Digital transformation presents a massive opportunity

IT departments have reacted to evolving business and customer needs in the past two years. The challenge now is to sustain this pace of digital transformation for businesses. They must move away from the reactive mode that has plagued most IT departments and embeds the processes and technologies to support digital transformation as a regular part of doing business.

 

To build dynamic, agile applications, organizations adopting cloud-native architectures will need new solutions to manage and optimize the performance of their IT estates. 

 

Implementing full-stack observability and application security across a cloud-native architecture will go beyond current application monitoring.

With full-stack observability now available, the channel has a huge opportunity to support customers as they embark on digital transformation, ensuring they have the right technology platforms, processes, and skills to achieve success.

 

Helping enterprises deal with overwhelming IT complexity

 

Any professional in the IT sector knows that technologists are feeling the effects of constant innovation and a dramatic shift to cloud computing. A patchwork of legacy and cloud technologies makes it difficult for IT departments to manage a fragmented, sprawling IT environment. In response to COVID-19, many global technologists believe that IT complexity has never been greater.

Therefore, IT departments have recognized the need to monitor the entire IT landscape, from customer-facing applications to core infrastructures such as networks and security. As a result of this enhanced monitoring, technologists now have to deal with soaring volumes of data from all over their IT stack, and this data noise further adds to complexity and pressure.

Consequently, there is no way to maximize the benefits of digital transformation investment, and there is a genuine and persistent concern about IT performance problems escalating into something extremely damaging.

 

Utilizing the full-stack observation opportunity 

 

Most technologists report at least one barrier to full-stack observability and link this to business outcomes that they need to overcome to adopt it. Concerns include technology implementation and integration, scalability, and how to build a business case that proves ROI.

Channel partners play a crucial role here in easing the pressure on technologists during this challenging time. They must also provide them with the information and support to build a business case and execute a strategic implementation program.

 

Partner companies have a tremendous opportunity to become a much larger, higher-value full-stack observability practice by extending an existing application monitoring practice. Anyone who can accomplish this within the next 12 months will effectively create and capture a new, largely uncontested market 

0 Comments

CYBERSECURITY CERTIFICATIONS

People usually ask a lot of questions about cybersecurity certifications. The cost and effort required can be intimidating for early-stage companies. The jargon alone can cause headaches: SOC 2/3, ISO27001, PCI-DSS, HIPAA, GDPR, PIPEDA, and CCPA.

 

The goal is to reframe certifications from minimum operational requirements to actual strategic capabilities that can drive growth.

 

Here are three reasons why startups need these certifications and why large organizations often ask for them:

 

The building of trust 

 

Building a secure system is not enough when it comes to cybersecurity. The security measures you use also need to be trusted by your customers. Both initiatives are equally important, and they are separate initiatives. 

 

Trust prevents you from taking advantage of significant opportunities. NBC considered early-stage companies for a partnership and declined their first choice in favor of startups with certifications. For young companies aiming high, certificates are essentially a given.

 

Certification provides a common language.

It can be challenging to earn security certifications, but they can simplify your security efforts. We don’t have to reinvent the wheel because they give us a common framework. Through the Comisión Nacional Bancaria y de Valores, Fondeadora obtained a full banking license in Mexico last year. Despite not requiring an international certification, Mexico’s national requirements overlapped with ISO27001’s requirements.

 

Certifications are only a starting point.

In building robust and trustworthy security mechanisms at your startup, doing the bare minimum to satisfy regulators and partners will only get you so far.

 

As threats evolve, so will the requirements for these certifications, warns Boucher. The best approach is to start with credentials and make security an integral part of the culture and product of your company, rather than going for the lowest common denominator.

 

Change of mindset

In my experience working with C-level executives, the most critical thing you can do is change your mindset. Entrepreneurs are addicted to the oxygen of growth and innovation, and focusing on certifications may cause a young, nimble company to become bureaucratic and inefficient. However, these certifications can also enable you to pursue more significant partnerships and take on even greater risks.

After obtaining the certification, you will have laid the groundwork for growth opportunities you may never have experienced otherwise. A prenuptial agreement is a kind of like a marriage built on trust. These relationships must continue long after the honeymoon is over.

0 Comments

Cyber Asset Management Overwhelming IT Security Teams

IT security teams are overwhelmed by cyber asset management. As corporate assets are being moved to cloud storage, IT security management is being strained to the breaking point as larger attack surfaces are created to expose organizations to increasing cyber risks.

API-first, cloud-first, and digital transformation initiatives are rapidly reshaping the enterprise technology ecosystem. Consequently, cybersecurity suffers.

Security professionals can no longer handle the asset lifecycle using traditional, manual approaches due to the growing complexity of modern attack surfaces.

 

Workload unprecedented

 

Modern security teams manage more than 165,000 cyber assets, such as cloud workloads, devices, network assets, applications, data assets, and users. Over 120,000 security findings are accumulated in the backlog of security teams, which are overworked, understaffed, and underskilled.

 

Key Findings

 

In the enterprise, cyber assets vastly outnumber employees. On average, an organization has more than 500 cyber assets per employee. Successful security requires automation.

 

Typically, organizations have a device ratio of 110:1 between employees and devices. Security teams manage an average of 32,190 devices. Almost 90 percent of modern devices involve the cloud. Only 1 percent of net assets are static IP addresses, while 56 percent are network interfaces. A dynamic attack surface requires new, automated security approaches.

 

A Look at the Numbers

 

Three hundred seventy-two million security findings were collected from 1,272 organizations, including enterprises, mid-market organizations, and small businesses.

90% of device assets in a modern organization are cloud-based. Less than 10 percent of all devices are physical devices, such as laptops, tablets, smartphones, routers, and IoT hardware.

As a result of the pandemic, businesses turned to cloud technology to support remote work and maintain some semblance of normalcy.

 

Pay attention to the cloudy forecast.

 

Security teams often overlook the indirect relationships between users, devices, networks, and critical data. According to the report, only eight percent of queries requested JupiterOne to analyze second or third-degree relationships between assets.

According to SCAR, cloud-native security tools are needed for automated decision-making and data-driven security. Having complete visibility of their cyber asset landscape and asset relationships will significantly benefit security teams.

 

second-degree or third-degree relationships between assets, noted the report.

Organizations need to invest in cloud-native security tools that allow for automation and data-driven decision-making, SCAR recommends. This will help security teams gain true visibility of their cyber asset landscape and asset relationships

0 Comments

Killware: The most dangerous Evolution of Ransomware

“Classic” ransomware attacks encrypt a victim’s data and then demand a ransom to decrypt it. Cybercriminals began forcing victims to pay ransom not only to get their data back but to keep it from being released or sold publicly. Businesses will continue to be attacked by threat actors who will mutate.

 

1. Killware raises the alert level in the healthcare industry ⛑

Killware is a ransomware attack that can result in physical harm, including death, if a ransom is not paid. Cybercriminals are raising the stakes in this manner to put more pressure on victims to pay the ransom. The attack on Springhill Medical Center in Alabama demonstrated just how detrimental killware could be.

 

In the worst-case scenario, cybercriminals may be able to manipulate data or even the way a device works if they hack into the WiFi networks or systems to which these devices are connected. This could potentially expose the PII of millions of users or even be deadly.

 

2. Fighting this new threat with good security hygiene 🔐

To protect against potential killware attacks, organizations need to take the proper precautions and practice good cybersecurity hygiene, regardless of industry. Fortunately, most IT security teams should find that they are on their way to a powerful killware defense, as the strategies necessary to defend against this new type of threat aren’t that different from what organizations should do to guard against other types of cyberattacks.

 

Here are four things to keep in mind:

2.1 Focus on security basics — they form the basis of a comprehensive cyber defense program.

2.2 Integrate application security into the development process from the beginning

2.3 Develop a threat model and enforce it.

2.4 Construct an incident response (IR) plan and practice it.

 

3. Seeing the bigger picture 👣

Successful kill-ware attacks will likely attract the attention of the US government and law enforcement agencies, and they will be forced to respond. Cybercriminals don’t want that kind of publicity. Ultimately, they do not wish for government scrutiny or to take lives, which I believe will keep this threat at bay.

0 Comments

5 steps to a successful security assessment

In an organization, security is everything. It is advisable to improve your security resiliency and performance and be prepared for the future.

 

It is imperative to identify all critical devices, applications, and networks vulnerable to internal and external security vulnerabilities when assessing your company’s security position. An enterprise network should have a zero-trust architecture, in which no one, no device, and no application should be trusted by default, whether it’s an internal network or an external network.

 

A firm’s security posture, including infrastructure and processes, can be evaluated effectively by following these five steps:

 

1. Identify the gaps in technology 

As security threats evolve, they become more damaging and more effective. Thus, security technology must also evolve constantly to keep up with the latest threats. A crucial part of your defense strategy should be evaluating the technology you have been using for four- or five-plus years, enabling you to become more resistant to external threats.

 

2. Utilize best-in-class standards 

Utilize time-tested approaches and methodologies based on industry standards and practices, such as the National Institute of Science and Technology (NIST) and the International Organization for Standardization (ISO), when evaluating your company’s threats, vulnerabilities, and potential penetration points. Using these best-in-class approaches, you can ensure that your applications, data, and systems are protected.

 

3. Ensure compliance requirements are met 

There are many regulations and standards that organizations must abide by, including PCI-DSS, HIPAA, SOX, and GLBA. Both internal and external rules must be followed. Your company likely works with many partners, vendors and/or customers who have their compliance requirements. Ensure that all your internal and external data is protected in a security assessment to avoid non-compliance costs.

 

4. Evaluate your security management resources

Recruiting and retaining senior-level security professionals can be challenging. External expert support is an option to consider. CISO-as-a-Service options allow executives to focus on other business objectives by training the appropriate person(s) internally or overseeing security ultimately.

 

5. Develop a remediation roadmap 

Security experts are often called in only after an organization has been breached; this can be expensive and time-consuming. By having policies and processes in place ahead of time, staff will know what to do in a security breach and act accordingly (e.g., who needs to be notified). Set up scenarios and simulate real-world incidents and respond to ensure you know what steps to take across the organization.

 

Apart from these five steps, there are some critical questions that modern organizations should regularly revisit, including:

 

  • Are you aware of our organization’s security posture and associated risks?
  • Are your employees security-conscious?
  • How mature is your cybersecurity?
  • Can we meet the Cybersecurity Maturity Model?
0 Comments

Will digital collaboration tools take over business email ?

Even though email remains the primary and foundational communication tool in the business world, tools like Microsoft Teams and Slack have diminished its importance in some circumstances.

Here is why and how email will play a larger role in business communications in the near future.

 

Where email falls short, collaboration platforms excel

In the 1970s, email was invented, and it exploded once the internet became accessible in the mid-1990s. The underlying framework and use of digital messaging has remained largely the same even though email went from a purely text-based communications medium to one that supports written text, images, and video. As a result, several aspects of email continue to plague businesses and users, including:

  • Complex and difficult-to-manage group and team email threads;
  • Malware and phishing risks are rampant;
  • Instant messaging is not available for one-on-one communication or group collaboration in real-time;
  • Collaboration tools and services are not well integrated with email platforms.

It is not surprising that collaboration providers have exploited these shortcomings to offer tools that have become extremely popular as of late. Some of these collaboration platforms include:

  • Communication threads that can be organized easily by one-on-one, team, and group;
  • Communication in real time using IM, team chat, voice, video, presence, and file sharing;
  • Platforms that are built with security in mind

 

The ubiquitous nature of email is its ace in the hole, but for how long?

With literally dozens of popular IM and collaboration platforms, it’s highly unlikely that everyone with whom a business needs to communicate and collaborate uses the same platform vendor

Microsoft, Slack, Cisco, Google, and Zoom are collaborating to develop cross-platform compatibility, allowing users to communicate while using different products. Even though this type of integration is still in its infancy and will encounter some roadblocks along the way, it’s likely that users of the most popular collaboration tools will soon be able to communicate, no matter what platform they are using.

 

Is business email going away anytime soon?

In spite of this, it’s unlikely a business of any size will completely abandon email in favor of modern collaboration tools. Nevertheless, email’s role in business communications will change.

0 Comments
Posts pagination
Send a Message