Topics In Demand
Notification
New

No notification found.

The WFA framework: Helping CISOs stay on top of their distributed work environment
The WFA framework: Helping CISOs stay on top of their distributed work environment

459

0

The trend is loud and clear: There is no stopping digital transformation. The pace of technological change we are dealing with is unprecedented. This is indeed good, but it comes with its challenges and security is one of them.

Many digital assets and employees are no longer within well-defined organizational perimeters as the Work from Anywhere (WFA) model takes root – which is leading to an increase in cybersecurity threats targeting the user identities and endpoints. As a result, Chief Information Security Officers (CISOs) are investing more in authentication technology such as multi-factor authentication. They will leverage AI and automation to analyze risk, prevent breaches, and flag insider threats. Many will take stock of their cloud security and practically every organization will educate employees about phishing and the importance of data privacy and security.

But this is an uphill task given that the sudden acceleration of digital transformation came as a surprise with COVID—19 and organizations were not prepared for it. Remote WFA practices and operations were hurriedly implemented in many organizations, with little or no thought to security. Now, there is an urgency to focus on the speed with which CISOs and their organizations detect and respond to new threats.

The key to success lies in implementing authentication and authorization with no implicit trust. Trust can no longer be established based upon the physical location of the user or the device. Therefore, organizations need to build a Zero Trust architecture and implement a Zero Trust policy. The first step toward Zero Trust security is the implementation of adaptive Multi-Factor Authentication (MFA). Compromise of identity is the first step in many breaches. Equally important is to gain complete visibility on user endpoints. The adoption of cloud web gateways and Endpoint Detection and Response (EDR) and similar technologies are helping organizations to gain visibility.

There are several business environments where remote working or operations were practically unknown before the pandemic broke out. These include many universities, hospitals, call centers, BPOs, and banks. While every business needs to educate users in the need for security, these types of organizations running remote operations for the first time should bring pinpoint focus to people-related education programs. Our recommendation is for using game-based training to make the learning experience memorable, engaging, and effective and reinforce it with simulation tests and mock exercises. Training employees and users in social engineering and securing the home network should be a priority. The home network is the new corporate network now. Simple things like how to secure home Wi-Fi and personal devices can prevent incidents. Many organizations are working towards making security a part of organizational culture.

Here are other techniques and processes that CISOs must follow, to improve security:

  • Build a holistic approach for your cloud adoption. Security should be at the forefront, tightly integrated into the design, and not an afterthought.
  • Use managed devices with endpoint security controls for remote access.
  • Companies permitting BYOD shall implement tools to get complete visibility without compromising privacy aspects.
  • Control access to sanctioned and unsanctioned apps.  
  • Apply software/application and OS security updates on time. Gone are the days of n-1 or 96% patching. 100% security patching is the new normal. Measure and improve your time to patch.
  • Identify vulnerabilities and have a program to mitigate them on each device on time
  • Review joiner-mover-leaver process in light of remote working practices.
  • Ensure data stored in laptops is backed up or synced up on cloud storage. Most organizations already have the policy to encrypt storage on mobile devices.
  • Laptops, applications, and users have moved out of the office. Applications have moved out of the boundaries of data centers. Applications are accessed from mobile phones and in many cases personal laptops. Organizations were able to maintain visibility when these assets were within the physical boundaries of the office. Now, organizations must implement solutions to gain visibility across endpoints, servers, applications, and cloud environments.  
  • Finally, have a plan to detect and provide a response for security breaches. Many organizations are struggling with the information overload in their Security Operations Centre (SOC). Silos may have come up as companies started embracing the cloud, including containers and serverless environments. SOC modernization should be a priority with a focus on adopting latest the technology that can collect and correlate deep activity data across multiple vectors such as email, endpoints, servers, cloud workloads, a serverless environment, networks, and IoT. Complete visibility and automation of security operations activity is the key. The response plan should not be limited to CIO and CISO functions. It should include all stakeholders and top management of the company in such plans. Perform periodic testing of such plans.

Without a doubt, organizations will increase the share of their IT budgets for cybersecurity. The numbers say it all: Forecasts suggest that spending on cybersecurity products and services will exceed $1.75 trillion cumulatively in the five years between 2021 and 2025. The budget and approach your organization takes to improve cybersecurity will determine how resilient it will be.

However, making investments to strengthen security practices is only one component in delivering the outcomes organizations aim for in a post-pandemic WFA world.

 

 

About the Author:

Author image
Devender Kumar
CISO, ITC Infotech

 

 Devender is Chief Information Security Officer (CISO) at ITC infotech. He has 25+ years of experience in the area of Cyber Security, Information Risk Management, and delivering Security Services. In these years, he has developed expertise in Information Security audits, Cyber Security Strategy, Governance, Risk management and Compliance. Having held leadership positions with Financial Services and IT Services companies, he has helped many organizations build cyber security resilience capability. He holds an Executive MBA from IIM K. With a blend of technology and business knowledge supplemented by experience in security, risk, and compliance, he has supported security enabled digital transformations and way forward.


That the contents of third-party articles/blogs published here on the website, and the interpretation of all information in the article/blogs such as data, maps, numbers, opinions etc. displayed in the article/blogs and views or the opinions expressed within the content are solely of the author's; and do not reflect the opinions and beliefs of NASSCOM or its affiliates in any manner. NASSCOM does not take any liability w.r.t. content in any manner and will not be liable in any manner whatsoever for any kind of liability arising out of any act, error or omission. The contents of third-party article/blogs published, are provided solely as convenience; and the presence of these articles/blogs should not, under any circumstances, be considered as an endorsement of the contents by NASSCOM in any manner; and if you chose to access these articles/blogs , you do so at your own risk.


ITC Infotech is a leading global technology services and solutions provider, led by Business and Technology Consulting. ITC Infotech provides business-friendly solutions to help clients succeed and be future-ready, by seamlessly bringing together digital expertise, strong industry specific alliances and the unique ability to leverage deep domain expertise from ITC Group businesses. The company provides technology solutions and services to enterprises across industries such as Banking & Financial Services, Healthcare, Manufacturing, Consumer Goods, Travel and Hospitality, through a combination of traditional and newer business models, as a long-term sustainable partner. ITC Infotech is a wholly owned subsidiary of ITC Ltd. ITC is one of India’s leading private sector companies and a diversified conglomerate with businesses spanning Consumer Goods, Hotels, Paperboards and Packaging, Agri Business and Information Technology. For more information, please visit: http://www.itcinfotech.com/

© Copyright nasscom. All Rights Reserved.