Why we need a mindset shift to combat the new wave of supply-chain cyberattacks

(Credit: Unsplash)

This article is brought to you thanks to the collaboration of The European Sting with the World Economic Forum.

Author: Dani Michaux, EMA Cyber Leader and Head of Cyber Security, KPMG Ireland

• The digital ecosystem has expanded in response to changing needs during the pandemic.

• There is a current rise in cyberattacks, often on vulnerable digital supply chains.

• Organizations must overhaul their risk-assessment procedures and widen the scope of their cybersecurity strategy.

Over the past year, we have seen major geopolitical changes driven by the impact of COVID-19, forcing organizations to strengthen their resilience approaches. The realization has also dawned that the world, as we once knew it, has changed.

A new operating model is emerging based on various restructuring activities, accelerating digitalization initiatives, alternative partnership models, and a sharper focus on core activities. As organizations pivot, it is important to reflect and consider the risks that may emerge as part of these major changes.

Prominent among these challenges is the need to safeguard the new digital ecosystem, which underpins this transformation, from cyberattack and the breakdown of our information infrastructure.

The digital world kept turning in 2020

Cybersecurity is key to achieving the Fourth Industrial Revolution. COVID-19 has accelerated that revolution and the use of digital and cloud technologies in both the public and private sectors. Those technologies are now fundamental to our society.

Sadly, the pandemic has also shown that organized crime is opportunistic and ruthless in its exploitation of events to gain financial advantage. Thus, we have witnessed a steady stream of high-profile cyberattacks on private enterprise, government and social media platforms during the year.

Nevertheless, it’s encouraging to observe the pace at which organizations rolled out robust digital infrastructure during difficult times, and the collaboration that we saw amongst business, technology and security teams to safeguard these rapidly deployed services. It shows us how these often-siloed parties can work together effectively to introduce secure innovation at market speed.

COVID-19 has given the remit of Chief Information Security Officers (CISO) a new dimension. Suddenly, they must concern themselves with effectively managing thousands of home-working sites, personal devices and a rapid shift to the cloud. The CISO has moved from securing corporate IT boundaries to a broader view of enterprise security.

The timescale for many cloud-migration projects has collapsed from years to months in the race to meet fast-changing business needs. Hyperscale cloud providers are increasingly dominant and intently focused on security.

Digital supply chains are becoming increasingly complex.
Digital supply chains are becoming increasingly complex. Image: University of Cambridge

The rise of supply chain attacks

Political and business leaders have become alert to the global interdependence of many critical functions and the nature of risk that cross-border supply chains have. The pandemic made these murky operational and systemic risks real and has given people pause for thought.

Supply-chain attacks are not new. However, in the new highly digitalized and interconnected world, they are becoming more prominent. Frequent attacks raise concerns around the ability of business organizations to remain resilient.

A common theme of all of these attacks is the presence of third-party providers of hardware, services or software. In complex infrastructure, set-ups that include rapid pivoting to new environments and dependencies on third-party suppliers are common.

Third-party providers are targeted with the ultimate aim of reaching a bigger mark. The methods and duration of the compromise vary, but there are some common patterns. These include exploiting rapid deployment challenges, looking for exposures in security controls as firms shift rapidly to new technology.

Lessons can be learned from sectors like oil and gas, where human safety is on top of executive agendas and assumptions are constantly challenged. It starts from the proposition that you can’t assume that anything will work in the event of a major incident. That’s the culture of resilience that should be in place in all organizations. It is a question of broad operational resilience, not just of IT systems and security.

A different risk-assessment mindset

As we look into the future of highly digitalized and scalable environments, resilience will likely be paramount and non-negotiable and may rely on the stability of the end-to-end supply-chain. However, it will also require a mindset shift in the approach to data security.

The hunt will be on for cybersecurity orchestration opportunities, for robotic process automation around manual security processes, for more integration with IT key workflows, and for new managed service and delivery models. Third-party security may also need new models for more dynamic risk management and scoring, including better tracking of supply-chain stresses.

Of course, the commonplace SOC 2 and ISAE 3402 assessments may play a role as firms seek to provide evidence once to satisfy a myriad of client questions over their cybersecurity. However, we can also expect to see the rise of “utility models” where intermediary organizations aggregate together client assurance requirements to undertake a one-size-almost-fits-all assessment of suppliers’ cybersecurity.

Over the last few years, firms have also sprung up offering risk-scoring services based on scanning of a firm’s internet-facing services, monitoring for data disclosures in the shady corners of the internet, and alerting customers that a supplier may have a potential problem, which they may not be aware of or the supplier has yet to disclose.

As outsourcing of non-core business services accelerates, it is worth asking: Do you really pay sufficient attention to your dependency on third parties who are now integral to your security and resilience as a business?

As we look to the future, organizations should move from just thinking about enterprise firewalls, antivirus software, and patching policies to considering approaches to security, which starts from the premise that a company’s success is based upon its reputation – ultimately a manifestation of the trust others have in its offerings.

What is the World Economic Forum doing on cybersecurity

The World Economic Forum’s Centre for Cybersecurity is leading the global response to address systemic cybersecurity challenges and improve digital trust. We are an independent and impartial global platform committed to fostering international dialogues and collaboration on cybersecurity in the public and private sectors. We bridge the gap between cybersecurity experts and decision makers at the highest levels to reinforce the importance of cybersecurity as a key strategic priority. World Economic Forum | Centre for Cybersecurity

Our community has three key priorities:

Strengthening Global Cooperation – to increase global cooperation between public and private stakeholders to foster a collective response to cybercrime and address key security challenges posed by barriers to cooperation.

Understanding Future Networks and Technology – to identify cybersecurity challenges and opportunities posed by new technologies, and accelerate forward-looking solutions.

Building Cyber Resilience – to develop and amplify scalable solutions to accelerate the adoption of best practices and increase cyber resilience.

Initiatives include building a partnership to address the global cyber enforcement gap through improving the efficiency and effectiveness of public-private collaboration in cybercrime investigations; equipping business decision makers and cybersecurity leaders with the tools necessary to govern cyber risks, protect business assets and investments from the impact of cyber-attacks; and enhancing cyber resilience across key industry sectors such as electricity, aviation and oil & gas. We also promote mission aligned initiatives championed by our partner organizations.

The Forum is also a signatory of the Paris Call for Trust and Security in Cyberspace which aims to ensure digital peace and security which encourages signatories to protect individuals and infrastructure, to protect intellectual property, to cooperate in defense, and refrain from doing harm.

For more information, please contact us.

This mindset leads to embedding security into products and services but, more than that, it focuses attention on protecting customers, clients and those increasingly important supply-chain partners. It emphasizes stewardship of the trust they place in you when they share their most sensitive data or show their willingness to become dependent on you.

No organization is an island, and all of us are part of an increasingly hyperconnected world. In that world, trust in supply chains and ecosystem relationships matters more than ever.

the sting Milestones

Featured Stings

Can we feed everyone without unleashing disaster? Read on

These campaigners want to give a quarter of the UK back to nature

How to build a more resilient and inclusive global system

Stopping antimicrobial resistance would cost just USD 2 per person a year

Europe should make voice ‘more heard’ in today’s ‘dangerous world,’ says UN chief

The revenge of the fallen

Syrian crisis is ‘clearest example’ of foreign investment in terrorism, Deputy Prime Minister says at UN

This Syrian national has been trapped at Kuala Lumpur airport for 3 months

European Commission calls on national political parties to join efforts to ensure free and fair elections in Europe

Back to the Basics: Primary Healthcare

Learning lessons from across Europe – the hidden costs of COVID-19 on lung cancer

Eliminating gender based bias in medicine: the role of medical students

MEPs propose more transparent legislative drafting and use of allowances

Out with the old: Young People transforming Humanitarian Action

Parliament adopts deal to improve quality of tap water and reduce plastic litter

Mergers: Commission clears acquisition of Eaton Hydraulics by Danfoss, subject to conditions

5 ways to #BeatAirPollution

Security spillovers from Trump’s trade wars: China, Germany prepare for global disorder

Iceland’s slowdown underlines the need to fix structural issues

Wirecard: MEPs call for new audit rules, protection for whistle-blowers and EU supervision

Why salaries could finally be on the way up

Estonia: use robust growth to improve income equality and well-being

More funds needed to counter ‘persistent and multi-faceted humanitarian problems’ in Ethiopia

EU prolongs economic sanctions on Russia by six months

New energy security framework will help meet growing needs in East Africa, sustainably – UN economic wing

Postal workers in France are helping elderly people fight loneliness

We are witnessing a revolution in genomics – and it’s only just begun

Why transparency in drug pricing is more complicated than it seems

COP21 Breaking News_04 December: Launch of CREWS, climate risk & early warning systems

Merkel: Nationalism and egoism must never have a chance again in Europe

More funding needed to combat locust swarms ‘unprecedented in modern times’

Global warming: our responsibility

Beware the fragility of the global economy

Commission provides 20 cities with funding for innovative security, digital, environmental and inclusion projects

WHO and UNICEF in campaign to protect 1.6 million in Sudan from cholera

Falling inflation urges ECB to introduce growth measures today

Why are the financial markets shivering again?

‘Great Pacific Garbage Patch’ clean-up project launches trial run: UN Environment

EU labour mobility: Inconvenient truths for everybody

European Parliament and Eurovision sign partnership for European Elections

EU attempts to make new deal with Turkey as relations deteriorate

Technophobe or technophile? We need more conversation about digital transformation

‘Emulate his example’ urges UN chief as world celebrates Nelson Mandela: a ‘global advocate for dignity and equality’

MWC 2016 LIVE: Qualcomm looks to pick up Hamilton’s winning ways

EP and EU ministers agree on Erasmus+ programme for 2021-2027

My experience living with depression and schizophrenia in Thailand

Building cybersecurity capacity through benchmarking: the Global Cybersecurity Index

3 ways to rebuild trust in how we regulate technology

First calls under Horizon Europe to be launched by the European Research Council

Philanthropy must face a reckoning on race in 2021

New UN finance panel to push Global Goals forward

Conditions deteriorating alarmingly in Yemen, warns senior UN official

Commission reinforces tools to ensure Europe’s interests in international trade

EU mobilises emergency assistance for Croatia in the aftermath of devastating earthquake

Commission concludes that an Excessive Deficit Procedure is no longer warranted for Italy at this stage

Better ID card security to curb document fraud

Can we automate our way out of the savings crisis?

5 lessons for the future of universities

Things are bad and getting worse for South Africa. Or are they?

This is why AI has a gender problem

Commission paralysed before the banking leviathan

The world must pull together to stem the urgent crisis in our ocean

Alice in Colombia

The recipe for creativity involves a lot of ideas, and a short break

More Stings?


Speak your Mind Here

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s