Cybersecurity, a growing priority

by Rebeca | Jan 26, 2022 | cybersecurity, soffid

Recently, there has been a staggering rise in cybersecurity threats. This is primarily due to the coronavirus pandemic. Increased geopolitical tensions, and cloud and IoT adoption have made companies vulnerable to more frequent and damaging cyber-attacks creating a greater need for security infrastructure and talent.

It is fair to say that convergence can be good for vendors but challenging for users. For many organizations, the prospect of any software platform conversion means more costs, more and possibly different licenses, and added usage. Also, product convergence eliminates competition, potentially leading to higher prices and fewer choices.

Today’s organizations need a cloud-based platform that supports centralized management of remote, mobile, and access to the data center or cloud, and:

• Unifies access policies for on-premise and cloud deployments
• Addresses the nuances of enterprise mobile security
• Reports on the health of all appliances and devices
• Provides a mass-provision workspace for deploying patches and features

Other challenges these organizations face include

• Error-prone access management.
  Managing access security appliances on a box-by-box basis is time-consuming for resource-strapped IT teams – and it’s an approach that is prone to error.
• Disparate point solutions.
  Separate solutions for remote, local, and mobile enterprise access increase equipment expenditures, operational overhead, and compliance complexity.
• Burdensome bulk operations.
  Without centralized management capabilities, IT teams can’t easily perform firmware updates and policy changes across the enterprise, or replicate configuration and polices from one appliance to many.

Identity

Identity started with a focus on humans. Thus, identity is something that can describe a person with a consistent set of details/attributes. But in the era of digital transformation, it is not limited to human identity only.

Conventional IAM architectures have relied primarily on the ability to authenticate user credentials to a directory store and grant fine-grained access to business applications based on statically assigned privileges, regardless of any inherent risk posed by a user.

This model no longer reflects an IT landscape in which a mobile workforce can use unmanaged smart devices from anywhere in the world to access sensitive data in cloud-hosted business applications.

A comprehensive identity platform allows for a common user experience across multiple applications and systems (both legacy and modern). In addition, it will enable consumers and distributed workforces to use the same authentication method to access applications and resources across different enterprises.

Soffid  helps organizations increase the maturity of their program by protecting your company from breaches, thereby, aiding in productivity, competitiveness, and maintenance of regulatory framework.

Sources:
(1) computer.org
(2) Technology Hits
(3) Solutionsreview

Picture: <a href=’https://www.freepik.es/fotos/grafico’>Foto de Gráfico creado por rawpixel.com – www.freepik.es</a>

Innovation or security?

by Rebeca | Jan 5, 2022 | cybersecurity, soffid

Throughout 2021, global news seemed to ricochet between the rapid spread of new iterations of COVID-19 and cyber criminality — both becoming increasingly creative and disruptive as they mutate in a battle for survival; both interlinked as cybercriminals profit from rapid digitalization forced by COVID-19 lockdowns. In a recent interview, a prominent cybersecurity executive pointed out that alongside birth, death and taxes, the only other guarantee in our current lives is the exponential growth of digital threats.

Because security is not built into new technology from the ground up, cyber criminals quickly get a foothold and cause untold damage before we can catch up.

Much has been said about the cybersecurity skills shortage. Millions of cybersecurity positions are unfilled, and this is causing serious problems at many organizations. But the magnitude of the skills shortage is based on a specific model of doing security. This model is reactive rather than proactive and takes a labor-intensive, “brute force” approach to threat response. We need more bodies in cybersecurity because our methodology is to “throw more bodies at the problem.”

For example, rather than doing threat modeling and building strong, proactive controls as they develop an application, organizations scan for vulnerabilities, manually analyze the scans and manually remediate the problems — or else let the vulnerabilities accumulate. This consumes a lot of resources and ultimately does not leave an organization significantly safer than if it had done nothing.

Moving Beyond Brute Force

While most people may see the logic in moving beyond this scattershot approach, it has an incredibly strong gravitational pull. IT governance policies at many organizations require the use of antiquated security technology and processes when other approaches would provide better protection using fewer resources. At the same time, the rapidly evolving marketplace means that development teams face continual pressure to crank out applications even faster than they do today. This makes it easy to rush into development rather than taking the time to architect an application to be secure before coding even begins.

But what if we were to break from the gravitational pull of reactive security and refocus on what really matters? We could build security into new technologies as they are developed, rather than adding it as an afterthought. We could become consistent, prioritized, focused, structured and strategic in the use of people, processes and tools. We could help developers learn to write safer code by providing real-time feedback.

At the same time, we need to be making security more visible. If users had an idea which software was safer and which was less safe, they would choose accordingly. The White House issued an executive order in May that can potentially move us in this direction. For example, it requires software vendors to provide a “Software Bill of Materials,” something of an “ingredients list” for an application. We need dramatically more information about why we should believe something is secure before we trust it with important things — like elections, finances and healthcare, for example.

Proactive cybersecurity strategies  aggregate a multitude of perspectives, which brings the benefit of innovation, problem-solving and consensus-building.

From the growing adoption of distributed cloud to the proven benefits of remote mobile workforces, the attack surface for bad actors is ever-widening. This means the requirements for network security have also evolved with the growing threats of increasingly distributed systems.

Security should not take a backseat to innovation in digital businesses. Of course, innovation and speed will require businesses to build secure systems, which means we can no longer afford to implement security only at the service level. We need to apply adaptable solutions from the architecture level that will change with digital business requirements.

Sources:
(1) Forbes
(2) Information Week

Cybersecurity trends for 2022

by Rebeca | Dec 29, 2021 | cybersecurity, soffid

Organizations start asking how they could defend their systems and people differently.

The changed world we’ve found ourselves living in since the global pandemic struck in 2020 has been particularly helpful to cybercriminals.

Homeworking, the ongoing digitization of society, and the increasingly online nature of our lives mean opportunities about for phishers, hackers, scammers, and extortionists. As we head into 2022, there is, unfortunately, no sign of this letting up. This is why it’s essential for individuals and businesses to be aware of the ever-growing avenues of attack as well as what can be done to mitigate the risks!

While the covid-19 pandemic upended workplaces and ushered in rapid digital transformation, the turmoil around cybercrime has remained constant: attackers are always changing tactics to evade detection. Flexible, customer-first solutions have emerged to meet ever-changing circumstances to keep organizations secure and confident against cyber threats. In the new year and beyond, as technology and workplace trends evolve and laws and regulations change, cybersecurity forecasts are emerging.

Enterprise spending on cybersecurity is expected to hold steady in 2022, as studies show that nearly all CISOs are getting a budget increase or level funding in the new year—only a small fraction of security chiefs will see their budgets fall.

CSO’s 2021 Security Priorities Study found that 44% of security leaders expect their budgets to increase in the upcoming 12 months; that’s a slight bump-up from the 41% who saw their budgets increase in 2021 over 2020. Fifty-four percent of respondents say they expect their budgets to remain the same over the next 12 months. Only 2% said they’re expecting a decrease—a much smaller figure than the 6% who saw their spending drop from 2020 to 2021.

According to PwC’s 2022 Global Digital Trust Insights report, “investments continue to pour into cybersecurity” with 69% of responding organizations predicting a rise in their cyber spending for 2022. Some even expect a surge in spending, with 26% saying they anticipate a 10% or higher spike in cyber spending for the upcoming year.

Meanwhile, tech research and advisory firm Gartner estimated that spending on information security and risk management will total $172 billion in 2022, up from $155 billion in 2021 and $137 billion the year before.

Firstly, it’s worth knowing that Gartner’s predictions come from Gartner IT Symposium/Xpo Americas, which ran virtually in October 2021.

The key theme of discussion this year was to explore the lessons learned from the ongoing disruption and uncertainty. On their page, Gartner states that they revealed their top strategic predictions for 2022 and beyond. These are:

• By 2024, 30% of corporate teams will be without a boss due to the self-directed and hybrid nature of work.
• By 2025, synthetic data will reduce personal customer data collection, avoiding 70% of privacy violation sanctions.
• By 2024, 80% of CIOs surveyed will list modular business redesign, through composability, as a top 5 reason for accelerated business performance.
• By 2025, 75% of companies will “break up” with poor-fit customers as the cost of retaining them eclipses good-fit customer acquisition costs.
• By 2026, a 30% increase in developer talent across Africa will help transform IT into a world-leading start-up ecosystem, rivaling Asia in venture fund growth.
• By 2026, non-fungible token (NFT) gamification will propel an enterprise into the top 10 highest-valued companies.
• By 2027, low orbit satellites will extend internet coverage to an additional billion of the world’s poorest people, raising 50% of them out of poverty.
• By 2027, a quarter of the Fortune 20 companies will be supplanted by companies that neuromine and influence subconscious behavior at scale.
• By 2024, a cyberattack will so damage critical infrastructure that a member of the G20 will reciprocate with a declared physical attack.

Conclusion

There is no such thing as the perfect plan, and many believe the future is unpredictable. However, if this were true, we wouldn’t have weather forecasts, and we wouldn’t have the list above along with the countless lists by other cybersecurity specialists and specialist companies.

The future is predictable (to some extent) by looking at the past and making some basic assumptions about what the future may hold for us. The time is right to take stock of what has gone before and make some reasonable assumptions and predictions about what our future holds, for there is no doubt that change is coming.