By Vishal Salvi, Chief Information Security Officer & Head of Cyber Security Practice, Infosys
Last year was a black swan event for cybersecurity because of the rapid transformation of organizations necessitated by the pandemic. The sudden shift to remote working as well as the accelerated adoption of digital collaboration tools required not just scaling up of the IT infrastructure but also an evolution of the security practices.
The cybersecurity industry witnessed a strong impetus in 2020, and the trends of the last year will define the priorities for 2021. Organizations will look at building a strong cyber resiliency program and follow a ‘secure by design’ principle while balancing user experience and productivity.
The organizations need to continue cloud adoption to embrace the benefits of scalability and reliability for business-critical applications as well as cost optimization. An enterprise can safeguard its infrastructure, network, applications, and data from emerging threats and vulnerabilities with a robust strategy for risk management, secure cloud design, and security governance.
Also, the demonstrated security tools, fine-grained access control, and privacy adherence has helped the industry move beyond the security concerns of the early days of cloud computing. The cloud providers have matured over time and enable regulatory compliances as well as fulfill data encryption and data sovereignty requirements.
Remote working not only expands the threat surface but also create new surfaces for attack. The first casualty of remote working is perimeter security as employees’ access collaboration tools as well as critical business applications from personal, untrusted devices on home Wi-Fi.
With perimeter security no longer the line of defense, the existing remote and VPN solutions might not be enough, and the organizations will have to shift their security paradigm to a borderless security architecture to allow business continuity from anywhere in the world.
A borderless security architecture involves zero trust network access, identity and access management, and securing the endpoints. Organizations will have to work on a cyber-resilient strategy and explore ‘security on cloud’ solutions – like Secure Access Service Edge (SASE) and Cloud Security Posture Management (CSPM) – and cloud governance.
Leverage new innovations
The ever-evolving landscape of cybercrimes requires implementation of sophisticated and emerging cybersecurity technologies to significantly boost advanced threat detection and eradication.
While artificial intelligence and deep learning can be used to analyze data to detect threats or unwarranted activities, machine learning can help in identification and hence elimination of advanced persistent threats. Similarly, behavioral analytics tools look at patterns of human and machine activity and use advanced analytics to detect meaningful anomalies to help foil cyberattacks.
Then there’s blockchain. The use of blockchain with AI can establish a robust verification system to keep potential cyber threats at bay. It works based on blockchain’s peer-to-peer network fundamentals where every member in a blockchain is responsible for verifying the authenticity of the data added.
It is evident that cybersecurity is no longer just an operational concern. With extensive digital transformation of enterprises, it is also a business concern and should be on the board room agenda for all organizations.
CISOs need to build a relationship with business leadership as well as the clients to build the required trust and assurance across the turf. Organizations need to share data about cyber threats to strengthen trust among all stakeholders while building a better security ecosystem.
It is not only vital to demonstrate the effectiveness of key technical and operational security practices, but organizations also need to ensure that there is adequate transparency to assure clients that the SLAs are met with agreed levels of security and appropriate cadence.
Creating a security culture
While COVID-19 has earned CISOs a seat at the table in a board room, there is also a need to create a healthy and sustainable security culture within the organization – perhaps more than ever before. Instilling such a culture across the board helps to impress upon the fact that security is non-negotiable.
A strong security culture is both a mindset and a mode of operation. When employees intuitively understand cybersecurity risks associated with everyday activities and mitigate those with confidence in alignment with organization’s security policies, it reduces risk of insider incidents and leads to increased security compliance.
An effective security culture also leads to a workforce that thinks and acts in a security-conscious manner and is more likely to be engaged with, and take responsibility for, security issues. Of course, it also requires continuous investment and nurturing until it transforms cybersecurity from a one-time event into a lifecycle with consistent returns.
There is also a need for prioritizing and re-calibrating compliance. Having organizational governance that starts with pervasive security awareness training and builds all the way up to nurturing a secure-first organization culture is crucial in times of remote working.
Balancing user experience
While organizations set up elaborate cybersecurity measures, remote workers often tend to abandon these procedures because they interfere with their workflow at the expense of cybersecurity. On the other hand, if they cannot jump over these security checks, their work productivity is hampered.
Hence, the organizations need to ensure a streamlined work experience while building transparent cyber security controls and develop new models to monitor employees for reasonable assurance of their productivity without conflicting privacy mandates. While enterprises have centered on creating security for systems traditionally, the focus now has to be on developing security for people.
Modernize security architecture
Given the remote access scenarios and increased used of personal devices to access corporate applications over internet, there is a need to move away from security architecture components with complex integrations with infrastructure and applications that do not support open standards and cloud solutions.
The security architecture of organizations needs to be evolved to enable faster security integrations and deployments as well as catch up with the rapid adoption of hybrid setups with public cloud, private cloud, and on-premise infrastructure. The key is to establish strong architecture for data, systems, and security ‘by design’, ‘at scale’, and ‘for digital resilience and trust into the future.’ Organizations also need to bridge the historical gaps in information security, business continuity, and crisis management and establish strong architectures for data, systems, and security.
Vishal Salvi is Senior Vice President, Chief Information Security Officer and Head of the Cyber Security Practice at Infosys. He is responsible for the overall information and cyber security strategy and its implementation across Infosys Group. He is additionally responsible for the Cyber Security Business Delivery, driving security strategy, delivery, business and operations enabling enterprises security and improving their overall posture.
Vishal has over 25+ years of industry experience in Cybersecurity and Information Technology across different Industries. Prior to joining Infosys, he has performed various leadership roles in Cybersecurity and Information Technology at PwC (Partner Cyber – 2 years), HDFC Bank (SVP & CISO – 8 years), Standard Chartered Bank (SVP & Head Cyber Ops – 11 years), Global Trust Bank (IT Ops), Development Credit Bank (IT Ops) and Crompton Greaves (IT Sales).
Vishal has extensive management and domain experience in driving transformation Cybersecurity programs, delivery and sales in all key aspects i.e. Policy, Standards, Procedures, Awareness, Identity & Access Management, IT-GRC, Network Security, Incident Response, Security Monitoring, Malware protection, Cyber fraud management, Security configuration, Compliance, On-line Banking and ecommerce, Cryptography, Data Protection, Third Party Management, Business Continuity Planning, Cyber Defence Centres & Cloud Security etc.
He is a well-known leader in the Cybersecurity industry within India as well as globally and has been part of the Cybersecurity domain for the past two decades. He is a regular speaker in major local and global Cybersecurity conferences for sharing best practices and raising Cybersecurity awareness across the industry. He is part of various Advisory Councils and Boards to provide leadership and direction on various Cybersecurity frameworks and standards to drive adoption of cyber security across industry. He has participated in various case studies related to cyber security practices over the past decade.
Vishal holds a degree in computer science engineering and MBA in Finance. His certifications include CISM and DSCI Certified Privacy Professional. He has received numerous awards from prestigious institutions such as DSCI, CSO Forum, ISACA etc.