What Will Cybersecurity’s ‘New Normal’ Look Like?


The coronavirus pandemic has forced changes for much of the business world, cybersecurity included. What can we expect going forward?

From the way restaurants operate to how sports are played, many people expect life to operate a whole lot differently in the pandemic’s aftermath. The big question for us, though, is what will the new normal be for those in cybersecurity?

“I think it’s worth pointing out that there’s only two ways security changes: a fundamental change in the business environment – because security is there for business – or if the threat changes,” says Bryson Bort, founder of SCYTHE and GRIMM, and co-founder of the ICS Village. “On the first point, clearly business will be different going forward. I think we finally crossed a Rubicon for remote workers, which changes the threat surface.”

He’s not alone in seeing a dispersed workforce as a significant change agent.

“When we deal with the new normal, no company that I’ve talked with has plans to bring the full workforce back in 2020, if ever,” says Kiersten Todt, managing director of the Cyber Readiness Institute. Even if some critical functions flow back into centralized offices, she explains, it’s unlikely that every employee who worked in an office in 2019 will be back in that office in 2021. That will create a “hybrid” workforce for most enterprise organizations.

“How do we secure the hybrid workforce? We combine the remote workforce with the secure workspace,” Todt explains. “Creating a unified cyber infrastructure that’s secure across the hybrid environment is critical.”

For that unified cyber infrastructure to be effective, it will have to satisfy a number of needs.

“We are still looking at the same fundamental issue: balancing user experience with security,” says Anton Klippmark, product manager at BehavioSec. But, as other experts have said, those fundamental issues will be dealt with in a changed environment.

“Our new normal is that organizations can no longer have a standard definition and expectation that a workspace is where application access happens,” explains Robert McNutt, CTO at Forescout Technologies. He says this shift in definition creates a shift in how organizations must approach protecting the enterprise.

Device Access on the ‘Granularity of Our Human Nature’
The move away from the primacy of a central office “… places a large emphasis on [devices], which could be located anywhere in the world, instead of the building or network it came from,” McNutt says. “[As a result], organizations will have to rethink their strategies for access control and identity assurance.”

Klippmark agrees.

“In the digital world, we’ve focused more on trusted devices and IP addresses than validating the actual person behind the screen,” he says, but that will need to change. “A new normal should be built more around granularity of our human nature instead of binary questions, like whether that particular device has been seen before or not.”

It also should ensure every point of access can prove identity, compliance, and configuration assurance, McNutt adds. Any environment that sees two separate vectors – users and applications – coming together at a single point (or device) will see that device become the point of greatest strength (or weakness) in the infrastructure, he says.

Trustworthy IoT
The emphasis on devices reaches its zenith in an environment where the devices don’t have traditional users: the Internet of Things (IoT.)

“All the things that have made devices insecure are larger,” Bort says. “It’s not the privacy of the webcam that’s the problem – it’s the fact that the webcam can be used as a pivot point.” The webcam, then, isn’t just secured for its own sake but because the small, headless device can so easily become a point of entry into the larger enterprise network.

The security landscape for the IoT has been evolving for some time, notes MediaPRO chief strategy officer Lisa Plaggemier.

“In a new normal, companies will design hardware and software with security in mind, not as an afterthought,” she says, pointing out how, in the wake of a series of very public IoT exploits (including last year’s Nest camera exploit), vendors have begun strengthening the authentication controls in IoT devices due to customer demand and regulatory pressure. “A new normal would mean security becomes a product attribute that companies market to consumers, and consumers seek it out in the products they buy.” 

Privacy Rights for Employees
Another attribute that employees working from home demand is respect for their data privacy. Recent years have seen privacy become a board-level concern, says Robert Waitman, director of Cisco’s Security and Trust Organization, and the coronavirus pandemic has only accelerated the move of privacy into the “critical” category.

“The top three concerns are that data might be used for an unrelated purpose, that it might be shared without permission to third parties, and that data only be kept as long as it’s needed,” he explains.

Most of the attention to data privacy has been given to customer data, but the work-from-home movement has seen the attention expand to include employees.

“The employee protections are different than the consumers’ [protections],” Waitman says. “At the core of it, though, employees are people, and so many of the same ideas and protections apply to employees.”  

Ultimately, experts agree that the challenges of the new normal also present an opportunity for companies to “get it right” when expanding their security and privacy practices to cover a widely distributed workforce.

“Building trust is critical – now’s the time to be building trust,” Waitman explains. “This is where companies need to pay attention.”

Related Content:

 

 

 

 

Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that “really bad day” in cybersecurity. Click for more information and to register for this On-Demand event. 

Curtis Franklin, Jr. has been writing about technologies and products in computing and networking since the early 1980s. He has contributed to a number of technology-industry publications including Dark Reading, InformationWeek Enterprise Efficiency, ChannelWeb, Network … View Full Bio

 

Recommended Reading:

More Insights





Source link

Recent articles

FIFA Women’s World Cup 2019™ – News – Groenen: Judo prepared me for the pressure of big games

One year ago today Jackie Groenen brilliantly settled a France 2019...

Blue Fireworks over the Liberty Belle

The COVID-19 pandemic have forced the annual 4th of...

Here’s every new item you can get from Pirate Gulliver in Animal Crossing today

Animal Crossing's resident seagull has turned to a life of piracy. Help him out and you can join him. Sort of Source link

Live Coronavirus Updates: U.S. Leaders Change Course

Boris Johnson, Britain’s prime minister, who said earlier this week that it was Britons’ “patriotic duty” to go to the pub when they...

European stocks lifted by data, but U.S. holiday keeps a lid on action

European stocks were set to break a four-session win streak on Friday, with upbeat economic...

Leave a reply

Please enter your comment!
Please enter your name here