The coronavirus pandemic accelerated the journey towards the fourth industrial revolution and new threats emerged in the process. Business leaders must therefore think about cybersecurity in a new way, writes Dani Michaux.
Over the past year, we have seen significant geopolitical changes driven by the impact of COVID-19, forcing organisations to strengthen their resilience. The realisation has also dawned that the world as we once knew it has changed. Amid all of this, I see a new and very different operating model emerging for business. That new operating model is based on various restructuring activities, accelerating digitalisation initiatives, alternative partnership models, and a sharper focus on core activities.
As organisations pivot, it is essential to reflect and consider the risks that may emerge as part of these organisational changes. What do the changes mean for the organisation, its supply chain partners and players, connected industry, government, and broader society? One prominent challenge is the need to safeguard the new digital ecosystem, which underpins this transformation, from cyberattack and information infrastructure breakdown.
The world kept turning in 2020
During the early part of 2020, we saw an increased number of CEO identity frauds, payment frauds, ransomware attacks, and crude attacks on insecure cloud services. As the year grew old, we saw more complex attacks targeting supply chains, major cloud environments, remote working applications, security product providers, and even critical infrastructure services. This time last year, we claimed that cybersecurity is key to achieving the fourth industrial revolution. COVID-19 has accelerated that revolution and the use of digital and cloud technologies in both the public and private sectors. Those technologies are now fundamental to our society.
Sadly, the pandemic has also shown that organised crime is opportunistic and ruthless in its exploitation of events to gain financial advantage. Thus, we have witnessed a steady stream of high-profile cyberattacks on private enterprise, government and social media platforms during the year.
Nevertheless, it’s encouraging to observe the pace at which Organisations rolled out robust digital infrastructure during difficult times, and the collaboration that we saw amongst business, technology and security teams to safeguard these rapidly deployed services. It shows us how these often-siloed parties can work together effectively to introduce secure innovation at market speed.
COVID-19 has given the remit of Chief Information Security Officers (CISO) a new dimension. Suddenly, they must concern themselves with effectively managing thousands of home-working sites, personal devices and a rapid shift to the cloud. The CISO has moved from securing corporate IT boundaries to a broader view of enterprise security.
The timescale for many cloud-migration projects has collapsed from years to months in the race to meet fast-changing business needs. Hyperscale cloud providers are increasingly dominant and intently focused on security. To succeed in the future, security teams must:
- Reskill employees to reflect the split of responsibilities between enterprise and cloud-service providers
- Adapt to agile development methods and new digital channels
- Enact these innovations while cloud security skills attract a premium salary as the global job market competes for much-needed talent in 2021
A common theme of all of these attacks is the presence of third-party providers of hardware, services or software.
The rise of supply chain attacks
Political and business leaders have become alert to the global interdependence of many critical functions and the nature of risk that cross-border supply chains have. The pandemic made these murky operational and systemic risks real and has given people pause for thought.
Supply-chain attacks are not new. However, in the new highly digitalised and interconnected world, they are becoming more prominent. Frequent attacks raise concerns around the ability of business Organisations to remain resilient.
We have seen several prominent cases over the past few years. Examples include the Target cybersecurity attack, where a network intrusion may have exposed approximately 40 million debit and credit accounts; a global cyber-espionage campaign known as ‘Operation Cloud Hopper’, which formed part of a shift to target managed service providers; a worldwide campaign against telecommunications providers called ‘Operation Soft Cell’; and the latest cyberattack on Solarwinds, a global provider of network management solutions.
A common theme of all of these attacks is the presence of third-party providers of hardware, services or software. In complex infrastructure, set-ups that include rapid pivoting to new environments and dependencies on third-party suppliers are common.
Third-party providers are targeted with the ultimate aim of reaching a bigger mark. The methods and duration of the compromise vary, but there are some common patterns. These include exploiting rapid deployment challenges, looking for exposures in security controls as firms shift rapidly to new technology. Of course, smaller organisations within the supply chain may also attract greater attention, based on the assumption of reduced sophistication and scale of security operations.
Lessons can be learned from sectors like oil and gas, where human safety is on top of executive agendas and assumptions are constantly challenged. It starts from the proposition that you can’t assume that anything will work in the event of a major explosion. For example, a company might have a procedure to pre-book hospital beds for casualties, but what happens if the hospital doesn’t have a burns unit? What happens if the ambulances can’t get to the site of the explosion? These things have to be planned for in advance, requiring creative paranoia and a certain mindset. That’s the type of culture of resilience that should be in place in all organisations. It is a question of overall operational resilience, not just the resilience of IT systems and security. In this complex world, organisations should address the following practical questions:
1. Understand the risks and dependencies in the supply chain
Here are some questions to ask:
- What are the threats and exposures associated with third-party access to your environments, services, and products?
- Do you have contractual agreements in place with clear service level agreements concerning expectations around cybersecurity?
- Are you in a position to monitor those, including supplier activities?
- Do you monitor exposures and cyber risks associated with the supply chain and discuss these issues as part of an ongoing agenda within the organisation’s management and risk committees?
2. Understand the extent of the supply chain
It is crucial to understand the extent of the supply chain within the existing environment and any changes arising from new digitalisation initiatives. Here are some questions to ask:
- How has the profile changed based on the rapid digitisation, restructuring and transformation initiatives in place?
- How do you have a view further down the supply chain (to fourth- and fifth-party providers, for example)?
3. Make arrangements to respond to supply chain cyberattacks collectively
Here are some questions to ask:
- Are there any mechanisms in place?
- Have you exercised these?
- Has the organisation included lessons learned from previous attacks?
- How has the organisation adapted based on the lessons learned from incidents?
- Are any other improvements required?
No organisation is an island, and all of us are part of an increasingly hyperconnected world.
Stepping into the future
As we look into the future of highly digitalised and scalable environments, resilience will likely be paramount and non-negotiable. Organisational resilience will rely heavily on the stability of the end-to-end supply chain. However, it will also require a new approach to data security.
The hunt will be on for cybersecurity orchestration opportunities, for robotic process automation around manual security processes, for more integration with IT key workflows, and for new managed service and delivery models. Third-party security may also need new models for more dynamic risk management and scoring, including better tracking of supply-chain stresses.
Of course, the commonplace SOC 2 and ISAE 3402 assessments may play a role as firms seek to provide evidence once to satisfy a myriad of client questions over their cybersecurity. However, we can also expect to see the rise of “utility models” where intermediary Organisations aggregate together client assurance requirements to undertake a one-size-almost-fits-all assessment of suppliers’ cybersecurity.
Over the last few years, firms have also sprung up offering risk-scoring services based on scanning of a firm’s internet-facing services, monitoring for data disclosures in the shady corners of the internet, and alerting customers that a supplier may have a potential problem, which they may not be aware of or the supplier has yet to disclose.
As outsourcing of non-core business services accelerates, it is worth asking: Do you really pay sufficient attention to your dependency on third parties who are now integral to your security and resilience as a business?
As we look to the future, organisations should move from just thinking about enterprise firewalls, antivirus software, and patching policies to considering approaches to security, which starts from the premise that a company’s success is based upon its reputation – ultimately a manifestation of the trust others have in its offerings.
This mindset leads to embedding security into products and services but, more than that, it focuses attention on protecting customers, clients and those increasingly important supply-chain partners. It emphasises stewardship of the trust they place in you when they share their most sensitive data or show their willingness to become dependent on you.
No organisation is an island, and all of us are part of an increasingly hyperconnected world. In that world, trust in supply chains and ecosystem relationships matters more than ever.
This article originally appeared on Chartered Accountants Ireland webpage, and is reproduced here with their kind permission.
Get in touch
If you have concerns about supply-chain attacks, or any queries on the issues mentioned above, please contact Dani Michaux, EMA Cyber leader at KPMG in Ireland.