themselves.

The cybersecurity industry needs to act now and follow the lead of the fast food industry and small businesses that have addressed skill shortages by leveraging technology to help manage work, increase productivity, and reduce burnout.

MEETING THE CYBERSECURITY JOBS CHALLENGE

To compound these difficulties, malicious actors have pounced, preying on these new work arrangements, hastily set-up network architectures, and fears of the pandemic to launch a growing number of Allcyber-attacks.ofthishas culminated in a cybersecurity workforce that is stretched out, overburdened, and burnt out.

ing to Andovercome.unfortunately, time is a luxury. Mali cious actors are not good sports, waiting for the cybersecurity community to transform itself before launching an attack. The cybersecurity industry needs to act now and follow the lead of the fast food industry and small businesses that have addressed skill shortages by leveraging technology to help manage work, increase productivity, and reduce burnout.

HERE’S HOW:

First, look for technology solutions that pri oritize automation. Technology that automates lower-order tasks is relatively easy to deploy, frees up workers’ valuable time and also removes the potential for any human error combing through different risks.

Second, recognize the power of context. In cybersecurity, context can help workers better understand the threats they face and enable them to make better, more accurate, and faster decisions.Notall threats are the same, so it’s important that context follows automation so that security teams do not waste hours chasing down the most basic of threats that can easily be remedi ated via Third,technology.lookfor technology solutions that leverage the expertise you already have. While context is key for understanding a single threat, it’s also valuable for cybersecurity teams who need to make decisions about which threats to prioritize. Workflow prioritization can help identify and remediate the most dangerous, time-consuming threats instead of randomly remediating threats based on when they’re discovered.Manysolutions already exist that can pro vide this kind of automation, orchestration and context. For example, if you are monitor ing the DNS traffic of your network and your DNS Firewall blocks a request to a malicious site, solutions that can automatically trigger a response to the Network Access Control system to quarantine that user into a sandbox until it can be further researched by an analyst can dramatically reduce the time and effort needed to track down and isolate infected devices. At the same time, systems that automatically send additional context about that user and the request (Who is the user? What kind of machine are they using? Where was the request sent?) to the analyst can give them a head start into researching and ultimately mitigating the threat.Vulnerability scanners are also a point of note. Oftentimes, they only scan networks at a given interval (once a day, week, or even month. Yes, monthly scans are a thing). Organizations can quickly, easily, and automatically improve their security posture by scanning a device as soon as it connects to the network by leveraging an orchestration flow where the DHCP server automatically identifies the new machine and triggers the scan. These and other technology solutions that leverage automation, context, and the skills your team already has are not merely a bridge between now and a fully-staffed cybersecurity industry of the future. They are a critical part of a robust cybersecurity platform today, one that both improves network security and extends the capabilities of the team you already have.

ë EXPERT BYLINE47APRIL 2022

EXPERT BYLINE

CLAUDE SCHUCK Regional Director, Middle East at Veeam Software

XO research from Veeam has found that 86% of EMEA organizations have a protection gap between how much data they can afford to lose and how often IT systems are protected. This has risen by 14% in the past 12 months and indicates that while the criticality of data con tinues to soar, so do the challenges in protect ing data to a satisfactory level. World Backup Day 2022, that was observed on March 31, is another reminder that as both the cyber threat landscape and IT environment complexity continue to increase, the need for robust data protection measures is more vital than ever. A solid backup, replication, and recovery plan is a key component of any Modern Data Protec

EVERY DAY SHOULD BE WORLD BACKUP DAY Nearly 9 of 10 EMEA Organizations Face Growing Data Availability and Protection Chasm

48 APRIL 2022

There is still a perception that ransomware strikes an unlucky few, but this is not the case. The majority (71%) of EMEA organizations have suffered ransomware attacks in the past 12 months. Given the inevitable nature of cyberattacks like ransomware, it’s paramount that businesses can recover. However, according to Veeam´s survey respondents, over one in three (36%) organizations are unable to recover data after a ransomware attack. Therefore, we now have the situation that it is no longer a question of whether businesses are experiencing ran somware incidents, but rather when. There are still far too many organizations that are unable to recover the data they lose.

WHY BACKUP MATTERS

Almost every organization experiences unex pected outages, according to the Veeam Data Protection Trends Report 2022. There are many incidents that can lead to downtime. Among EMEA businesses, these are com monly caused by infrastructure or networking outages, server hardware failures, and applica tion software faults. Furthermore, ransomware and other cyber threats are compounding the situation – with 51% of EMEA organizations suffering outages at the hands of a cyber-attack in the past 12 months.

Simply put, any data that is not backed up can be lost forever in the event of an outage. While the threat landscape is daunting, the general rule of thumb for a robust Modern Data Pro tection strategy are consistent. No matter how data is compromised, whether hardware and power failure, accidental deletion, or cyberattack, if it has been protected in line with Veeam’s 3-2-1-1-0 backup rule, you can get it back. There should always be at least three copies of important data, on at least two dif ferent types of media, at least one off-site and one as immutable copy offline, and finally, with zero unverified backups or backups completing with errors.

tion strategy that ensures business continuity and the capacity to take immediate action.

BACKUP BEST PRACTICE:

RANSOMWARE IS A NEW NORM

CYBERSECURITY BEST PRACTICE: There are three elements that create the ultimate strategy to protect data against ran somware. The first line of defence is using edu cation to build a human firewall. Prepare your employees with the digital hygiene tools and knowledge needed so that they do not fall for some of the oldest tricks in the cybercrime book like phishing. Make sure this is an integral part of your business practices. The second is imple mentation. Implement the 3-2-1-1-0 backup rule; invest in solid Disaster Recovery provi sions in accordance with your defined RPOs and RTOs; ensure you’ve protected data across all platforms including physical, virtual, cloud, SaaS, and Kubernetes. Finally, it’s remediation. If your education and implementation strategies fail, do not pay the ransom. The only option is to restore data.

The ability to move workloads from one plat form to another – including physical, virtual, and cloud-hosted – enables organizations to progress with Digital Transformation initiatives and retire legacy backup tools. But not at the expense of IT resilience. Veeam enables both cloud-powered data protection, as well as protection of cloudhosted workloads such as SaaS and containers, with full backup and recovery, disaster recovery, application mobility, and ransomware protec tion. It is essential for decision-makers to under stand that data is the lifeblood of their business and investment in Modern Data Protection is an investment in their future. ë

EXPERT BYLINE49APRIL 2022

FUTURE-PROOF YOUR DATA INVESTMENTPROTECTION

Month ENGAGEMENT COMMERCIAL ACTIVITY CONTENT MAY GCCSS JUNE CISO REBOOT CISO TRAINING- Develop and accelerate your cybersecurity skills with interactive and hands-on training to drive business growth and efficiency to your business. TOP 5 CISO_LEADERS TALK CISO FORUM COLUMN_ 5 MEMBERS JULY GCC | APAC BFSI SUMMIT_VIRTUALCISO TOP 5 CISO_LEADERS TALK CISO FORUM COLUMN_ 5 MEMBERS AUGUST CISO REBOOT CISO Training_ for Organizations TOP 5 CISO_LEADERS TALK CISO FORUM COLUMN_ 5 MEMBERS SEPTEMBER GCC | APAC GOVERNMENT AND OIL GAS CISO SUMMIT TOP 5 CISO_LEAD ERS TALK CISO FORUM COLUMN_ 5 MEMBERS OCTOBER CISO REBOOT TOP 5 CISO_LEAD ERS TALK CISO FORUM COLUMN_ 5 MEMBERS NOVEMBER GCC | APAC HEALTH CARE AND MANUFAC TURING CISO SUMMIT TOP 5 CISO_LEADERS TALK CISO FORUM COLUMN_ 5 MEMBERS TRAINING COURSES IN SCOPE 2022 ROADMAP FUNDEMENTALS OF CYBERSECURITY MANAGEMENT RESPONSEINCIDENT DEFENSECYBER Implementing Information Security Policies and Controls Implementing Information Security Management System Security Incident Response and Handing Digital and ForensicsNetwork Security Operations using SIEM, EDR, and SOAR Intrusion Detection and Signature Development Network Ethical Hacking and Penetration Testing Web App Ethical Hacking and Penetration Testing OFFENSECYBER MANAGEMENTADVANCED INCIDENTADVANCEDRESPONSE MANAGEMENTADVANCED MANAGEMENTADVANCED CISA Training AdvancedForensicsWindows SoftwareSecureDevelopment Reverse Engineering and Exploite Development CISM Training Advanced UNIX / Linux Forensics Mobile, Virtualization, and Cloud Security Network Programming for Security ResearchersCISM Training GLOBAL CISO FORUM - 2022 OUTLOOK 50 APRIL 2022

OUR HOWPLATFORMSTOENGAGE? Contribute to online columns and by-lines Take part in the expert speakingdiscussionspanelandsessions Involve in Hostleadershipthoughtarticlesbasedonmonthlythemesandtopicsworkshopsandseminarsasindustryexperts Benefit from the fantastic leverage of cover features and stories of the month Initiatenetworkingpeer-to-peerInitiatetownhallscommunity Indulge with communitythe GLOBAL CISO FORUM - 2022 OUTLOOK51APRIL 2022

COUNTRIES40 C-LEVEL4000EXECS SESSIONS300+ EXHIBITORS200+ TOBROUGHTYOUBY WHERE TECHNOLOGY IS BORDERLESS, AMBITIONS ARE FEARLESS, AND LEADERSHIP IS LIMITLESS #L 2022 ROADSHOW JULY-NOVEMBER 2022