I’m not the biggest sci-fi fan. I can count the number of times I have seen the Star Wars movies on one hand, and I have never seen any of the Star Trek movies or television series. However, I am a fan of the Big Bang Theory and as Dr Sheldon Cooper has pointed out on many occasions, many of the inventions that we see today were predicted on Star Trek decades before they were invented.

Along with Big Data, innovation is what will drive the future development of the Fourth Industrial Revolution and our relationship with technology. There are a number of key growth points that we need to look at which will have a significant impact on the world and the way that technology will enable productivity in the future.

Technology in today’s world

I recently read an article which pointed out that from the moment you wake up, to the moment you go back to sleep, technology is everywhere. The highly digital life we live and the development of our technological world have become the new normal. According to The International Telecommunication Union (ITU), almost 50% of the world’s population uses the internet, leading to over 3.5 billion daily searches on Google and more than 570 new websites being launched each minute. And even more mind-boggling? Over 90% of the world’s data has been created in just the last couple of years.

The article adds that with data growing faster than ever before, the future of technology is even more interesting than what is happening now. We’re just at the beginning of a revolution that will touch every business and every life on this planet. By 2020, at least a third of all data will pass through the cloud, and within five years, there will be over 50 billion smart connected devices in the world.

Keeping pace with digital transformation

At the rate at which data and our ability to analyze it are growing, businesses of all sizes will be forced to modify how they operate. Businesses that digitally transform, will be able to offer customers a seamless and frictionless experience, and as a result, claim a greater share of profit in their sectors. Take, for example, the financial services industry – specifically banking. Whereas most banking used to be done at a local branch, recent reports show that 40% of Americans have not stepped through the door of a bank or credit union within the last six months, largely due to the rise of online and mobile banking.

The article points out that, according to Citi’s 2018 Mobile Banking Study, mobile banking is one of the top three most-used apps by Americans. Similarly, the Federal Reserve reported that more than half of U.S. adults with bank accounts have used a mobile app to access their accounts in the last year, presenting forward-looking banks with an incredible opportunity to increase the number of relationship touchpoints they have with their customers by introducing a wider array of banking products via mobile.

Be part of the movement

The article added that rather than viewing digital disruption as worrisome and challenging, embrace the uncertainty and potential that advances in new technologies, data analytics and artificial intelligence will bring. The pressure to innovate amid technological progress poses an opportunity for us all to rethink the work we do and the way we do it.

Reframing the future

Most of this is scary for us to comprehend. However, if done correctly, we can reframe the future responsibly. I recently read an article where Chief Information Officers (CIOs) weigh in on how to reframe the future with emerging technology.

The lure of the latest breakthrough technology can be strong, but state chief information officers also need to take more practical considerations into account when contemplating new deployments. In a live session on the last day of the NASCIO annual conference, moderator Chris Estes, former CIO of North Carolina, who now works at EY, was joined by Utah CIO Mike Hussey and Pennsylvania CIO John MacMillan to weigh in on a new report from NASCIO and EY, How Will the Power of Emerging Technology Help Reframe your Future?

the article pointed out that, indeed, a more measured approach seems the most prudent for government. “You can’t always do every shiny widget that comes through the front door,” Hussey said. But as has been proven repeatedly during the past several months when CIOs have been focused on digital service delivery during the pandemic, there’s a place for innovation in state government. And in fact, it’s what citizens expect.

To support this point, Estes recalled a comment from Rhode Island CIO Bijay Kumar: “There’s no way government can not do emerging technology when the citizens are so used to using it.”

Critical to the successful use of emerging technologies in government, then, is constructing appropriate guard rails to make sure it is used responsibly in a way that produces value. In short, good governance is paramount.

Governance: The Utah and Pennsylvania Approaches

the article added that, in Utah, there are a few groups responsible for evaluating the potential of new technologies and their applicability to state government. An agency review board, Hussey explained, is made up of staff from various departments and business areas. They offer specific organizational perspectives on how a technology might be used to solve business problems for the state. Their work is complemented by an external technology advisory board with representatives from outside of state government. Together, Hussey explained, the two groups serve as an effective vetting mechanism before any investment decisions are made.

Yet another body involved in evaluating emerging tech applications for Utah is its center for excellence for artificial intelligence, established in 2019. At a recent virtual event, Utah Chief Technology Officer Dave Fletcher counted about a dozen major initiatives currently underway from the center.

MacMillan explained that Pennsylvania began looking at best practices around architecture frameworks a couple of years back, eventually arriving at its Commonwealth Innovation Architecture Framework (CIAF). The framework is made up of seven models (in performance, business, data, application, technology, security and digital) to help establish standard governance on how the state approaches the use of emerging technologies. These well-defined parameters keep the state focused on the right things.

the article pointed out that the panelists concurred with an assessment offered by Tennessee CIO Stephanie Dedmon: “Emerging tech needs to add value, solve problems and make things easier.” MacMillan added that the approach in Pennsylvania is to ensure that tech investments fit within the context of existing architecture, and further, that tech must solve a business problem. “IT is not in business for itself,” he said.

Most Impactful Emerging Tech

In the annual NASCIO State CIO survey released Tuesday, more than half (61 percent) of respondents said artificial intelligence was their top prediction for the emerging technology that will be the most impactful in the next three to five years. The response isn’t surprising given how the pandemic has pushed governments to quickly move services online, a move often supported by chatbots, machine learning and robotic processes automation (RPA).

The emerging tech survey found that the top place respondents believe AI-powered solutions like these will make the most impact is in citizen-facing digital services, like chatbots that can help residents get their questions answered more quickly than trying to call a government agency. MacMillan said that in Pennsylvania, they’ve experimented with the potential interactions AI can have and the “intents” of citizen questions so they are then pointed in the right direction. This tracks with his notion that you can’t just toss out a new solution and expect it to work perfectly. “Each one of these emerging technologies requires some kind of care and feeding,” MacMillan stressed.

the article added that survey responses that followed automation included low-code app development (33 percent), and the Internet of Things and connected/autonomous vehicles (tied at 2.3 percent). The latter are congruent with what Hussey sees coming down the pipeline, pointing to Utah’s smart corridor project and vehicle-to-infrastructure work. “I know it’s a very small piece right now,” he said, “but certainly that’s where you’ll start to see that take off.”

Utah is also exploring new applications for drones to measure air quality at various altitudes, given the smoke that has moved into their state from the west, and is looking at taking vehicle titles digitally so citizens don’t need to visit a DMV to transfer ownership. “We’re eyeing a potential solution that’s on blockchain,” Hussey said. “There’s a lot of opportunities to get excited about the new technologies,” he added.

Barriers to Adoption

Of course, all the opportunities and excitement about solutions like chatbots and connected vehicles don’t necessarily mean there aren’t challenges to putting emerging tech in place for state government. Respondents to the survey ranked budget as the most challenging obstacle to getting emerging tech projects off the ground, which MacMillan agreed with, noting that “every new CIO understands their success relies on the budget director in some form or another.”

the article pointed out that, in Pennsylvania, they have a system of procurement waivers, built upon state code originally written in 1929 that has been updated through the years. The value, he explained, is that a waiver makes sure his IT agency can consider “valid exceptions” when other statutes might prohibit a novel technology.

Hussey said that Utah, on the other hand, has an annual innovation fund that goes toward innovative ideas and allows the state to demonstrate that a technology solution will have appropriate return on investment.

the article added that, in addition to issues around how to fund emerging tech, survey respondents also cited alignment of use cases, legacy IT systems, lack of necessary staff skills and organizational silos as barriers to adoption. And MacMillan sees questions arising around how an increasingly connected life is regulated.

“This kind of technology has to become a national technology,” he said, pointing to work in Pennsylvania around self-driving cars and asking what happens when those cars reach a jurisdictional border. “It can’t just be a unique occurrence within a state. There are lots of problems to solve on the road to autonomous vehicles.”

Secret Weapon
Every industry, from financial service providers to banking to gyms, are tryaing to future proof their business models with artificial intellegence (AI); this adoption will only accelerate in the future.

I recently read an article which pointed out that the secret to designing a positive future with AI is by embracing imagination.

Many physical tasks previously seen as un-automatable can now be performed by machines, from medical diagnoses to legal document drafting. Meanwhile, the need for remote working during the COVID-19 pandemic is converting complex business processes into modular, decontextualized tasks more amenable to automation.

The article points out that such trends are fuelling the growth of automation technologies and will spur large-scale, global changes, including 400 to 800 million lost jobs by 2030, according to McKinsey. Automation technologies may also exacerbate economic and social inequalities within a fractured and dysfunctional society.

Even optimistic economists anticipate a world that promises a high standard of living to all, but leaves few people with any useful role that is valued by others by today’s standards — in essence, life on Earth might feel much like a cruise ship experience, a world in which human beings are merely passengers.

For many, this kind of future would rob life of the very aspects that give it meaning. In order to avoid such outcomes, it is essential that we take steps to ensure an economically sustainable and desirable future for workers today, and for generations to come. To accomplish this, our most essential step is to tap into a quality we often overlook when discussing jobs and the future economy: our imaginations.

Seeking true vision

The article adds that we must imagine the positive world we want to live in, the desirable future economy we think we want.

A desirable future economy will have several traits. It's one in which, even after many dramatic economic shifts occur, humans retain valuable and meaningful roles in society. This world would be economically sustainable, allowing humans to flourish while planetary boundaries are respected, and inequalities are minimized.

The article points out that focusing on the positive is key to steering toward a positive destination. Instead of being passive passengers in a collective spaceship erring towards dangerous planets, we can instead actively move in the direction of the outcomes we want, such as full employment and equity.

This is, at its heart, an exercise in vision. To be sure, realizing that vision will require a commitment to idealism, hope, and an openness towards change and uncertainty. But the vision is paramount and will set our future course.

Tapping a range of disciplines

The article adds that building such a vision is a collective intelligence exercise that requires many voices from around the world. In taking this step, we can empower participants from various backgrounds and countries to make this vision real and identify the implications of that long-term vision for present-day policy decisions

Such work can seem like a creative writing prompt but was actually a key exercise undertaken by the World Economic Forum’s Global AI Council (GAIC), a multi-stakeholder body that includes leaders from the public and private sectors, civil society and academia. In April 2020, we began pursuing an ambitious initiative called Positive AI Economic Futures, taking as its starting point the hypothesis that AI systems will eventually be able to do the great majority of what we currently call work, including all forms of routine physical and mental labour.

The article points out that knowing science-fiction’s astounding accuracy in predicting both the advantages and challenges technologies can bring, we solicited the creativity of notable authors to give their thoughts along with policy makers and subject-matter experts in economics and AI. In a series of ongoing workshops, this diverse group of individuals discussed existing visions and their implications for present-day policy.

Running in parallel with the workshops, the non-profit XPRIZE Foundation is organizing a short film competition that challenges participants from around the world to showcase their ideas for a future economy, ideas that addressed individual aspirations and fears. This is the part of the overall project where imagination takes its full power.

The article adds that tapping visionaries from the creative, technical and policy realms ensures we tap in the full range of ideas for a new society. A true breadth of ideas is only possible by getting the perspectives from a range of disciplines.

Looking ahead

We stand on the cusp of remarkable change. AI and other emerging technologies are positioned to raise global income levels and improve standards of living for billions of people.

The article points out that, at the same time, as noted by various economists, many livelihoods will be severely disrupted. Previous industrial revolutions suggest that over time, labour markets eventually adjust to changes in demand for workers from technological disruptions such as the combustion engine. But there are reasons to believe that the Fourth Industrial Revolution may play out differently.

The article adds that much has been written about painful transitions that could be in our future. In our minds, less attention has been given to crafting and working toward a positive outcome. As we see it, it is much better to plan for the worst by planning and designing for the best.

A 5G jump forward

Huawei has emerged as the first real challenger to the dominance that Apple and Samsung have had in the telecommunications industry. The fact that their phones are cheaper and are run by impressively sophisticated tech means that the company is a future industry giant in the making.

Their expansion is hinging on the growth of 5G. The company did encounter a lot of resistance in Australia and New Zealand over its 5G expansion plans. But this is not stopping the development of the tech as Nokia is now also pinning its hopes on the tech.

Like AI, 5G will be a technology of the future, whether we like it or not. I recently read an article which pointed out the future uses of the tech.

The Purported Potential Uses of 5G

The article pointed out that the US is the first country in which 5G will rely on a triad of cellular frequencies: existing ones across a range of bands, new allocations up near the bands currently used for 5 GHz Wi-Fi and soon for 6 GHz Wi-Fi, and mmWave starting at 24 GHz. It’s a grand experiment for delivering broad-scale higher-performance in lower bands and super-fast throughput as needed in the much higher bands.

The uses cited for 5G include all things we do now, though carriers actually don’t mention video streaming all that often. Perhaps 4K-quality video streams just aren’t that compelling, especially given that some carriers already downscale video automatically or require a higher-priced subscription to get higher fidelity than 480p, and more expensive plans top out at 1080p.

The article added that carriers are excited about (and investing in) 5G because they anticipate new money-making opportunities, particularly in industries in which low-latency, high-bandwidth, high-coverage wireless enables new products or services, or allows shifting intelligence from edge devices to central processing.

Just as Web apps have benefitted from the massive improvements of speed in JavaScript running in a browser that allows a combination of locally downloaded code and seamless interaction with remote resources, 5G networks will ostensibly enable massively scaled systems that can feed data out in real time to edge points. This includes both relatively low-featured Internet of Things (IoT) devices that will benefit from storing their brains elsewhere—with all the security and privacy issues associated with that—and more sophisticated hardware, like autonomous or driver-assisting vehicles.

The article pointed out that some of the most compelling cases are:

-  Augmented reality: In recent years, Apple has focused significant attention on AR, which can require a lot of constantly updated data that’s processed centrally and streamed to a device, all while responding to movements in the physical environment;

-  Gaming: Gamers often required wired Ethernet connections in their homes for the best results. 5G will make mobile gaming more responsive;

-  Rural access: Every generation of cellular technology promises better coverage for rural residents. Every generation often disappoints them, too, because carriers prefer to deploy service where they can more easily make money. However, 5G’s greater efficiency and variety of frequency options, particularly in some new frequency territory around 5 GHz and 6 GHz, should generally improve rural service;

-  Urban/suburban access: In some cases, carriers and other parties might find it feasible to deliver high-speed urban and suburban residential broadband over 5G. It’s more likely to happen outside the US because in this country there’s sufficient inexpensive wired infrastructure (cable, phone wire, and fiber) in more densely populated areas. I pay $85 per month for unlimited gigabit Internet in Seattle; it’s hard to imagine a wireless provider offering even 100 Mbps at that price for residential-scale video and other use in the US. However, in some developed and developing countries, even relatively populated or dense areas lack wired or fiber-optic infrastructure at the level demanded;

-  Remote medical procedures: We’ve all become more familiar with telemedicine consultations in the last few months, but with sufficient bandwidth, remote medical procedures are here today. Diagnosis and even robot-assisted surgery can be performed through remote linkages, but setting up a stable, low-latency, high-bandwidth network where a wired, low-latency broadband connection is unavailable, or for facilities that aren’t able to wire Ethernet into existing areas, would open up new possibilities. (That said, would you want a wireless surgeon operating on you? Seems like a hard sell.);

-  Autonomous cars: A car can’t rely solely on a 5G network for robotic operations while it’s zooming down the highway, but it could overlay its onboard capabilities with information gathered around and ahead of it to deter accidents and improve safety.

In short, although 5G is inevitable and may become an important aspect of society’s networking infrastructure, there’s no reason for most people to upgrade to get it right now. It will be interesting to see how all of these technologies develop in the future. 

When faced with two challenges, it important to know the difference between the two so that you can devise an appropriate strategy to address them.

We are into the third week of Cyber Security Awareness Month and we are presented with the challenge of differentiating between cyber security and cyber resilience. Most companies confuse the two and then come up with these hybrid strategies which are mostly ineffective.

Acknowledging that these strategies are separate, and equally important to companies, is the first step towards effective protection.

The article pointed out that cyber threats like hacking, phishing, ransomware, and distributed denial-of-service (DDoS) attacks have the potential to cause enormous problems for organizations. Not only can companies suffer serious service disruption and reputational damage, but the loss of personal data can also result in huge fines from regulators.

Take British Airways as an example. In 2019, the airline was fined more than £183m by the UK's Information Commissioner's Office (ICO) after customer data was compromised in a cyber-attack. Customer details, including name, address, logins, and payment card, were harvested by hackers – affecting half a million customers in total. The fine, which amounts to around 1.5% of British Airways’ global 2018 turnover, was the first proposed by the ICO under the new General Data Protection Regulation (GDPR).

The article adds that cyberattacks like this are hitting the headlines with increasing frequency. But while a company the size of British Airways can, in theory, swallow such a huge fine and cope with the aftermath, for other businesses, the effects of a cyber-attack can be permanent and devastating. This is why all companies need to invest in cybersecurity and cyber resilience.

What’s the difference between the two?

In a nutshell, cybersecurity describes a company's ability to protect against and avoid the increasing threat from cybercrime. Meanwhile, cyber resilience refers to a company's ability to mitigate damage (damage to systems, processes, and reputation), and carry on once systems or data have been compromised. Cyber resilience covers adversarial threats (such as hackers and other malicious actors), as well as non-adversarial threats (for example, simple human error).

The article pointed out that one way of thinking about the difference is that cyber resilience involves accepting the fact that no cybersecurity solution is perfect or capable of protecting against every possible form of cyber threat. This is why every company needs both aspects. The cybersecurity strategy is designed to minimize the risk of attacks getting through. But when they inevitably do, the cyber resilience strategy is there to minimize the impact.

What does all this mean in practice?

The article adds that practical cybersecurity steps are perhaps more immediately obvious than those for cyber resilience. At the very least, cybersecurity involves ensuring:

-    All your devices are running the most up-to-date firmware;

-    That firewalls, VPNs, and antivirus/malware protection is running and up-to-date;

-    That all software and tools are fixed with the latest patches; and

-    That employees at all levels of the business are educated on the potential threats and how their actions help to defend the organization.

The article points out that cyber resilience steps will vary from business to business, but a good starting point is to work out where cyber events and incidents could have the most damaging effects on the business. Drawing up a list of where your operations are reliant on technology, as well as where sensitive and valuable data is stored and used, will help you to gain an overall understanding of how continuity of service could be affected. This is where the concept of a “digital twin” can play an important role in cyber resilience. A digital, simulated model of your organization or its processes can help you understand the impact on overall output and efficiency.

Having gained an understanding of how core functions could be affected, cyber resilience involves putting in place measures to mitigate the damage as best as possible in the event of an attack. For example, you might develop offline emergency processes to keep essential functions such as customer service, quality assurance, finance, and security running as well as possible until the breach can be fixed.

The article adds that, in addition, you’ll need a solid cyber incident response plan to clarify:

-     What needs to be done in the event of a failure or breach;

-    Who is responsible for taking those steps;

-    How to communicate the incident to stakeholders (customer services will have a core role to play here);

-    How failures should be reported to regulators (which may be a regulatory requirement in your jurisdiction);

-    How to assess and report the impact of resilience measures;

-    How to get back to normal operations as quickly as possible; and

-    How to recover data, if data has been lost or accidentally erased (cyber resilience promotes the idea that it’s impossible to certify that any piece of data is totally “safe,” even if the data is backed up, and therefore steps should be in place to recover it when it is lost).

To help put this plan into action in the event of an incident, many organizations find it helps to create a response team, with representatives from every business department who are responsible for declaring a “state of emergency” and coordinating first responses.

The article points out that technology brings incredible new opportunities and business advantages, but it also brings unprecedented new threats. Cybersecurity and resilience both require an investment in time, resources, and education, but that investment will be repaid many times over once you’ve withstood your first cyber-attack.

Accelerated focus

What is encouraging to see is that there is an accelerated focus on cyber security adoption. Recent studies show that 83% of enterprises transformed their cybersecurity in 2020.

The article points out that this, and many other insights are from a recent survey of IT leaders completed by CensusWide and sponsored by Centrify. The survey's objectives on understanding how the dynamics of IT investments, operations and spending have shifted over the last six months. The study finds that the larger the enterprise, the more important it is to secure remote access to critical infrastructure to IT admin teams. Remote access and updating privacy policies and notices are two of the highest priorities for mid-size organizations to enterprises today. The methodology is based on interviews with 215 IT leaders located in the U.S. 

Some of the key highlights of the study include:

-    73% of enterprises (over 500 employees) accelerated their cloud migration plans to support the shift to remote working across their organizations due to the pandemic;

-    81% of enterprises accelerated their IT modernization processes due to the pandemic;

-    48% of all companies surveyed have accelerated their cloud migration plans, 49% have sped up their IT modernization plans because of Covid-19;

-    32% of large-scale enterprises, over 500 employees, are implementing more automation using artificial intelligence-based tools this year.

SMB adoption

The article points out that the overwhelming majority of enterprises have transformed their cybersecurity approach over the last six months, with 83% of large-scale enterprises leading all organizations. It's encouraging to see small and medium-sized businesses adjusting and improving their approach to cybersecurity.

Reflecting how digitally-driven many small and medium businesses are, cybersecurity adjustments begin in organizations with 10 to 49 employees. 60% adjusted their cloud security postures as a result of distributed workforces.

Leading the way

The article adds that 48% of all organizations had to accelerate cloud migration due to the pandemic, with larger enterprises leading the way.

Enterprises with over 500 employees are the most likely to accelerate cloud migration plans due to the pandemic. 73.5% of enterprises with more than 500 employees accelerated cloud migration plans to support their employees' remote working arrangements, leading all organization categories.

This finding reflects how cloud-first the largest enterprises have become this year. It's also consistent with many other surveys completed in 2020, reflecting how much the cloud has solidly won the enterprise.

Modernization

The article points out that 49% of all organizations and 81% of large-scale enterprises had to accelerate their IT modernization process due to the pandemic.

For the largest enterprises, IT modernization equates to digitizing more processes using cloud-native services (59%), maintaining flexibility and security for a partially remote workforce (57%) and revisiting and adjusting their cybersecurity stacks (40%).

Highest priority

The article adds that 51% of enterprises with 500 employees or more are making remote, secure access their highest internal priority. In contrast, 27% of all organizations' IT leaders say that providing secure, granular access to IT admin teams, outsourced IT and third-party vendors is a leading priority.

The larger the enterprise, the more important remote access becomes. The survey also found organizations with 250 – 500 employees are most likely to purchase specific cybersecurity tools and applications to meet compliance requirements.

Lesson learning

The article points out that IT leaders are quickly using the lessons learned from the pandemic as a crucible to strengthen cloud transformation and IT modernization strategies. One of every three IT leaders interviewed, 34%, say their budgets have increased during the pandemic. In large-scale enterprises with over 500 employees, 59% of IT leaders have seen their budgets increase.

All organizations are also keeping their IT staff in place. 63% saw little to no impact on their teams, indicating that the majority of organizations will have both the budget and resources to maintain or grow their cybersecurity programs. 25% of IT leaders indicated that their company plans to keep their entire workforce 100% remote.

The article adds that it's encouraging to see IT leaders getting the support they need to achieve their cloud transformation and IT modernization initiatives going into next year. With every size of organization spending on cybersecurity tools, protecting cloud infrastructures needs to be a priority. Controlling administrative access risk in the cloud and DevOps is an excellent place to start with a comprehensive, modern Privileged Access Management solution. Leaders in this field, including Centrify, whose cloud-native architecture and flexible deployment and management options, deliver deep expertise in securing cloud environments.

The bottom line

The bottom line is that it’s time for a better approach to cybersecurity. You may be sufficiently covered and up to speed with the latest industry trends. The fact of the matter is that this industry is constantly evolving, and at a pace that is much quicker than most companies can cope with.

The role of chief security officer has never been easy, especially in the complex bureaucracies of the federal government. Stakes are high, IT infrastructure is sprawling and Congressional oversight could lead to a hearing in an instant. Additionally, nation-states and criminals are increasing their attacks against government agencies, shifting from disruptive and destructive tactics to large-scale social manipulation through disinformation operations.

The article points out that security teams are tasked with defending U.S. government critical assets against cyberthreats, yet they often lack insight into the effectiveness of their security controls.  Unless they are exercised regularly, security controls fail through misconfiguration or user mistakes. Security leaders can help solve this problem by focusing their teams on the threats that matter most and by shifting their approach to a data-driven strategy with performance effectiveness at the center.

The need for increased security effectiveness is clear. Today government agencies face elevating cyberthreats since the onset of COVID-19 and heightened tensions in American society, particularly in advance of the 2020 presidential election. Unemployment and civil unrest provide nation-state groups with preconditions for operations, as a recent Harvard University study on disinformation outlined. The FBI and Department of Homeland Security recently warned against Chinese and other state-sponsored attackers increasing malicious operations amidst the pandemic. Within government, the pandemic has strained workforces, leaving them ill-equipped to address the increasing number of threats. With Gartner forecasting global government IT spending will decline 0.6% in 2020, it’s unclear how agencies can remain secure on a leaner budget.

How to do more with less

The article adds that government IT managers need a way to optimize their security strategy by continuously validating their networks and gauging the effectiveness of current controls to ensure their investments work as intended.

Security optimization is the management practice of maximizing the efficiency and effectiveness of an organization’s total security program by ensuring that existing control investments are measured, monitored and modified continuously from a threat-informed perspective. Security optimization is not about cost cutting; it is about programmatically aligning security and risk services within the organization.

The article points out that It all comes down to data. To achieve efficiency and effectiveness across a security program, government agencies must shift from a project-centric to a program-oriented mindset with performance data at the center.

Nuts and bolts

What would that program look like? First, it would be underpinned by the MITRE ATT&CK framework. Second, it would include automated testing, pitting cyberdefenses against known threats. Third, it would use automated testing to generate real data about the security team’s operational performance.

The article points out that this is a shift in security program strategy. By organizing teams around a shared view of threats, automation and performance data, security leaders can make programmatic improvements in people, process and technology to gain the best return on investment.

Traditionally, “blue team” network defenders focus their operations on meeting baseline cybersecurity best-practices: correcting misconfigurations, administering patches and deploying best-in-class commercial products. If defenses are not oriented toward the most important threats, however, those resources are wasted. If they are not tested actively against probable threats, they are likely to fail when challenged by the adversary, letting the attacker slip past.

The article adds that security organizations typically turn to “red teams” and penetration testing to help secure the enterprise. Red teaming is the process of testing technologies, policies, systems and assumptions by adopting an adversary’s approach.  Although red teams often discover faults in cyberdefense programs, red-team testing is notoriously sporadic, under-resourced and ineffective in validating security controls continuously and at scale to achieve real security effectiveness.

Purple teams

The article points out that one way to improve the efficiency of this approach is by having blue- and red-focused teams adopt a purple team mindset for cyberdefense operations.

Purple team doctrine ensures that organizations optimize their cybersecurity continuously by validating their controls against a library of known attack methods. Purple teams focus on the overarching threat landscape. They understand their security technologies, their organization and its operational attributes. When combined with automation, security teams can test these operations at scale, across the organization, and discover ways to improve security efficiency and effectiveness. The Defense Department has conducted purple team operations to achieve cybersecurity effectiveness for military networks. Other government agencies should adopt a threat-informed, purple team mindset to improve their cybersecurity effectiveness at a programmatic level. 

By ensuring that existing security investments are measured, monitored and modified continuously from a threat-informed perspective, senior security leaders can use performance data to make sound investment decisions, improve the cybersecurity of government agencies and better protect Americans’ data.

Important tips

In the modern age, small and medium businesses contribute a lot towards economic development. However, these are the companies who are most vulnerable to cyber attacks.

Here are some important tips for these companies to follow:

-    Implement a Robust Firewall. A firewall is a cybersecurity solution that sits between a small business network and the outside world and prevents unauthorized individuals from gaining access to the network and stored data. Not all firewalls are created equal. Extra investment in a next generation firewall is money well spent. Don’t forget to also protect remote workers. Ensure that they are also protected by a firewall;

-    Create and Enforce Password Policies. You should implement password policies that require all users to set strong, secure passwords. A strong, unique password should be used for all systems. Passwords should include capitals, lower-case letters, a number, and a special character, and should be at least 10 digits long. Teach employees how to create secure passwords and enforce your password policies. Consider using a password manager so passwords do not need to be remembered.  Consult NIST for the latest password guidance;

-    Security Awareness Training. Make sure you provide the workforce with regular security awareness training. This is the only way that you can create a culture of cybersecurity. Be sure to cover the security basics, safe Internet use, how to handle sensitive data, creation of passwords, and mobile device security. You should provide training to help employees avoid phishing attacks and consider phishing simulation exercises to test the effectiveness of your training program;

-    Backups. It is essential to have a good backup policy. In the event of disaster, such as a ransomware attack, you need to be able to recover critical data. Backups must also be tested to make sure files can be recovered. Don’t wait until disaster strikes to test whether data can be recovered. A good strategy is the 3-2-1 approach. Three backup copies, on two different types of media, with one copy stored securely offsite.

So where does GT fit in?

GTconsult has a long history of assisting companies with their cybersecurity and cyber resilience. A lot of our clients are large companies; however, we specialise in SMBs as that is where our A Team can give focused advice and assistance.

GTconsult offers a range of cyber security services that will ensure that you are protected against any threats. We also have our A Team which will assist you with any concerns you have. Contact us today to find out more.