As COVID-19 hit, it became clear that going forward, business would be anything but normal. The added strain of the pandemic stretched the bounds of the cybersecurity architecture for many organisations across all industries. A new normal is taking shape. Businesses began to acknowledge that they now must adopt an encompassing defensive posture that elevates cybersecurity and fully understands the risks they face as the number of remote workers increases.
Gartner recently published a 2021 cyber security report that shows important risk trends in cybersecurity. This article discusses what implications these trends have on cybersecurity architecture.
The recently released Gartner report on cyber security highlights what they consider the top eight security and risk trends for 2021.
Trend #1 – Cybersecurity Mesh
The top security and risk trend deals with cybersecurity meshes. A cybersecurity mesh is a modular and decentralized conceptual approach to security architecture. It allows the distributed enterprise to deploy and extend security along composite networks across corporate boundaries and clouds.
COVID-19 accelerated digital business. It also accelerated the trend where digital assets and individuals are working outside of the traditional enterprise infrastructure. This, of course, puts cybersecurity at risk. Around the globe, cybersecurity teams are expected to secure countless types of digital transformation, in addition to newly arriving technologies. Gartner highlights that “A cybersecurity mesh is a modern security approach that consists of deploying controls where they are most needed, in a manner that is composable, scalable flexible and resilient”. This will enable organisations to move forward securely.
These composable services will most likely stretch across landscapes of local data-centers and clouds (hybrid cloud). Prerequisites for a secure and unhampered service orchestration and transit of data are public key infrastructures in every deployment area and a centrally managed Bring Your Own Key Strategy, which keeps the data owner in control of all data. The result being, third parties will not have access to unencrypted data at any time. In the advent of the IoT, the inclusion of “things” into such value nets assumes a prominent role. Secure 5G architectures enable transport security of the communication, mitigate tampering and repudiation, and boost the agile, scalable composability through built-in real-time Service-level-agreement functionality.
The root of trust to such composite services are industry-grade hardware security modules and key management systems which also ensure levels of compliance with industry regulations such as PCI-DSS or eIDAS.
Trend #2 – Cyber-Savvy Boards
As public security breaches increase and security setups become increasingly complex, boards are now paying more attention to their organisation’s cybersecurity. Since cybersecurity is such a risk to the enterprise, boards are forming specialized and dedicated committees to focus on and address cybersecurity issues. These committees are typically led by board members with expertise in security or by a third-party consultant.
However, the reverse view is also important. Agile, auditable and centrally controllable security are the enablers for secure and scalable business models, which increasingly build on customer-centric products, achieved through the orchestration of inhouse and external services, while complying to or exceeding market security criteria. That said, CISOs could expect increased scrutiny, standards and expectations as boards become more cyber-savvy and have higher aspirations for cybersecurity. In turn, CTOs and CISOs become a driving force in the self-disruption and innovation of companies.
Trend #3 – Vendor Consolidation
Having too many security vendors complicates security operations. In “2020 CISO Effectiveness Survey, Gartner found that 78% of CISOs have 16 or more tools in their cybersecurity vendor portfolio, while 12% of CISOs have 46 or more tools”. Organisations recognize the need for vendor consolidation to increase security while reducing costs. Bigger security vendors are responding to this need with better-integrated products.
Utimaco has been proactively aligning to this market requirement through an ambitious M&A strategy, surgically complementing its product portfolio with best in class players like Atalla, Geobridge, myHSM, or exceet Secure Solutions. Utimaco’s vendor-agnostic solutions allow for a centrally managed security architecture across ALL applications.
Trend #4 – Identity-First Security
Identity-first security has been a gold standard for a while, however it was not the focus of organisations with more traditional setups. With COVID-19, more businesses shifted to remote work, along with technical and cultural shifts. Identity-first security is now trending as organisations address their need for remote information workers and those working on-premises.
One decisive technology in an identity-first security strategy is the digital signature. Such signatures are not limited to documents such as PDFs. They need to be applied across all digital communication including mail or ERP programs. Code signing makes sure that the IT infrastructure itself remains uncompromised. A second key technology in the identity first context is multi-factor authentication.
Trend #5 – Managing Machine Identities as a Critical Security Capability
Organisations are seeing an increased number of nonhuman entities in their digital transformation journeys. A vital part of their security strategies is managing machine identities, including workloads (e.g., containers, applications, services) and devices (desktop computers, mobile devices, IoT/OT devices). As the number of devices continues to grow, organisations will need to develop an enterprise-wide strategy to manage machine identities, digital certificates, and confidential data to better secure their digital transitions.
Secure Machine Identity Management starts during the production of components, with key injection into the Electronic Control Unit (ECU). Even non-electronic components like tires can receive a digital ID. Throughout the component’s complete life-cycle, keys can be tracked, rotated and eventually de-commissioned. The connection with the injected keys and the private key in the monitoring and managing Hardware security module creates the basis for unambiguous and unfakeable identities, which can then be part of clearly defined workflows and management processes.
Trend #6 – Remote Working is Now Just Work
“According to the 2021 Gartner CIO Survey, an average of 64% of employees are able to work from home, and two-fifths actually are working from home”. COVID-19 has increased the shift to moving more employees to permanent remote working. However, this requires a total overhaul of policies, tools, and approved machines to adequately mitigate the increase in security risks.
Such end-to-end processes are by default decentralized. They rely on resilient identities (which at times may require qualified certificates in compliance with eIDAS), protected communication channels and encrypted data at rest and in transit. Identified infrastructure such as the employee’s computer ensure that corporate processes cannot be hijacked by third parties and data cannot be intercepted.
Trend #7 – Break and Attack Simulation
Break and attack simulation (BAS) is an emerging new market that helps organisations validate their security postures. BAS offers continuous testing and validation of an organisation’s security controls. It also tests its vulnerability against external threats, offers specialized assessments to highlight risks to assets, such as confidential data, and provides training that allows security organisations to mature. The tools BAS provides will help identify security issues that relate to the efficacy of security controls, issues with configuration, and detection capability. This will enable near real-time security assessments across a range of attack techniques.
Utimaco’s HSM based infrastructures come with included simulators. These allow for an initial verification of the security backend. Connecting the complete infrastructure to a BAS simulator will allow it to continuously assess the architecture, even as threat portfolios evolve. Latent leaks can be discovered and closed before any threat scenario materializes.
Trend #8 – Privacy-Enhancing Computation Techniques
Emerging privacy-enhancing computation (PEC) techniques protect data while it is in use versus while it is in motion or at rest. This enables secure data processing, cross-border transfers, sharing and analytics, regardless of whether the environment is trusted. As this technology continues to rapidly transform from academic research to real projects that deliver real value, it will enable new forms of computing and sharing while reducing the risk for data breaches.
Where Utimaco Stands in the Light of Gartner 2021 Security and Risk Trends
Anticipating the evolution in Information Technology, decentralization of work infrastructures and the modularization of meshable service architectures, Utimaco has spent the recent years reinventing their security solutions. Extensive research and innovation and an ambitious M&A strategy converted the company to a leading solution provider for end-to-end security across hybrid clouds in many solution critical infrastructures.
Originating in banking security in the 1970, the Utimaco Group has expanded to include all disruptive industry segments such as Finance, Automotive, Health, Manufacturing, IoT, Cloud, Defense, Aviation and more.
Scalable architectures allow for setting up security meshes along decentralized business models, providing companies with the required agility to dynamically respond to evolving customer needs. Delivering holistic security solutions allows customers to set up a consolidated and centrally managed security infrastructure alongside applications of multiple vendors and in hybrid locations. Innovative solutions such as containerized Hardware Security Infrastructures allow the execution of global strategies with security customized to the needs of various industry and business segments, including areas of jurisdiction.
Investing into security today means looking at a horizon of 10 years or more. Utimaco is dedicated to providing infrastructures that go beyond current security requirements. Our solutions are crypto-agile, which means that they are able to dynamically adapt when the nature of threats evolves.
Last but not least, Utimaco’s solutions bring compliance with important regulations and standards, providing companies with the legal assertion needed to focus in an unhampered way on developing their business strategy and ongoing requirements.
Blog post by Dr. Ulrich Scholten
Gartner, ‘Top Security and Risk Management Trends 2021’, Peter Firstbrook, Zaira Pirzada, March 30, 2021
