Bill Headshot

How IT Operations Can Survive and Thrive in a Multi-cloud World

By Bill Talbot | September 17, 2019

IT Operations Can Thrive in a Multi-cloud World IT operations teams are contending with the reality that growing volumes of

Samsung

Developing AI ScaleNet: Enabling Seamless, High-resolution 8K Streaming

By Cloud Syndicate | December 5, 2019

It’s official: We’ve entered the era of 8K TVs. Around the world, sales of 8K displays are steadily increasing, and

Vibhav
Vibhav Agarwal

Principles of an Effective Cybersecurity Strategy

Effective Cybersecurity Strategy

A number of trends contribute to today’s reality in which businesses can no longer treat cybersecurity as an afterthought. These include a rapid increase in the number of internet connected devices, an increased dependency on third party applications, self-provisioning as a result of bring-your-own-device and public cloud. Add to these, unprecedented levels of smart phone and mobile device adoption and we can see that the cybersecurity ‘attack surface’ has increased massively.

According to MetricStream’s, ‘The State of Cyber Security in the Financial Services Industry’ report, around 66 percent of financial services institutions have faced at least one cyber-attack in the last 12 months. The cost of this, which can be catastrophic, can include regulatory penalties, eroded share prices, a loss of customer confidence and reputational damage. It can even result in a complete shutdown of the business.”

It is clear therefore, that organizations need to constantly evolve their security strategies and tactics to safeguard data, systems and operations against ever-evolving security risks.

In today’s cloud era, an effective strategy should leverage industry-standard cybersecurity frameworks and unified threat management systems. A sole reliance on traditional approaches and tools, such as firewalls and security solutions, may now leave networks exposed.

Companies attracted by the cost, flexibility and adaptability of cloud still have concerns over how secure it is. According to Crowd Research Partners’ 2016 Cloud Security Spotlight Report, security concerns top the list of barriers to cloud adoption and one in three organizations say external sharing of sensitive information is the biggest security threat.

Cybersecurity Strategies and Risks

Understanding the Cyber Landscape

The constant threat of cyber-attacks hangs over all businesses. So prevalent are security breaches that over half (54 percent) of cybersecurity professionals anticipate a successful cyber-attack on their organization in the next twelve months, while Ponemon tells us there is a 26 percent likelihood that a material data breach involving 10,000 lost or stolen records will occur in the next 24 months.

The explosive growth in digital transactions, together with the increased volume of personal and sensitive information now stored digitally has raised the potential for targeted attacks.  The emergence of cybersecurity threats can be broadly attributed to:

It is a challenge to keep pace with technological change and to adapt to new ways of protecting data from internal and external threats. Not surprisingly therefore, cybersecurity is one of the top priorities for regulators during supervisory reviews.

Add to this the complexity of maintaining compliance with evolving regulations, such as the EU’s General Data Protection Regulation (GDPR), Federal Information Security Management Act (FISMA), Gramm-Leach-Bliley Act and the Homeland Security Act and a significant effort has to be put into assessing current policies and practices to ensure compliance.

Principles of an Effective Cybersecurity Strategy

An effective cybersecurity strategy should be sufficiently flexible to cope with the evolving threat landscape and should:

  • Include the implementation of security policies
  • Incorporate security assessment models such as the Open Web Application Security Project (OWASP), the Software Assurance Maturity Model (SAMM) and other industry standard frameworks
  • Monitor for early warnings, continually gathering threat intelligence accordingly
  • Include a rapid response plan including crisis communications, so that the business is prepared to minimize material impact should a cyber-attack occur.

A cybersecurity framework is a good starting point for enterprises to define, adopt and refine the critical infrastructure. It helps organizations to assess current capabilities and draft a prioritized roadmap towards improved cybersecurity practices.

Frameworks provide a toolkit to assess security measures against industry standard best practices and compliance requirements. The Federal Financial Institutions Examination Council (FFIEC), National Institute of Standards and Technology (NIST) and other regulatory bodies have all released specific frameworks and tools to strengthen cybersecurity policies.

Enterprises today allocate considerable budget and resource to establish security policies and adopt industry frameworks. However, with threats becoming more sophisticated, it is extremely important for organizations to invest in threat intelligence systems and better business continuity, disaster recovery and redundancy mechanisms.

What Cybersecurity Means in a Cloud Era

Cloud abuse is one of the top cybersecurity threats. The recent spear phishing campaign on Dropbox’s cloud storage, where the attackers were able to carry out their activity while hiding as legitimate users shows that attackers continually adapt new technologies as well as vulnerabilities to further their ends.

Alarmingly, as per the 2016 Cloud Security Spotlight Report, a huge majority (84 percent) of cybersecurity professionals are dissatisfied with traditional security tools when applied to cloud infrastructure. The report also states that unauthorized access or improper access controls is the single biggest threat to cloud security, followed by hijacking of accounts (44 percent) and insecure interfaces/APIs.

Organizations need secure cloud to preserve the integrity of systems and operations and to protect their data, and for this they must work collaboratively on risk assessment and security planning with cloud service providers. Clarity and rigor is required around security protocols including access and data separation as well as roles and responsibilities around compliance and assurance over business continuity.

Is Cloud Enabled Cybersecurity the Way Forward?

PwC’s Global State of Information Security Survey 2016 highlights the importance of using cloud-based monitoring and analysis technologies and adopting new safeguards for digital business models. Cloud-based threat management systems allow organizations to rapidly identify and analyze a threat in order to take action.

The future lies in harnessing the power of cloud to improve cybersecurity for organizations. This includes using cloud to create highly secure platforms which can be used to block any tools and procedures used by the attackers.

By Vibhav Agarwal

POPULAR ARCHIVES

Cloud Education

6 Surprising Ways Cloud Computing is Changing Education

Cloud Computing Education The benefits of cloud computing are being recognized in businesses and educational institutions across the board, with

Daren

Countdown to GDPR: Preparing for Global Data Privacy Reform

Preparing for Global Data Privacy Reform Multinational businesses who aren’t up to speed on the regulatory requirements of the European

Brian Wheeler

Financial Management Finds a Welcome Home in the Cloud

Cloud Based Financial Management The most cautious person in any organization is likely to be the CFO. After all, they’re

The Rise Of BI Data And How To Use It Effectively

The Rise of BI Data Every few years, a new concept or technological development is introduced that drastically improves the

Ted Talk

Critical Thinking And Big Data

In a deeply moving TED talk about the importance of critical thinking when dealing with data, big or small, Susan