JULY 201919 DIGITAL TRANSFORMATION: BANE OR BOON FOR CYBERSECURITY?BY RAMESH MUNAMARTY, SENIOR EVP - TECHNOLOGY & INNOVATION, INTERNATIONAL SOSDigital Transformation appears to be ubiquitous with different connotations across enterprises. Regardless of what "Digital Transformation" means for an enterprise there is increased focus and threat posed by security. This article will go into the benefits and the risks to security posed by an organization's desire to be more agile and responsive to market needs.CIOs for decades had to deal with security challenges and in spite of the best efforts and increased investments, 50% of US companies had a cyber-attack in 2017. The problem is amplified with the increase of endpoints and the complexity of the attack vectors due to technologies such as IoT and mobile devices accessing enterprise network. The statistics from CSO Online show that 61% of organizations have experienced an IoT security incident, 90% of remote code execution attacks are associated with cryptomining and 54% of companies have experienced an industrial control system security incident. While the additional devices and new ingress points are causing a strain on the security, there has been an increase in targeted phishing attacks, ransomware and malware as well. Our good old e-mail is still the major source (92%) of malware causing havoc on enterprises. The price tag on an average ransomware attack is not trivial - it can cost an enterprise $5M.The recent attacks of WannaCry and NotPetya show that the scale of the attack can be humongous impacting the entire healthcare network of NHS and other organizations such as Telefonica.Digital transformation, which at the end of the day is leveraging technological innovations to drive better business outcomes capitalizes on 4 key technologies ­ Cloud, Internet of Things, Machine Learning/Artificial Intelligence and Mobility. Technologies such as Blockchain are also becoming relevant for certain enterprises. Enterprises are looking to drive automation of business processes and digital connectedness of the entire value chain to drive agility.A number of them are creating new business models and leveraging data to drive growth. As outlined in the MIT Technology Review, in the digital era, the focus needs to shift from securing network perimeters to safeguarding data spread across systems, devices, and the cloud.Enterprises have several new security challenges that are posed due to Digital Transformation:· Polymorphic Attacks: Sophisticated attacks that can change and adapt to avoid detection by traditional security solutions. The malware frequently changes attack states or uses different file names, hashes or signatures to encrypt or otherwise hide code to avoid detection and eradication. · DevOps: Agile development and DevOps is fundamental to Digital delivery. Rapid releases and continuous integration and development could lead to security vulnerabilities pass through undetected into production. · Lack of visibility across diverse environments: Hybrid Cloud based IT infrastructure, highly distributed environments spanning remote branches, and non-integrated, siloed multi-vendor point defense products leads to lack of visibility of vulnerabilities across user, system and network.· Digital Value Chain: Increased direct connectivity across suppliers, partners and customers are exposing several new weak links for the attackers as the network is no longer contained with perimeter protection being enough.· Endpoint devices in highly vulnerable locations: Next-generation devicessuch as IoT in industrial equipment and consumer devices are now deployed in potentially vulnerable environments such as vehicles, hospitals, and energy plants, vastly increasing the risks to human welfare. Concerns about such devices being hacked, turned into botnets, and used to attack targeted computers and organizations are growing as well.· Application vulnerabilities: Application Development teams should share the responsibility of CyberSecurity with the Infrastructure and Security teams as a number of new vulnerabilities are being exposed through applications and the development team is responsible for hardening and securing applications. Self-defending apps are being created with advanced access-control capabilities, allowing them to react to malicious source-code modifications and debugging at runtime. Encryption is being built-in both for data at rest and in transit.CXO NSIGHTS
< Page 9 | Page 11 >