Why we need a mindset shift to combat the new wave of supply-chain cyberattacks

This article is brought to you thanks to the collaboration of The European Sting with the World Economic Forum.

Author: Dani Michaux, EMA Cyber Leader and Head of Cyber Security, KPMG Ireland

• The digital ecosystem has expanded in response to changing needs during the pandemic.

• There is a current rise in cyberattacks, often on vulnerable digital supply chains.

• Organizations must overhaul their risk-assessment procedures and widen the scope of their cybersecurity strategy.

Over the past year, we have seen major geopolitical changes driven by the impact of COVID-19, forcing organizations to strengthen their resilience approaches. The realization has also dawned that the world, as we once knew it, has changed.

A new operating model is emerging based on various restructuring activities, accelerating digitalization initiatives, alternative partnership models, and a sharper focus on core activities. As organizations pivot, it is important to reflect and consider the risks that may emerge as part of these major changes.

Prominent among these challenges is the need to safeguard the new digital ecosystem, which underpins this transformation, from cyberattack and the breakdown of our information infrastructure.

The digital world kept turning in 2020

Cybersecurity is key to achieving the Fourth Industrial Revolution. COVID-19 has accelerated that revolution and the use of digital and cloud technologies in both the public and private sectors. Those technologies are now fundamental to our society.

Sadly, the pandemic has also shown that organized crime is opportunistic and ruthless in its exploitation of events to gain financial advantage. Thus, we have witnessed a steady stream of high-profile cyberattacks on private enterprise, government and social media platforms during the year.

Nevertheless, it’s encouraging to observe the pace at which organizations rolled out robust digital infrastructure during difficult times, and the collaboration that we saw amongst business, technology and security teams to safeguard these rapidly deployed services. It shows us how these often-siloed parties can work together effectively to introduce secure innovation at market speed.

COVID-19 has given the remit of Chief Information Security Officers (CISO) a new dimension. Suddenly, they must concern themselves with effectively managing thousands of home-working sites, personal devices and a rapid shift to the cloud. The CISO has moved from securing corporate IT boundaries to a broader view of enterprise security.

The timescale for many cloud-migration projects has collapsed from years to months in the race to meet fast-changing business needs. Hyperscale cloud providers are increasingly dominant and intently focused on security.

The rise of supply chain attacks

Political and business leaders have become alert to the global interdependence of many critical functions and the nature of risk that cross-border supply chains have. The pandemic made these murky operational and systemic risks real and has given people pause for thought.

Supply-chain attacks are not new. However, in the new highly digitalized and interconnected world, they are becoming more prominent. Frequent attacks raise concerns around the ability of business organizations to remain resilient.

A common theme of all of these attacks is the presence of third-party providers of hardware, services or software. In complex infrastructure, set-ups that include rapid pivoting to new environments and dependencies on third-party suppliers are common.

Third-party providers are targeted with the ultimate aim of reaching a bigger mark. The methods and duration of the compromise vary, but there are some common patterns. These include exploiting rapid deployment challenges, looking for exposures in security controls as firms shift rapidly to new technology.

Lessons can be learned from sectors like oil and gas, where human safety is on top of executive agendas and assumptions are constantly challenged. It starts from the proposition that you can’t assume that anything will work in the event of a major incident. That’s the culture of resilience that should be in place in all organizations. It is a question of broad operational resilience, not just of IT systems and security.

A different risk-assessment mindset

As we look into the future of highly digitalized and scalable environments, resilience will likely be paramount and non-negotiable and may rely on the stability of the end-to-end supply-chain. However, it will also require a mindset shift in the approach to data security.

The hunt will be on for cybersecurity orchestration opportunities, for robotic process automation around manual security processes, for more integration with IT key workflows, and for new managed service and delivery models. Third-party security may also need new models for more dynamic risk management and scoring, including better tracking of supply-chain stresses.

Of course, the commonplace SOC 2 and ISAE 3402 assessments may play a role as firms seek to provide evidence once to satisfy a myriad of client questions over their cybersecurity. However, we can also expect to see the rise of “utility models” where intermediary organizations aggregate together client assurance requirements to undertake a one-size-almost-fits-all assessment of suppliers’ cybersecurity.

Over the last few years, firms have also sprung up offering risk-scoring services based on scanning of a firm’s internet-facing services, monitoring for data disclosures in the shady corners of the internet, and alerting customers that a supplier may have a potential problem, which they may not be aware of or the supplier has yet to disclose.

As outsourcing of non-core business services accelerates, it is worth asking: Do you really pay sufficient attention to your dependency on third parties who are now integral to your security and resilience as a business?

As we look to the future, organizations should move from just thinking about enterprise firewalls, antivirus software, and patching policies to considering approaches to security, which starts from the premise that a company’s success is based upon its reputation – ultimately a manifestation of the trust others have in its offerings.

What is the World Economic Forum doing on cybersecurity

The World Economic Forum’s Centre for Cybersecurity is leading the global response to address systemic cybersecurity challenges and improve digital trust. We are an independent and impartial global platform committed to fostering international dialogues and collaboration on cybersecurity in the public and private sectors. We bridge the gap between cybersecurity experts and decision makers at the highest levels to reinforce the importance of cybersecurity as a key strategic priority. World Economic Forum | Centre for Cybersecurity

Our community has three key priorities:

Strengthening Global Cooperation – to increase global cooperation between public and private stakeholders to foster a collective response to cybercrime and address key security challenges posed by barriers to cooperation.

Understanding Future Networks and Technology – to identify cybersecurity challenges and opportunities posed by new technologies, and accelerate forward-looking solutions.

Building Cyber Resilience – to develop and amplify scalable solutions to accelerate the adoption of best practices and increase cyber resilience.

Initiatives include building a partnership to address the global cyber enforcement gap through improving the efficiency and effectiveness of public-private collaboration in cybercrime investigations; equipping business decision makers and cybersecurity leaders with the tools necessary to govern cyber risks, protect business assets and investments from the impact of cyber-attacks; and enhancing cyber resilience across key industry sectors such as electricity, aviation and oil & gas. We also promote mission aligned initiatives championed by our partner organizations.

The Forum is also a signatory of the Paris Call for Trust and Security in Cyberspace which aims to ensure digital peace and security which encourages signatories to protect individuals and infrastructure, to protect intellectual property, to cooperate in defense, and refrain from doing harm.

For more information, please contact us.

This mindset leads to embedding security into products and services but, more than that, it focuses attention on protecting customers, clients and those increasingly important supply-chain partners. It emphasizes stewardship of the trust they place in you when they share their most sensitive data or show their willingness to become dependent on you.

No organization is an island, and all of us are part of an increasingly hyperconnected world. In that world, trust in supply chains and ecosystem relationships matters more than ever.