How to build cybersecurity into your digital transformation project

Dig­i­tal trans­for­ma­tion projects took on a whole new world of urgency in March 2020. Lock­downs drove busi­ness­es to estab­lish work from home sys­tems, often with­out much pri­or plan­ning, mean­ing some things fell through the cracks. Wor­ry­ing­ly, cyber­se­cu­ri­ty was one of them.  

While cyber­se­cu­ri­ty was nev­er, of course, exclud­ed from the dig­i­tal trans­for­ma­tion process, accel­er­at­ed imple­men­ta­tion time­lines meant blind spots were cre­at­ed. With organ­i­sa­tions now increas­ing­ly using hybrid work mod­els, such weak­ness­es must be addressed by the C‑suite, ensur­ing that cyber­se­cu­ri­ty is baked in mov­ing for­ward. 

Learning from mistakes 

There were numer­ous mis­takes made by many com­pa­nies in the rush to imple­ment work from home. Greg Day, CSO (EMEA) at Palo Alto Net­works, calls them “time-based deci­sions that can be rec­ti­fied with fur­ther time and reflec­tion”. 

Although this might sound like seman­tics, it’s an impor­tant point: organ­i­sa­tions have had to com­press mul­ti­ple dig­i­tal trans­for­ma­tion projects that might nor­mal­ly take years into a mat­ter of months. The sud­den work from home busi­ness demand dic­tat­ed that “good enough” was suf­fi­cient for projects to get the green light. 

Three com­mon mis­steps sum up the inse­cu­ri­ty sce­nario: frag­ment­ed cloud trans­for­ma­tion, vir­tu­al pri­vate net­work (VPN) bot­tle­necks and the cyber-time para­dox. 

“The notion of mov­ing to the cloud means the chance to rewrite the soft­ware to take advan­tage of doing things in new ways,” Day explains, “yet for many it was more a cut and paste, sav­ing the rewrite for lat­er when there is more time.” 

This led to com­pa­nies using what­ev­er cyber­se­cu­ri­ty was pro­vid­ed with the cloud offer­ing or buy­ing off the shelf with­out due dili­gence. “With hind­sight,” Day con­tin­ues, “this cre­ates non-scal­able frag­ment­ed solu­tions, as many now realise they have many mul­ti­ples of dif­fer­ent solu­tions … most using mul­ti­ple cloud providers with each hav­ing its own solu­tion for iden­ti­ty”. 

Then there’s the VPN sit­u­a­tion: busi­ness­es already had capac­i­ty to serve maybe 25% of staff, but in the rush to trans­form sim­ply bought more secure tun­nels to con­nect back to base. “Your busi­ness net­work quick­ly becomes a bot­tle­neck: the pinch point, now that huge vol­umes of traf­fic must get through,” Day says. Such a “choke point” for a secu­ri­ty goal sim­ply isn’t fit for pur­pose. For exam­ple, secu­ri­ty require­ments for video ses­sions are quite dif­fer­ent to those for access­ing con­fi­den­tial data.

That leads to the final part of this erro­neous tri­umvi­rate: think­ing that the “same old secu­ri­ty same old” will scale to such a dra­mat­ic shift in work­load. Day calls this the cyber-time para­dox. More digi­tised busi­ness process­es mean more to secure, pro­duc­ing more data to man­age and so increas­ing the threat sur­face. 

Simul­ta­ne­ous­ly, what is con­sid­ered accept­able process down­time has dimin­ished to hours and often min­utes. It’s a para­dox that can’t be solved by throw­ing more peo­ple at it; it demands that com­pa­nies assess what process­es can be auto­mat­ed or out­sourced, Day con­cludes.

Cybersecurity responsibility

How can you prop­er­ly bake cyber­se­cu­ri­ty into your project? The basic maths of ensur­ing a secure dig­i­tal trans­for­ma­tion out­come remains sim­ple enough: process + peo­ple + imple­men­ta­tion = suc­cess. Stephen Crow, head of secu­ri­ty and com­pli­ance at inde­pen­dent tech com­pa­ny UKFast, likens it to build­ing a shed. 

“You don’t put the roof on first,” he says, “you make sure you have the right tools and some­body build­ing it who is com­pe­tent at DIY, and fol­low a plan.” You can still take the roof off to make changes after the ini­tial build is com­plete, but it’s not ide­al and will inevitably cost you a lot more. 

If you haven’t con­sid­ered upgrade paths and end-of-life plan­ning, you must do so soon­er rather than lat­er. “This is crit­i­cal because lat­er down the line you might end up in a sit­u­a­tion where you’re rely­ing on old sys­tems with exploitable vul­ner­a­bil­i­ties that have no patch,” Crow explains. Sim­i­lar­ly, if your ini­tial roll­out has mis­tak­en­ly equat­ed a Secu­ri­ty Infor­ma­tion and Event Man­age­ment (SIEM) sys­tem plus a Fire­wall with “suf­fi­cient cyber­se­cu­ri­ty”, this needs revis­it­ing. 

“A SIEM and a Fire­wall can only pro­tect you from a tiny per­cent­age of poten­tial attack vec­tors,” Crow says. “Nev­er put your trust and effort into one sin­gle tool.” Equal­ly, your dig­i­tal trans­for­ma­tion secu­ri­ty suc­cess can be ham­strung by intro­duc­ing too many over­ly strict or man­u­al pro­ce­dures. “This is a sure­fire way to gen­er­ate shad­ow IT usage that cir­cum­vents secu­ri­ty,” Crow says. “Cyber­se­cu­ri­ty is a day-zero respon­si­bil­i­ty for every­one work­ing on a project.”

Cross-functional teams 

Mivy James, the dig­i­tal trans­for­ma­tion direc­tor at BAE Sys­tems Applied Intel­li­gence, advis­es that equip­ping and empow­er­ing users with the right under­stand­ing to make the right deci­sions must go hand in hand with a dig­i­tal­ly trans­formed cul­ture. 

“Infos­e­cu­ri­ty can’t be seen as the thing that puts the brakes on dig­i­tal change,” she says. “The dan­ger here is that cyber­se­cu­ri­ty has tra­di­tion­al­ly been seen as the depart­ment of ‘no’ and some­thing which can slow change down.” 

Dig­i­tal lit­er­a­cy is right­ly con­sid­ered vital for lead­er­ship; James sees cyber lit­er­a­cy as a large part of that. For exam­ple, in the uptake of cloud-based ser­vices, cyber­se­cu­ri­ty is either over­looked entire­ly or seen as such a cause for con­cern “that cloud migra­tion becomes impos­si­ble”, she notes. 

Nor­mal­is­ing cross-func­tion­al mul­ti­dis­ci­pli­nary teams where busi­ness, tech­nol­o­gy and secu­ri­ty lead­ers oper­ate togeth­er in deci­sion mak­ing is required to dri­ve such cyber-lit­er­a­cy, accord­ing to James.

Busi­ness lead­ers need to lis­ten to their secu­ri­ty experts, because secu­ri­ty isn’t a point in time exer­cise. “Inte­grat­ing secu­ri­ty too late in the game will cre­ate huge com­plex­i­ties for your busi­ness,” Crow says, “or worse, miss­ing it out com­plete­ly will leave gaps that are hard to fix in key tech­nolo­gies and process­es.”