This year’s Infosecurity Magazine report threw up interesting issues that six months ago we’d never have anticipated. Admittedly six months ago we’d never have dreamed of a pandemic leading to us being locked up at home, but the IT-specific issues that those sampled prioritised shows that as we evolve as an industry, we also can’t escape the greatest hits – certain issues keep coming back to haunt us.
COVID knocked us all for six
Perhaps unsurprisingly, COVID-19 was named the biggest trend, as it had a huge impact on cybersecurity. For some companies it has compelled them to educate employees on cyberattacks and ways to detect malicious activity, and perhaps accelerated security trends such as zero trust to enable better authentication. However, it’s also clear that unless deemed a priority for business recovery and growth, long-term technology spend will be impacted by the pandemic, as will how firms leverage video conferencing and internal comms tools such as Zoom or Slack – both of which carry well-documented security flaws.
For IT professionals, it’s certainly been a baptism of fire in helping ensure secure and high performing infrastructures, and these challenges are likely to continue as the return to offices starts, with fluid work set-ups likely required. This no doubt will cause more challenges later down the line, but one thing the first ‘wave’ has shown us is that no one was fully prepared for the unexpected. For all the rhetoric surrounding digital first, very few found that the transition to entire workforces working remotely was a seamless process.
We don’t trust what we can’t control
Another interesting point raised by the report was feelings towards the Cloud, alongside automation and AI. Whilst respondents saw the benefits provided by working in the Cloud or adopting automation, there is still some misunderstanding, particularly surrounding Cloud and its constant evolution. This highlights that some IT pros remain cautious – they don’t trust what they can’t control. The same is true of AI and machine learning – it’s helpful in regard to intelligence and diagnostics visibility; but like all disruptive new technologies it’s also aiding the hacker in the evolution of threats, thereby making cyberattacks more sophisticated and complex for IT professionals to thwart.
The issue remains that cybersecurity is at the forefront of a digital evolution – akin to the importance of the Industrial Revolution all those years ago. According to Ivanti, IT workloads have increased 37% during the pandemic, with a 66% rise in security threats. IT pros need to leverage tools that can better enable them to do their jobs. It’s interesting that technologies that can help drive significant efficiencies can be viewed with such caution. However, any security implications of these technologies should be discussed and addressed in the adoption phase, to ensure that this doesn’t stymie a company’s digital progression.
Gone phishing: people still a major problem
Phishing continues to be another major trend this year. Of course exacerbated by COVID-19, it highlights the threat employees hold. Better education is still required, and despite being a legacy threat, it highlights that people are the Scylla and Charybdis of enterprise IT – companies can’t just presume people are paying attention or know what a threat looks like.
People were also identified as their own trend – notably, IT professionals themselves. The report raised the age-old issue of the skills shortage, alongside the issue of diversity – not ethnic or cultural – but cognitive. How people think can determine response times and impact, so it’s no wonder that IT teams want diverse thinkers to help make them as agile as possible. Perhaps paradoxically, the report signalled that despite an increase in automation, people are needed more than ever to help the technology learn, and then ultimately make the final call, showing that human input will always be a business’ most valuable asset.
But what next?
My take-out from the report is that the industry is certainly being challenged by COVID-19, but that it could be a catalyst for real change. Those working in the industry are naturally cautious and want to shore up every defence, but the pace at which external threats and working requirements are evolving is preventing that from happening. The next 12 months will be critical, as less frequently discussed issues like state-sponsored attacks may start to raise their heads as the world scrambles to regain normality. Bad actors can smell vulnerabilities, and for some nations, what better way to divert from a bad news cycle at home than to attack a conglomerate and steal their IP?
The status quo calls for a back-to-basics and layered approach. Address the greatest hits – phishing, patching, employee unawareness – and consign them to the past. Leverage automation to help free up skilled staff to address the harder to find or more advanced issues so no one is caught on the back foot. My advice to cyber stakeholders right now is know your threats, know your systems and don’t forget to communicate. The rest will fall into place.
By Geraldine F.
