Comment: Adaptability and awareness are key to preventing cyber-attacks in 2018
Cybersecurity was a massive concern for most organisations in 2017 and looks to continue to be a headache for CIOs in 2018. Symantec recently released their cybersecurity predictions for 2018, listing the many concerns that CIOs and InfoSec specialists may have in store for them this year. The outlook is bleak, and there is not sufficient knowledge of the threat landscape to prevent attacks. Organisations need to act to avoid potential threats as well as be prepared in the event of a breach.
It is vital that organisations understand their own current security maturity, taking into account the existing cyber threat landscape and the industry in which they operate. This cannot be a generic check. Different parameters exist for various industries and every industry has a different threat or risk profile. A financial services provider for example, which deals with sensitive information, on a daily basis, will have different security requirements to say, a glass manufacturer.
Despite different threat profiles, every industry also has exposure to the same types of threats that are out there. As the Symantec report evidences, there are several distinctive threats to be cognisant of. Ransomware was the most talked about threat last year, however lesser publicised threats such as data theft, identity theft and financial trojans are also leaving considerable damages in their wakes.
A cyber-attack can do a lot of damage. Beyond the financial impact of lost data, compromised identities or having to pay a ransom to recover data- there is also reputation damage to consider. People are more reluctant to do business with an organisation known to have suffered data losses.
Cybersecurity maturity evaluation
The first port of call for any organisation should be to evaluate and understand where their weak points are, not just currently but in line with their business strategy too. Current security controls need to be reviewed frequently in line with the business trajectory, while also incorporating any possible digital transformation strategies. Current and potential gaps should be identified and prioritised, and a security roadmap should be implemented for remediation- incorporating whatever changes are required, budget permitting.
Any planned digitalisation needs to be measured against current security controls to evaluate their suitability and sustainability. New technologies, applications and programs open up new vulnerabilities, and therefore existing security controls may not be sufficient.
One key factor to consider when planning a security strategy or roadmap is the shortage of proper cybersecurity skills- particularly in South Africa. An organisation planning on executing a complex digital strategy with equally complex cybersecurity demands, should consider outsourcing its security to a reputable and knowledgeable partner. This will ensure that security remains current and equipped to handle the myriad of threats out there.
Awareness, awareness, awareness
So important, it needs to be repeated frequently. Many security breaches occur simply because employees are not aware of how to work securely and responsibly. While assessing the security threat landscape and an organisation’s security maturity, they should also continually assess their internal awareness of both.
Frequent training and awareness programs can go a long way to reducing the risk of attack. Mindful employees are empowered with the knowledge of how to identify risk areas, handle any security incident and the appropriate reporting channels in the event of a breach.
A simple way to assess an organisation’s security maturity, identify weak points and evaluate internal awareness levels - is to conduct cybersecurity simulation exercises. Similar to a fire drill, by simulating a cyber-attack, such as ransomware and implementing the relevant procedures in response, a business can clearly spot the gaps and remedy its reaction plan.
A simulation addresses the entire response process- including the technology, skills and capabilities within the organisation to ascertain whether or not they are geared to handle the real deal. It also looks at the suitability of a business’ crisis communication plan and whether or not the breach is properly communicated to stakeholders and correctly managed from a remediation point of view.
Simulations can teach the employees within a business a lot about whether or not they are properly prepared to tackle a security threat, and what can be reasonably changed to ensure success.
There is no doubt that 2018 will be riddled with cyber threats, as cybercriminals seek to profit from the likes of Ransomware-as-a-Service (RaaS) and more. An organisation which stays on top of the current security threat landscape and constantly adapts its security strategy accordingly, is more likely to see out the year successfully, with little to no impact.
GfK and VMware: Innovating together on hybrid cloud
GfK has been the global leader in data and analytics for more than 85 years, supplying its clients with optimised decision inputs.
In its capacity as a strategic and technical partner, VMware has been walking GfK along its digital transformation path for over a decade.
“We are a demanding and singularly dynamic customer, which is why a close partnership with VMware is integral to the success of everyone involved,” said Joerg Hesselink, Global Head of Infrastructure, GfK IT Services.
Four years ago, the Nuremberg-based researcher expanded its on-premises infrastructure by introducing VMware vRealize Automation. In doing so, it laid a solid foundation, resulting in a self-service hybrid-cloud environment.
By expanding on the basis of VMware Cloud on AWS and VMware Cloud Foundation with vRealize Cloud Management, GfK has given itself a secure infrastructure and reliable operations by efficiently operating processes, policies, people and tools in both private and public cloud environments.
One important step for GfK involved migrating from multiple cloud providers to just a single one. The team chose VMware.
“VMware is the market leader for on-premises virtualisation and hybrid-cloud solutions, so it was only logical to tackle the next project for the future together,” says Hesselink.
Migration to the VMware-based environment was integrated into existing hardware simply and smoothly in April 2020. Going forward, GfK’s new hybrid cloud model will establish a harmonised core system complete with VMware Cloud on AWS, VMware Cloud Foundation with vRealize Cloud Management and a volume rising from an initial 500 VMs to a total of 4,000 VMs.
“We are modernising, protecting and scaling our applications with the world’s leading hybrid cloud solution: VMware Cloud on AWS, following VMware on Google Cloud Platform,” adds Hesselink.
The hybrid cloud-based infrastructure also empowers GfK to respond to new and future projects with astonishing agility: Resources can now be shifted quickly and easily from the private to the public cloud – without modifying the nature of interaction with the environment.
The gfknewron project is a good example – the company’s latest AI-powered product is based exclusively on public cloud technology. The consistency guaranteed by VMware Cloud on AWS eases the burden on both regular staff and the IT team. Better still, since the teams are already familiar with the VMware environment, the learning curve for upskilling is short.
One very important factor for the GfK was that VMware Cloud on AWS constituted an investment in future-proof technology that will stay relevant.
“The new cloud-based infrastructure comprising VMware Cloud on AWS and VMware Cloud Foundation forges a successful link between on-premises and cloud-based solutions,” says Hesselink. “That in turn enables GfK to efficiently develop its own modern applications and solutions.
“In market research, everything is data-driven. So, we need the best technological basis to efficiently process large volumes of data and consistently distill them into logical insights that genuinely benefit the client.
“We transform data and information into actionable knowledge that serves as a sustainable driver of business growth. VMware Cloud on AWS is an investment in a platform that helps us be well prepared for whatever the future may hold.”