Briefing
The global covid-19 pandemic will have lasting effects. It will transform information security practices and cybersecurity. These adjustments and the pace of change will depend on individual business sector norms, end user demands and workforce demographics. Seismic changes are now inevitable in the medium to longer term because of the shift in working practices, the rise in cyber threats and the economic challenges that will face many companies and organisations. Although there will be various overarching themes, the following five trends stand out:
- The rise and rise of Working from Home and Teleworking
For the largest companies and organisations that now allow hundreds and thousands of staff to work from home, by default, the cybersecurity challenges are enormous and ever evolving. The rise in ransomware and phishing attacks have been the most obvious challenges requiring new forms of training, policies and procedures and closer network monitoring. The rise in network access points and endpoints and the use of personal devices (Use Your Own Device) to access corporate networks have expanded the threat surface, increased the likelihood of human error and created stocks of unpatched and less-secure endpoints. While cybersecurity teams can find ad hoc solutions in the short term, the medium to longer term will require the increase in zero trust practices and the intensive use of new data loss prevention policies, services and tools. Specialised training in remote-working data protection compliance and staff training to avoid social engineering will need to be imbedded.
- The unlocking of Video Collaboration
One clear effect of Covid-19 has been to greatly increase the use of video conferencing and multimedia collaboration tools. Applications and services that are white-listed on corporate networks and adapted by companies and organisations do not pose unmanageable risks. However, the main risk arises from collaboration and video conferencing software and applications that sit outside of corporate networks, but are readily available, easy to use and popular. A number of these applications were not built for the enterprise but were consumer-focussed products and services which have poor data protection, General Data Protection Regulation (GDPR), California Consumer Protection Act (CCPA), information management and weak cybersecurity standards and practices. Information security teams will need to have an answer to staff and teams that use these services and rely on the utility and convenience. Organisations should actively test these products and services against relevant industry standards and the organisation’s own cybersecurity risk appetite. New governance standards and rules should be applied to mitigate risks. Vigilance is key, even for services that sit outside the corporate network, but are increasingly used for business activities.
- Cyber Resilience
Covid-19 has brought cyber resilience to the forefront, both as a tangible corporate aim and as an ongoing state of dynamic vigilance. Resilience is no longer a distant intention, but results from blending cybersecurity strategy, business continuity and disaster recovery objectives into a holistic set of principles and measurable outcomes. This analysis must also include considerations of the insurance in place for physical assets, cyber assets, intellectual property assets, data assets, know-how and personal data. The pandemic is also a signal that companies and organisations must see cybersecurity resilience through the prism of multiple emerging threats such as climate change, unusual weather events, terrorism, future epidemics, wars, civil unrests and high value persistent state-sponsored hacktivism.
- Scrutiny of Future Supply Chain Security
Covid-19 has exposed the frailties of just-in-time supply chains and the reliance of excessively long supply routes. Future supply chains will be judged for their cybersecurity resilience, cyber insurance protections and effectiveness. Cloud services and hosting will be asked to provide greater cybersecurity assurances and evidence of their business continuity and disaster recovery plans. Information security teams will increasingly develop second and third preference suppliers and explore the ability of new providers to step in, augment, or take over information technology services. It is also inevitable that information security suppliers will be held to higher standards of compliance to international information security certifications, cybersecurity best practice, sector norms, information management and data protection standards. Supply chain information security risks will receive greater scrutiny from boards and senior leaders.
- The Future of Digital Transformation
The focus of digital transformation will move way from broadly defined aims of efficiency, innovation and cost savings. The new and emerging metrics driving digitisation will be elasticity, scalability, cybersecurity resilience, ease of adoption and maintenance (leading to long term savings). The adoption of Cloud services, especially Infrastructure as a Service (Iaas) are set to increase, driven by cybersecurity concerns and the need to increase cyber resilience.