MARCH, 20238 IN MYV EWFACING DIGITALIZATION AS CYBER SECURITY PROFESSIONALBY OLIVER VALENTINO, HEAD OF CYBER SECURITY, AMAR BANKDigitalization has become the main theme for change these past few years. Currently, everything is either "as a code" or "as a service". These changes happen because of a global pandemic that is affecting every aspect of our lives. By moving to digital space, a whole new risk is introduced to businesses around the globe.Before the global pandemic happened, some companies already started their digitalization effort to gain an advantage over competitors. So, when digitalization is a must, a lot of people are already prepared to transform the business into a digital space. But what about cyber security? Are we ready?Let's look at what cybersecurity is all about. A penetration test is where they do a manual security test at the end of the development or once a year, where they have to sign off every deployment. Tools administration is where they place a security engineer for each tool and do administration to the tools, where the tools are expected to protect and monitor everything. We try to comply with or certified our process to meet certain security standards. So, is this bad? Is this good? Or even, is this enough? And is there any problem with this setup?The main problem with this arrangement is, security is not integrated with the business process. We, as security leaders, act as a gatekeeper and that's it. So, are we helping them to achieve the security standard? Or are we just becoming an obstacle?Cyber security has to evolve. We need more cyber security professionals that understand we are in the same boat as the other team. We need to start bringing value to what the company thinks is important.Here are a few things that we, as cyber security professionals, need to start doing,Integrate PresenceWe have to start integrating our presence into the business process. Not only as a gatekeeper but also as a navigator. Talk with your business and product team as early as possible. Initiate conversation, or ask to be involved as early as the ideation stage. State your concern regarding potential risk early on, and state that you need to be involved in the whole cycle, including penetration testing in the last phase, so they can plan accordingly. Involved in requirement preparation for the new product, giving security recommendations that help developers as guiding posts when they develop their product, not the exact word-by-word limitation. By doing this, they can feel cyber security presence as a friend instead of a blocker. We can help them navigate their development process toward a secure product.Maintain the Same Speed and AgilitySecurity testing might take a long time to complete. Start adopting automation where low-hanging fruit can be easily found as early as possible. While manual testing will still need extra time to complete, the cyber security team can plan so the process can be completed without taking too much time. The team can start understanding the product by learning their documentation. Have documentation on how you will conduct the test, and what the Oliver Valentino
< Page 7 | Page 9 >