As the world is increasingly connected, cyber-attacks can go beyond data theft to disrupt critical infrastructure across industries. With the growing threats from sophisticated hackers, the cybersecurity players are witnessing a transformational shift pertaining to the design and implementation of security products and services. While implementing a robust cybersecurity strategy is vital, organizations need people who have mastered the skills to secure networks and to protect systems, computers, and data from attack, damage and/or unauthorized access.
In your experience as a CISO, what are the implications of technology in your industry, and how are they affecting cybersecurity protocols?
The choices we make today have significant implications. The hardest one among them is the management of the DevOps, which involves developing applications and new technologies. While the DevOps teams need to work on Agile, it becomes complex for us to keep in mind the speed and security of the developments, side-by-side. Hence, I believe maintaining agility alongside ensuring that the development is taking place in a secure manner is an uphill task.
What are the challenges enterprises face while developing technologies in a secure and compliant way?
The foremost challenge is to attain agility while maintaining security hand-in-hand. The enterprises need to develop the products or technologies in a rapid fashion, as they have to go live with their unfinished prototypes for the testing phase, which cuts down their need to redevelop the product once again. Understanding this, most enterprises are nowadays executing their developments in a productive environment besides connecting their internal productive environments with external cloud services. While keeping the data secure is imperative, the challenges boil down to managing the data efficiently.
While initiating technology transformation for attaining a seamless workflow for DevOps, what will be some of the best practices to engage in?
Vontobel has implemented a process called First Cut Analysis, in which every newly implemented technology, application or cloud service is first assessed for its security impacts. This allows us to decide which professionals are to be included in the new technology project or application development. We tighten security from the earliest possible moment by assigning an in-charge in the development or implementation process. Therefore, without a completed First Cut Analysis no new systems or technologies can be implemented at Vontobel. Based on this initial impact analysis, the security officer can decide whether the IT basic protection is sufficient or whether a security concept with an in-depth risk analysis and additional security measures has to be elaborated. Our service integration process also requires new or revised applications and systems to be thoroughly tested and formally approved by the security officer before they can be used productively by our customers or employees. This helps us maintain cyber security in the long term.
These days, security officers are no longer like policemen. Rather, they are advisors who support ensuring the fulfillment of regulatory aspects and managing the compliance. In other words, they help companies to work safely and comply with legal requirements.
What are some of the changes you would like to see in the way things are currently performed, and how would you go about implementing those changes?
We always do our best in whatever we do. To cope up with the ever-changing landscape of cybersecurity, we analyze the changes time and again before deciding on the requirements for creating new measures. Additionally, we monitor the systems, processes, accessories, and more. This is why we have recently implemented a Security Orchestration, Automation and Response system (SOAR), which is covering all these monitoring tasks and automating the incident handling processes so that we do not need to manually take care of the smallest of security incidents.
"These days, security officers are no longer like policemen. Rather, they are advisors who support ensuring the fulfillment of regulatory aspects and managing the compliance. In other words, they help companies to work safely and comply with legal requirements"
Is there any advice you would like to convey to other CISOs?
Be an enabler! Besides knowing how important cybersecurity is, you need to work in a pragmatic way and you should be more of an advisor, rather than a police officer. This way, when people come to you and ask your advice, you are always involved in changes or innovations from the very beginning.