Cybersecurity considerations 2024

The technology, media and telecommunications (TMT) sector is leading the way in driving digital transformation across organizations through its continuous innovation and development of new technology. This has caused TMT organizations to evolve from previously offering distinct services to becoming multi-dimensional service providers, adding layers of diversity to their profiles. This transformation is driven by emerging technologies such as artificial intelligence (AI), 5G, blockchain/crypto, cloud and virtual reality, among others.

As TMT companies continue to innovate and expand, they are increasingly exposed to cyber threats and complex global regulatory requirements. Addressing these expanded cyber risks and complying with an ever-increasing spectrum of regulations is becoming a pressing challenge.

With the deeper integration of data and technology, cybersecurity and data privacy are increasingly being embedded within the core business functions. While Chief Information Security Officers (CISOs) play a vital role, the entire leadership team needs to embrace cyber and data privacy as a top priority. The focus should not be solely on responding to threats, but on proactively ensuring cybersecurity and data privacy are embedded across the organization.

To juggle the swift pace of technological innovation and transformation, TMT organizations are increasingly relying on partnerships. However, ensuring a trusted and secure supply chain across these evolving partnerships presents unique challenges.

Moreover, managing rapidly evolving digital identities within a hyperconnected environment and navigating the need for humans and machines to coexist has become a major consideration.

This article explores cybersecurity considerations for the TMT sector. It provides an overview of the rapidly evolving cybersecurity landscape, the evolving role of CISOs, the need for operational resilience and the incorporation of security within core functions.

Consideration 1: Embed cyber and privacy for good

Digital has transformed business processes, leading TMT organizations to transition from centralized cybersecurity operating models to deeply embedding cyber across all functions. As businesses continue to adopt technologies beyond cloud-based services, new security risks are emerging that require effective resource deployment and the application of AI. Cultivating a sustainable security culture that prioritizes continuous threat monitoring, clear communication, trust-building and balancing technical and soft skills is vital.

Constantly evolving business model – TMT organizations are moving toward a business model marked by rapid digital transformation and swift innovations. Technology companies are making significant AI investments, telecommunications organizations are shifting to a tech orientation and media firms are embracing an all-digital approach. These ongoing changes, coupled with a reliance on digital systems, increase exposure to dynamic threats.

Compliance and legislation – With the acceleration of creativity comes increased regulatory compliance. Emerging regulations around data, content, AI and open interfaces have far-reaching implications. For TMT organizations, ensuring compliance remains a challenge.

Digital trust – Organizations in this sector now have the opportunity to harness digital trust as a competitive differentiator, reframing cybersecurity and privacy from being perceived as costs to value propositions.

Shift-left innovation – With formalized initiatives around emerging technologies, the “shift left” approach offers opportunities to embed security and privacy measures at the onset of product design and service delivery.

Global collaboration – International conversations can improve collaboration in digital security, providing repeatable best practices and enhancing inter-organizational cooperation across various industries.

Amid the rapid evolution of business models and compliance complexities, TMT organizations remain a dynamic target for cyber threats. Embracing the “secure by design” principle across all business functions helps integrate security smoothly across the operational spectrum.

Consideration 2: Modernize supply chain security

As organizations in the TMT sector face an increasingly complex and interdependent supply chain ecosystem, they are more exposed to new cyber threats. In response, businesses are urged to establish strategic supplier partnerships focused on continuously monitoring and managing the evolving risk profiles of these entities to enhance operational resilience. The rapid pace of technological advancement and the deployment of AI augments and complicates this landscape, presenting new opportunities and potential risks. Global standards and regulatory bodies are stepping in to ensure the supply chain ecosystem is adequately focused from a cyber risk perspective and that proper security controls are deployed.

Supply chain dependency – Cyber intruders often target software and hardware vulnerabilities, posing a significant threat to supply chains. The TMT sector operates within a complex ecosystem that includes intricate information exchange through dynamic APIs, large volumes of information exchanges, seamless access across multiple entities to provide the appropriate customer experience, and a web of virtual technologies to ensure those experiences are unique. Security weakness in this ecosystem can create a massive ripple effect. Instances like the SolarWinds attack remind us of the far-reaching consequences of these dependencies.

Weakest Link – TMT companies often share sensitive information with business partners, exposing them to data leakages and cyberattacks through these links. The strength of cybersecurity measures depends on the weakest link in the chain, underlining the crucial yet challenging task of conducting thorough third-party due diligence.

Regulatory consequences – Cyber intruders can compromise not only an organization's information but also third-party data. This exposure can lead to stringent punitive measures such as fines, penalties or lawsuits, adding another layer of challenge and risk to the equation.

Supply chain integration – Integrating cyber considerations into engineering and procurement processes presents a huge opportunity for organizations to minimize risks emerging from supply chain compromises. This proactive approach can strengthen enterprise positioning.

Collaborative innovation – Collaborating across the value chain to share insights and innovate offers a wealth of opportunities. Regular participation in industry-wide sharing sessions, viewing stakeholders and suppliers as partners, and driving collective approaches in areas of shared benefit can foster trusted supply chain networks.

Supplier risk management – Continuous monitoring and inventory assessment of frequently used suppliers and software can help organizations better understand providers' security structures and identify potential risks. Sharing information can enhance supply chain relationships and solidify best practices.

Intelligent automation – Improving ongoing visibility into changing supplier risk profiles can help build a sustainable, scalable and forward-looking third-party program.

Crowdsourcing intelligence – Encouraging the crowdsourcing of intelligence within your organization and with trusted third parties can provide collective cybersecurity insights, enhancing threat detection and response capabilities.

With increased instances of supply chain disruptions, TMT enterprises investing in comprehensive risk management need a clear, continuous view of an ever-expanding third-party ecosystem. With today’s complex global dynamics, evolving toward a cybersecurity posture encompassing businesses and the vendor ecosystem is crucial.

Consideration 3: Make identity individual, not institutional

Digital identity has emerged as a key factor for efficient digital interactions in the connected world. With smart devices tethered to organizations’ digital backbone, managing their identities is imperative. Customer digital identity is another increasing area of focus, with consumers accessing digital platforms daily. This has made a reliable and trusted federated identity model particularly important.

In this environment, the security challenges of establishing digital identity are growing with the rise of deepfake technologies. Cybercriminals are using this tactic to target corporations, institutions and sovereigns, many of which are unprepared to defend against this threat.

Machine identity – TMT organizations are seeing an increased number of smart devices utilized to carry out malicious activities. Traditional methods often falter in verifying these digital identities, and some companies can't even quantify their machine count, making a robust digital identity system crucial for preventing cybersecurity risks.

Customer identity – The rise of online platforms and digital communication has led to a dispersion of customer identities across channels. This causes a complex, fragmented experience that can lead to data breaches and security risks if not properly monitored and addressed. Federated identities present an additional risk, as identity compromise can have far-reaching effects across multiple services.

Connected enterprises – As organizations operate with increased connectivity spanning employees, partners, vendors and others, lack of proper digital identity management exposes them to the risk of cyber intrusions launched through poorly managed identities.

Individual identity – Due to the evolving nature of digital identities, it's becoming increasingly difficult to confidently identify individuals interacting with businesses. As consumers create multiple digital identities for various online services, the risks associated with identity verification also increase.

Deepfake threats – Cybercriminals can bypass digital identity checks using deep fakes, and much of the industry is ill-prepared to defend against such sophisticated attacks.

Verification-centric approach – TMT organizations can bolster their cybersecurity posture by adopting a “verify, then trust” model. This approach emphasizes verifying everything, including organizational resources and the vendor ecosystem, as the cornerstone for strengthening cyber defenses.

Advanced behavioral authentication – Leverage the power of AI and machine learning to establish behavior-based identity verification measures and detect anomalies, signaling suspicious activity. AI-based technologies can enable TMT organizations to enhance authentication processes significantly.

Consumer experience – In today’s digital world, consumers crave swift, effortless, and efficient online interactions and transactions. This presents an opportunity to strike the optimal balance between establishing a user-friendly yet sophisticated and secure identity for consumers.

As TMT organizations take the lead in implementing emerging technologies, they must also be aware of the accompanying risks, including the potential for misuse. A reimagined approach to identity and access management, encompassing employees, ecosystem providers, connected devices and consumers, is a strong move toward ensuring and upholding a resilient security posture.

Real-world cybersecurity in the technology, media and telecommunications sector

Companies in the TMT space are increasingly facing cybersecurity and privacy threats because of their extensive reliance on digital channels. Unauthorized network access can lead to substantial financial losses, damage to brand reputation, legal action and erosion of customer trust.

Privacy threats are also prevalent, as TMT companies collect, store and process large volumes of personal data. These threats underscore the need for comprehensive data protection and cybersecurity measures.

A leading telecommunications company recently experienced a major cyberattack, leading to widespread disruptions. The attack affected the provision of various services based on data networks, voice services, television, SMS and voice/digital customer care systems.

The company had millions of subscribers, and the impact was observed across the majority of subscribers. There was also an impact on adjacent technology systems such as fintech and medtech services, which significantly depended on telecommunications capabilities.

As a result of the incident, there was a significant impact on the brand’s reputation, clearly highlighting the need for cyber to be embedded into business processes.

Top priorities for TMT security professionals

Positioning digital trust as a competitive advantage in the marketplace.
Embedding cybersecurity and data privacy as vital components of business processes.
Emphasizing and bolstering resilience and digital identities in hyperconnected environments.
Active engagement with industry forums and regulators to keep pace with emerging threats and regulations.
Creating a secure and trusted supply chain to future-proof the organization and foster a culture of continuous innovation.

How this connects to what we do

In addition to assessing your cybersecurity program and ensuring it aligns with your business priorities, KPMG professionals can help TMT organizations develop advanced digital solutions, advise on the implementation and monitoring of ongoing risks and help design the appropriate response to cyber incidents.

KPMG professionals are adept at applying cutting-edge thinking to clients’ most pressing cybersecurity needs and developing custom strategies that are fit for purpose. With technology that is secure and trusted, KPMG professionals offer a broad array of solutions including cyber cloud assessments, privacy automation, third-party security optimization, AI security, and managed detection and response.