Black Hat recently celebrated 25 years of its cybersecurity event with several days of trainings, briefings and keynotes. One of the more exclusive events — the Omdia Analyst Summit — showcased the world of cybersecurity and the direction it is heading. They had different speakers from around the world discussing various topics, ranging from ransomware to cloud security. First on the agenda was digital dependence by Maxine Holt, senior director of cybersecurity at Omdia.
What is digital dependence?
Digital dependence is a philosophy that stems from the idea that we, as a population, have been using technology and the Internet of Things (IoT) more and more as we have progressed further into the fourth industrial revolution. This digital dependence was turbocharged by the COVID-19 pandemic and the innovations that came out of it. While a dependency may seem like a bad thing, digital dependency is not. It has created an increase in technological advancements.
The way this occurs is through the following steps:
- Consumer demand drives organizational demand
- Organizational demand drives digital dominance
- Digital dominance drives digital dependence.
However, because of this digital dependence, it is more important than ever to manage security, data/identity and privacy.
Cybersecurity risks are ever present
With an increase in digital dependence, there must be a strong increase in cybersecurity, too — especially with the rise of digital cloud in business and plant settings. The World Economic Forum ranks cybersecurity as No. 7 on its list of immediate societal risks, according to Holt.
In the past couple of years, there has been a resurgence in ransomware — a type of malware that encrypts a target’s data so they can’t access it without paying a ransom. This re-escalation is a major cause for concern, especially with the rise of ransomware-as-a-service (RaaS), which effectively allows any person to become a threat actor, no matter the experience level.
One issue cybersecurity professionals are running into in the race for more secure systems is a skills shortage. There aren’t enough students taking up cybersecurity as a career path to help combat threat actors and keep different systems as secure as possible.
The frequency of information technology (IT)-driven operational technology (OT) attacks has also increased. These attacks primarily take place at pipelines, water treatment facilities and building automation systems, as well as critical infrastructure.
The three eras of cybersecurity technology
According to Holt, we have gone through several different eras of cybersecurity technologies and responses:
- Preventive – Related to the first attacks and learning from them
- Reactive – Assuming a breach has occurred, detecting it swiftly and mitigating
- Proactive – Never trust, keep monitoring and reduce the attack surface.
These three eras are all equally important and useful for continuous improvement in cyberspace.
This fits into the philosophy of digital resilience. It is imperative that a company or plant can continuously operate through an attack and quickly leverage digital opportunities (patches, software, counter measures, etc.) to ensure the protection of their systems. This falls in the same category as continuous improvement.
With this, there are four major tenets to taking action:
- Risk – Understand the attacks as they come, “patient zero”
- Prioritize – Do so with risks aligned with an organization’s digital experience
- Control – Build and enhance to address cybersecurity risk
- Review – Review development to support security controls.
Holt reminded attendees that there is no silver bullet to cybersecurity. It is a heavily involved process that snowballs over time.
Digital dependence takeaways and solution types
Holt closed off her section on digital dependence with several major takeaways:
- Resilience is important
- Companies must be adaptive and flexible
- Cybersecurity is necessary
- Reducing the attack surface is necessary
- Proactive security is key.
From that, there are two different ways of approaching cybersecurity: a built-in or bolt-on model. Both have their place, with bolt-on working best for temporary solutions and built-in for permanent solutions. Built-in is ultimately best for optimal cyber cleanliness and providing a strong cyber defense against threat actors. A built-in response also addresses the root cause of a weakened security point.
It is important to remember that cybersecurity isn’t a challenge — it’s an opportunity. All companies are on their own journey and are at different points in that process. It is crucial for them to work with enterprises to ensure a strong cybersecurity presence, especially with RaaS growing in popularity.
Do you have experience and expertise with the topics mentioned in this article? You should consider contributing content to our CFE Media editorial team and getting the recognition you and your company deserve. Click here to start this process.
