Cybersecurity in the age of hybrid working

Adri­an Ash­er, CISO and cloud archi­tect, Checkout.com

Dar­ren Guc­cione, CEO and co-founder, Keep­er Secu­ri­ty

Emma Smith, Glob­al cyber­se­cu­ri­ty direc­tor, Voda­fone

Shub­hanga Prasad, Direc­tor, strat­e­gy, OakNorth Bank

Helen Rabe, Senior direc­tor, glob­al cyber­se­cu­ri­ty, Abcam

What does the cyber­se­cu­ri­ty land­scape look like in 2021?
DG: The coro­n­avirus pan­dem­ic has been cat­alyt­ic in forc­ing organ­i­sa­tions to move to dis­trib­uted remote work envi­ron­ments. This shift served up a buf­fet table for cyber­crim­i­nals to ramp up their attacks, which increased from the dark web up to 600%. Ran­somware-as-a-ser­vice is a huge issue now. It’s pro­lif­ic, per­va­sive, car­tel-based organ­ised crime in the worst and dark­est way pos­si­ble. They are attack­ing every­thing and no com­pa­ny, regard­less of size or indus­try, is safe. How­ev­er, 80% of the attacks are tar­get­ed to small­er enti­ties, because of a lack of time and bud­get, they don’t have sophis­ti­cat­ed IT archi­tec­tures or staff.

ES: Between com­pa­nies, we cer­tain­ly shouldn’t be com­pet­ing in secu­ri­ty. All of us need the whole ecosys­tem of com­pa­nies – no mat­ter how big, or small – to be secure, resilient to cyber­at­tacks, which will require quite a bit of col­lab­o­ra­tion and sup­port. We see a con­tin­u­ing increase in sup­ply chain com­pro­mise to attack maybe more sophis­ti­cat­ed com­pa­nies, so it’s in all of our inter­ests to keep the whole ecosys­tem as safe and secure as pos­si­ble. Addi­tion­al­ly, small­er com­pa­nies must under­stand which ser­vices are the most attrac­tive to attack­ers and which are the most impor­tant to pro­tect for their busi­ness.

AA: When, as a soci­ety, we went to pre­dom­i­nant­ly work­ing at home, it exposed the inef­fi­cien­cies of the secu­ri­ty logon process; two-fac­tor authen­ti­ca­tion, for instance, is a poor use of a worker’s time. What has become clear is that many firms have cum­ber­some remote work­ing authen­ti­ca­tion process­es that have impact­ed pro­duc­tiv­i­ty. It’s been a risk and an oppor­tu­ni­ty to get on top of that.

HR: The cir­cum­stances meant we had to engage more proac­tive­ly with our end users dur­ing the pan­dem­ic. They came to us with more direct ques­tions about man­ag­ing cyber­se­cu­ri­ty in both their pro­fes­sion­al and per­son­al lives, and it’s good that aware­ness is grow­ing. I have nev­er been a pro­po­nent of the state­ment, ‘the human is the weak­est link,’ and I think the phras­ing must change. The human is the one of our pri­ma­ry lines of defence. There is a mind­set shift need­ed so that secu­ri­ty becomes a lifestyle choice and that peo­ple adopt these behav­iours with less reluc­tance.

SP: Ulti­mate­ly, every­one is respon­si­ble for ensur­ing the cyber defences of the organ­i­sa­tion. Great secu­ri­ty solu­tions help put locks in place, but it’s a bal­ance. You don’t want to impose too much on the users or work­ers, but you need to be secure. There is no cor­rect answer, but com­pa­nies must keep cal­i­brat­ing their defences because cyber threats con­stant­ly evolve.

How has the role of chief infor­ma­tion secu­ri­ty offi­cer (CISO) evolved over the past 18 months?
ES: Cyber­se­cu­ri­ty in an organ­i­sa­tion should be like a foot­ball team; it can’t all be left to the goal­keep­er, or CISO. We need the whole team tack­ling the oppo­si­tion at every pos­si­ble line; oth­er­wise, we’ll nev­er win the game. Some basics must under­pin the strat­e­gy – patch­ing, hard­en­ing, vul­ner­a­bil­i­ty man­age­ment, user-access man­age­ment and pass­words. These are all lay­ers that make up a strong secu­ri­ty pos­ture. But com­pa­nies need to be proac­tive and use detec­tion or threat analy­sis tools, because pre­ven­tion is bet­ter than the cure. Increas­ing­ly, I think the core role of the CISO is to dis­til a com­plex top­ic to some­thing easy for the c‑suite to com­pre­hend to dri­ve trans­paren­cy and report­ing on cyber­se­cu­ri­ty. ‘Water­mel­on report­ing’ – where some­thing looks green but is red when you slice into it – is not good enough.

HR: Tra­di­tion­al­ly, most CISOs start­ed off tech­ni­cal­ly strong, but now I see many of us as strate­gic thinkers who can engage and reas­sure many stake­hold­ers across the busi­ness. We’re hybridised in our role; we need to under­stand the tech­nol­o­gy at some lev­el, but we’re not in the grass­roots of it. I spent a great deal of my time last year with a lot of end user engage­ment, for exam­ple, advis­ing peo­ple work­ing in remote loca­tions on the ben­e­fits of using the VPN and guid­ing them on best prac­tice behav­iours that pro­tect our assets. As a result, the col­lab­o­ra­tion between non-tech­ni­cal busi­ness teams and the cyber­se­cu­ri­ty team has become stronger.

SP: CISOs have cer­tain­ly had to enhance the employ­ees’ knowl­edge of cyber­se­cu­ri­ty, some­times across con­ti­nents. It is a skill to know how to speak to dif­fer­ent peo­ple at the right lev­el – includ­ing the c‑suite – so they under­stand what you need to tell them. We have found that gam­i­fy­ing train­ing has helped engage­ment.

AA: If you speak to your board about cyber­se­cu­ri­ty, you have to do so in a lan­guage they under­stand. As a CISO, you should always make it eas­i­er for peo­ple to do the right thing. If you are putting up secu­ri­ty con­trols and peo­ple are try­ing to get around them, your con­trols are wrong. They have to be as seam­less as pos­si­ble. Ide­al­ly, they will be very strong, but com­plete­ly hid­den to not impact pro­duc­tiv­i­ty.

What are the tools busi­ness­es need to com­bat cyber­crime?
AA: Pass­words should be killed as soon as pos­si­ble, and that includes PINs. It’s crazy that we rely on humans to try and remem­ber some­thing that a com­put­er is going to find hard to guess. It’s an inef­fec­tive use of human com­put­ing pow­er. Organ­i­sa­tions should be look­ing to inno­vate in this area, so there is con­tin­u­ous authen­ti­ca­tion, zero trust, and ses­sion estab­lish­ment, and it’s all seam­less­ly going on in the back­ground.

SP: As a bank, we are hyper-obsessed about our cus­tomer expe­ri­ence, and we are look­ing to inno­vate around pass­words and secu­ri­ty. We are work­ing with cyber­se­cu­ri­ty fin­techs to use smart­phones for behav­iour­al authen­ti­ca­tion, allow­ing access if the user is in the expect­ed geolo­ca­tion and types in a pat­tern on their device as expect­ed.

DG: Inno­va­tion in this space is essen­tial, but for the moment hav­ing a pass­word man­age­ment plat­form is the first key step to improv­ing cyber­hy­giene, espe­cial­ly giv­en the pro­lif­er­a­tion of the cloud and the demand for more strong pass­words. It is vir­tu­al­ly impos­si­ble to cre­ate and remem­ber pass­words for dozens of dif­fer­ent appli­ca­tions from a human per­spec­tive. The Keep­er Secu­ri­ty plat­form enables the end-user to authen­ti­cate into any web­site app or sys­tem in a sec­ond with­out trans­act­ing with a pass­word.

HR: Cyber­se­cu­ri­ty train­ing is a crit­i­cal ele­ment, unfor­tu­nate­ly it can be soporif­ic and dry, so it needs to engage your end user. Our cul­ture is young and dynam­ic, so we have boost­ed engage­ment in the last year by using ani­me videos to raise aware­ness and gain inter­est in the wider secu­ri­ty edu­ca­tion and train­ing pro­gramme. These have helped to con­tex­tu­alise secu­ri­ty, and we extend­ed the train­ing to friends and fam­i­ly, to improve aware­ness and cyber­hy­giene. This approach has made a huge dif­fer­ence.

ES: In addi­tion to chal­lenges, new tech­nolo­gies also cre­ate pos­i­tive oppor­tu­ni­ties. For exam­ple, 5G con­nec­tiv­i­ty brings high reli­a­bil­i­ty, low laten­cy and new secu­ri­ty fea­tures.

For more infor­ma­tion please vis­it https://keeper.io/protect

Spon­sored by

Keep­er Secu­ri­ty