How to manage cyber risks in a transformation project

What­ev­er the busi­ness trans­for­ma­tion – dig­i­tal, enter­ing a new mar­ket or over­see­ing a merg­er – there are inher­ent risks. But all too often the focus is on areas such as oper­a­tional ben­e­fits or cost-sav­ings. Cyber­se­cu­ri­ty, how­ev­er, needs to be a major part of the plan­ning process.

Cyber­se­cu­ri­ty is inte­gral to the suc­cess of any busi­ness trans­for­ma­tion project and needs to be fac­tored in at the design and plan­ning phase. This is par­tic­u­lar­ly impor­tant if the C‑suite doesn’t have suf­fi­cient expe­ri­ence or where a chief infor­ma­tion offi­cer (CIO), or their equiv­a­lent, is not involved in the busi­ness process con­ver­sion. 

In prac­tice, how­ev­er, cyber­se­cu­ri­ty teams are often includ­ed too late or not at all. “The project lead­ers need to iden­ti­fy poten­tial cyber­se­cu­ri­ty threats and devel­op a robust strat­e­gy to man­age cyber risks and become cyber resilient,” says Jane Fran­k­land, founder of Knew­Start and the IN Secu­ri­ty Move­ment.

“Although cybersecurity’s role in busi­ness trans­for­ma­tion has improved, both in aware­ness and involve­ment in ear­li­er stages of the design process, those in charge, typ­i­cal­ly chief infor­ma­tion secu­ri­ty offi­cers (CISOs), are still strug­gling to see the breadth of projects in their ecosys­tems.”

For instance, with com­plex cloud migra­tion strate­gies, such as mov­ing from soft­ware as a ser­vice to plat­form as a ser­vice and devel­op­ing mul­ti-cloud set-ups, busi­ness­es need a clear strat­e­gy, an agile gov­er­nance mod­el and align­ment across the whole organ­i­sa­tion. In all this, the organisation’s appetite for risk must be under­stood.

“Busi­ness­es must include cyber­se­cu­ri­ty at the start and com­mu­ni­cate a trans­par­ent gov­er­nance risk frame­work, along with close mon­i­tor­ing and reme­di­a­tion of anom­alies, to main­tain com­pli­ance. And they must work on devel­op­ing the right mind­set, behav­iours and cul­ture in their organ­i­sa­tions when tran­si­tion­ing,” says Fran­k­land.

Protecting sensitive data

Busi­ness trans­for­ma­tion inevitably goes hand in hand with tech­no­log­i­cal upgrades, which often means migrat­ing sen­si­tive data and tech­ni­cal process­es from one sys­tem to anoth­er. The first chal­lenge, accord­ing to Chris Har­ris, Europe, Mid­dle East and Africa tech­ni­cal direc­tor at Thales UK, is under­stand­ing where sen­si­tive data is held. 

“While this should already be an inte­gral part of an organisation’s cyber­se­cu­ri­ty approach, it is often some­thing that catch­es them out,” says Har­ris. “No area should ever be over­looked when con­sid­er­ing cyber­se­cu­ri­ty in a dig­i­tal trans­for­ma­tion project. Doing so could leave a busi­ness excep­tion­al­ly vul­ner­a­ble to attack. Hack­ers will find any means to infil­trate an organ­i­sa­tion so busi­ness­es must ensure they shut every gate and lock every door.”

Once the trans­for­ma­tion is under­way, the switchover peri­od pos­es the great­est risk of hack­ing and cyber­at­tacks, and needs atten­tion. “Cyber­se­cu­ri­ty mea­sures such as anti-mal­ware, com­pre­hen­sive fire­walls and pri­or plan­ning of every step of the trans­fer are key,” says Steve Jacob, UK direc­tor of inter­na­tion­al web devel­op­ment agency Smar­tOSC.

“With cyber­se­cu­ri­ty laws and reg­u­la­tions, such as GDPR [Gen­er­al Data Pro­tec­tion Reg­u­la­tion], in place in many regions, many reg­u­la­to­ry bod­ies have teeth and will bite, hard, with penal­ties for non-com­pli­ance. Being active­ly aware of the cyber­se­cu­ri­ty require­ments in any new mar­ket you plan to enter are now table stakes.”

Locating the source of responsibility

While every­body in an organ­i­sa­tion should be trained in the impor­tance of data secu­ri­ty and what they can do on a per­son­al, day-to-day basis to mit­i­gate risks, the ulti­mate respon­si­bil­i­ty for cyber­se­cu­ri­ty lies with the exec­u­tives and, if there is one, the ded­i­cat­ed cyber­se­cu­ri­ty team. 

“The C‑suite exec­u­tives should make a com­pre­hen­sive plan to iden­ti­fy poten­tial secu­ri­ty prob­lems and who is in charge of head­ing them off in time,” says Jacob.

It’s a view shared by Richard Meeus, secu­ri­ty tech­nol­o­gy and strat­e­gy direc­tor, Europe, Mid­dle East and Africa, at Aka­mai Tech­nolo­gies, who says the ulti­mate respon­si­bil­i­ty falls to the C‑suite and nor­mal­ly this means the CISO. 

“They should be involved in all dis­cus­sions about the trans­for­ma­tion project to ensure the busi­ness is not putting itself at any unnec­es­sary risk and secu­ri­ty is fac­tored in at each stage,” says Meeus.

The wider busi­ness also has a shared respon­si­bil­i­ty to know the risks asso­ci­at­ed with a project and the steps being tak­en to mit­i­gate them. While edu­ca­tion from top to bot­tom is vital to ensure any secu­ri­ty poli­cies intro­duced are being fol­lowed, final respon­si­bil­i­ty sits at the top. 

“Ulti­mate­ly it’s the per­son at the top that can lose their job should a breach occur, so they need to be aware of steps being tak­en,” Meeus adds. “Just because the world we oper­ate in is in large part vir­tu­al, the rules have not changed. It is still the respon­si­bil­i­ty of busi­ness­es to take own­er­ship and respon­si­bil­i­ty for the data they col­lect and store,” he says.

What can go wrong

From rep­u­ta­tion­al dam­age to hits to the bot­tom line, no busi­ness can afford to over­look any area of cyber­se­cu­ri­ty. “Hacks and data breach­es spell dis­as­ter for the indi­vid­u­als who are tar­get­ed and the rep­u­ta­tion of any com­pa­ny that is attacked. Keep­ing users’ per­son­al data safe should be the business’s pri­or­i­ty above all things when under­tak­ing a trans­for­ma­tion project,” says Jacob.

With­out a water­tight plan in place to iden­ti­fy and resolve cyber­se­cu­ri­ty issues quick­ly, sen­si­tive data can fall into the wrong hands and even be used for crim­i­nal pur­pos­es. “It’s absolute­ly cru­cial busi­ness­es have a sol­id data recov­ery plan to be pre­pared for the worst-case sce­nario,” he says.

The coro­n­avirus pan­dem­ic has accel­er­at­ed the need to move on dig­i­tal trans­for­ma­tion for many organ­i­sa­tions, but it remains vital to car­ry out safe imple­men­ta­tion with­out cut­ting any cor­ners. 

“Com­pa­nies must fol­low a secu­ri­ty-by-design approach and build tai­lored cyber­se­cu­ri­ty mea­sures into the sys­tem. It’s also vital that busi­ness­es fac­tor in secu­ri­ty from day one, rather than treat­ing cyber­se­cu­ri­ty as an after­thought. Any lapse in this could allow hack­ers to breach the perime­ter,” says Har­ris at Thales UK.

Balancing transformation and cybersecurity

Bal­anc­ing the need to move quick­ly on a trans­for­ma­tion project with under­tak­ing it in a cyber-secure way must start with iden­ti­fy­ing project risks and devel­op­ing a clear­ly defined, man­aged process. “Ide­al­ly, sim­pli­fy the approach as much as pos­si­ble, using a stan­dard­ised set of solu­tions to gain speed and agili­ty,” says KnewStart’s Fran­k­land.

She also advis­es the lead­ers charged with trans­for­ma­tion respon­si­bil­i­ty to grasp the breadth of projects to under­stand the risk expo­sure across net­works, appli­ca­tions, cloud infra­struc­tures, dat­a­cen­tres and sup­ply chains. 

“Pen­e­tra­tion test­ing and risk assess­ments are also a must to uncov­er vul­ner­a­ble assets and direct risk mit­i­ga­tion action. Automa­tion with­in con­tin­u­ous secu­ri­ty mon­i­tor­ing solu­tions can fur­ther advance capa­bil­i­ties, reduce the threat sur­face and enable cyber­se­cu­ri­ty teams to focus their efforts on reme­di­at­ing risks based on their pri­or­i­ties, max­imis­ing time and effi­cien­cy,” says Fran­k­land.

And to reduce risk even fur­ther, busi­ness­es might con­sid­er active­ly includ­ing women in the trans­for­ma­tion team. “Women are well known for adding a strate­gic and com­pet­i­tive advan­tage to busi­ness. And when it comes to cyber­se­cu­ri­ty, they add anoth­er ben­e­fit of see­ing risk in a dif­fer­ent way to men,” she says.

“Being high­ly attuned to chang­ing pat­terns, a skill that’s need­ed for spot­ting anom­alies, cor­rect­ly iden­ti­fy­ing threat actors and pro­tect­ing envi­ron­ments, women are espe­cial­ly use­ful in cyber­se­cu­ri­ty. But it’s not that women are bet­ter than any oth­er gen­der, it’s just that when we come togeth­er as human beings, we do a bet­ter job. Diver­si­ty strength­ens busi­ness­es.”