Tech@2023 - Channel 360 MEA

Today ransomware has become one of the greatest network security threats organisations have to deal with. Increasingly sophisticated and distributed at a high speed via the internet and private networks using military-grade encryption, today’s ransomware attacks demand multimillion-dollar ransoms. As per the findings of the 2022 IBM Security X-Force Threat Intelligence Index, the Middle East and Africa (MEA) region was ranked fourth worldwide for the most ransomware attacks. According to a report by Group-IB, between Q1 2021 and Q1 2022, the data belonging to 147 companies from the MEA region was uploaded on ransomware dedicated leak sites (DLS). And this is only one of the many threats that organisations have to deal with.There are also distributed denial of service (DDoS) attacks, Man in the Middle (MitM) attacks, social engineering, insider threats, malware, and advanced persistent threats (APTs) to contend with – and those are just the most common network security threats.Here are four strategies to make cybersecurity professionals’ organisations safer from the countless network security threats they’ll be facing in the near future:Create a “Security-first” CultureThe problem for CSOs is that, while most employees have some basic knowledge of cybersecurity best practices, that is pretty much all they have. Without ongoing training, knowledge testing and awareness, staff behaviour is one of the biggest cybersecurity risks that organisations face.Organisations must look to create a robust and distributed digital immune system with a radical re-engineering of staff behaviour. Business leaders need to have accountability for cybersecurity; security teams need to collaborate with business leaders to create and implement policies that will actually work, and those policies need to be routinely re-evaluated and tested.Create a Continuous Security Education ProgramA “security-first” culture requires that all members of the culture appreciate the concept of network security threats. For this to actually have an impact on culture, however, staff must be trained routinely to ensure that their knowledge is current.Implement a Zero-Trust Model Throughout the BusinessWell-trained staff and a monitored environment are crucial to the successful protection of any organisation but without a foundational Zero Trust environment, defences will be intrinsically weak.The Zero Trust model is a strategy for preventing network security threats that all enterprises and governments should be using to defend their networks. It consists of four components:· Network traffic control: The goal is to allow only as much network access to services as is needed to get the job done. Anything beyond the minimum is a potential threat.· Instrumentation: The ability to monitor network traffic in-depth along with comprehensive analytics and response automation provides fast and effective incident detection.· Multi-vendor network integration: Real networks aren’t limited to a single vendor. The goal is to get all of the multi-vendor network components working together as seamlessly as possible to enable compliance and unified cybersecurity. This is a very difficult and complex project but keeping this strategic goal in mind as the network evolves will create a far more effective cybersecurity posture.· Monitoring: Ensure comprehensive and centralised visibility into users, devices, data, the network, and workflows. This also includes visibility into all encrypted channels.· At its core, the Zero Trust model is based on not trusting anyone or anything on the company. This means that network access is never granted without the network knowing exactly who or what is gaining access.Establish and Test Disaster Recovery PlansA key part of a disaster recovery plan involves backups. However, it is surprising how often restoring from backup systems in real-world situations doesn’t perform as expected. CSOs should plan the order in which backed-up resources will be recovered, know what the start-up window will be, and test backups as a routine task with specific validation checks to ensure that a recovery is possible.Staying SecureThe CSO’s job isn’t getting any easier, but solid planning using the four strategies will help ensure an organisation’s digital safety. In addition, partnering with top-level enterprise cybersecurity vendors will ensure that critical security technology and best practices are central to the organisation’s cybersecurity strategy.

Powered by

20% of organizations will have adopted a NaaS strategy

Migration to a network-as-a-service (NaaS) framework enables IT to accelerate network modernization yet stay within budget, IT resource, and schedule constraints. In addition, adopting a NaaS strategy will help organizations meet sustainability objectives since leading NaaS suppliers have adopted carbon-neutral and recycling manufacturing strategies.

Built-in security replaces bolt-on

Reducing cybersecurity risk has become a core operational concern. No longer can organizations bolt-on perimeter firewalls around the network to protect against threats and vulnerabilities. Zero trust and SASE frameworks will become more intertwined, not only to protect from threats but to apply micro-segmentation across the complete IT stack including users, connected devices, applications, network services, compute, and storage platforms.

Location services enable new business models and greater efficiency

Challenging skilled labor markets and recurring supply chain issues will force companies to become more efficient, productive, and resourceful. This will require merging information technology (IT), Internet of Things (IoT), and operational technology (OT) data with contextual information about the environment. A new focus will be placed on obtaining the accurate location of work activity an Fwd d assets, the identity of people and machines, the real-time applications being used and by whom or what, and the security posture of every device and machine.

IT will consolidate operations onto a single, centralized network and security management platform

More diverse digital technology IoT is being deployed by enterprises to improve user experiences and to streamline IT operations. With an intensified focus on end user quality of experience while increasing protection from cyberattacks, IT will look to a single centralized management system with visibility across the network and the ability to configure edge-to-cloud QoS and security policies.

SLA measurements will be based on User Experience not box uptime and link availability

IT must optimize their networks to meet hybrid working requirements. Businesses will have dedicated teams whose priority is to ensure a seamless end user digital experience for employees and customers. Tight control of network performance is no longer sufficient. Being able to identify and troubleshoot application response time and performance issues rapidly and remotely will be essential to ensure a seamless end user digital experience no matter where users connect.

AIOps shift to delivering automated remediation

With AI, cloud adoption, and access to vast amounts of data now common in enterprise-class network management solutions, automation takes center stage. The need to streamline IT efficiency and do more with less is driving human-assisted workflows, which will enable administrators to examine recommended changes and their impact, and then enable remediation of on-going occurrences into production.

Powered by

As the world marches ever onwards in its transition to a digital-first economy, the business landscape around us continues to shift in fundamental ways. Against the backdrop of increasingly distributed workplaces, rapid digital transformation and accelerated cloud adoption, business as usual is out of the window. For channel partners like yourselves, this will lead to new levels of customer service requirements as you are called upon to help businesses navigate, survive and thrive in this new reality. And with this, we will see the role of channel partners evolve from traditional resellers to service providers and trusted advisors.Looking ahead, channel partners have the opportunity to play an even greater role in the IT ecosystem in 2023. But doing so will rely on you anticipating customer needs and providing solutions to address arising issues, while also building and maintaining the capabilities to evolve alongside them. Here’s how I expect we’ll see partners adapt, and the areas where we’re anticipating significant growth and investment.The partner ecosystem will become increasingly complex as we accelerate towards multi-cloud environmentsIn 2023 organizations will continue to leverage technology to completely transform themselves in myriad ways – unlocking efficiency, fostering innovation and enabling new services and business models. With Gartner estimating that over 85% of organizations will embrace the cloud-first principle by 2025, partners must be prepared to help their customers adapt as the technology becomes the new centerpiece for workloads.Looking ahead, partners, vendors and service providers must update their business models to reflect the growing need to source distinct solutions and services from various IT organizations. Channel partners that can talk with credibility about helping companies reduce their energy footprints will stand out from the crowd. As the partner ecosystem rises – the reseller will be at the very forefront. As vendors, it will be our job to support this ecosystem and ensure we are purposefully partner-centred. The ability to build collaborative partnerships will be a key determinant to channel success for everyone.

Partners must leverage the rising appetite for Network-as-a-Service (NaaS) – or risk losing out Hybrid work is here to stay, with Gartner predicting that if an organization were to go back to a fully on-site arrangement, it would risk losing up to 39% of its workforce. It’s no wonder the transition from a hardware-driven industry to a software-first market, or an as-a-service-based economy will speed up. Research from Canalys shows this looks set to surge, predicting that the channel software market will reach $8.9 billion in revenue by 2027.Our own research has shown that interest in this model is rising – it is now being discussed in 86% of EMEA companies. Recognition of the channel’s role in its enhanced popularity is also clear – with IT resellers showing up strongly in respondents’ expectations of who they’d like to purchase NaaS from. Elsewhere, market indicators demonstrate that mass adoption is imminent, and so partners looking to succeed in 2023 must ready themselves to capitalize on this increased interest.Sustainability will soar to the top of the business agendaAs I’ve already mentioned, we’re also expecting sustainability to be an increasing focus for businesses in 2023. Canalys has confirmed that the environmental accountability of IT investments will be one of channel customers’ top priorities within the next two to three years. By partnering with an experienced NaaS vendor, channel partners can benefit from a vendor’s depth and breadth of product and solution knowledge to provide a network configuration that optimizes energy consumption.NaaS offerings should also be underscored by an environmental approach to networking across the entire IT supply chain. Channel partners will need to reassure customers that they are connected to certified sustainable vendors to make certain that sustainable objectives are embedded at the top of the value chain.The IT skills gap will exacerbateWhile the future IT landscape looks promising in regards to the depth and breadth of technologies out there, there is one key roadblock we must address – the growing digital skills gap. The Digital Economy and Society Index (DESI) shows that every third person who works in Europe lacks basic digital skills. It has been estimated that 14 G20 countries could miss out on $11.5 trillion cumulative GDP growth if the skills gap isn’t addressed.This tech talent shortage is impacting not only the IT sector, but of course every industry looking to make digital changes. Enlisted with delivering digital transformation, the channel must ensure that it is addressing these skills gaps both on behalf of customers and itself. Channel partners must look for vendors that offer robust partner-centric programmes, equipping them with the knowledge needed to foster IT evolution.

Powered by

Amantra FM is bullish on the UAE integrated facilities management industry’s growth potential in 2023. The Dubai-headquartered niche facilities management company specializing in bespoke services added that the industry looks poised to register a healthy growth rate of 10% as trends shift in favour of differentiated services that lead to demonstrable outcomes such as energy and cost savings and reduced tenant/occupant churn. The industry’s technology adoption will be attuned to national priorities, according to Amantra FM, which has been vocal about its commitment to the UAE Vision 2025.

“The FM industry will be increasingly prefixed by the word ‘integrated’ in 2023, with stakeholders hoping to bridge silos between people, technologies and systems in facilities. It will lead to the standardization of computer-aided facility management (CaFM) adoption and IoT-led operations. The resulting impact on tenant experiences, energy conservation/management, sustainability goals, and cost savings will invite supportive government policies and incentives,” predicted Sangeetha B, CEO of Amantra FM.

Sangeetha’s notions about widespread technology adoption in the industry are supported by a few tell-tale signs this year. FM operators and owners have been in the market for IoT and CaFM solutions. The increased demand has, in turn, necessitated service providers to revamp their value propositions. Those developments have worked in favour of service providers, such as Amantra, who have operated within a business niche from the get-go.

“Differentiated services, along with niche marketing, are increasingly getting the better of mass marketing FM models. Though the pandemic was a causal factor behind this shift, there are structural trends, such as digital transformation. Owners and FM operators are inclined toward service providers who may not have broad-based solutions but show visible positive outcomes in their niche offerings,” explained Sangeetha.

Robotics-powered cleaning, which characterizes higher efficiency, lower labour requirements and reduced costs, is among the niche offerings sought by owners in the UAE. Sangeetha added that hard services pertaining to HVAC systems are being prioritized by owners who, following the pandemic, are more cognizant of indoor air quality (IAQ) standards. Such developments complement frameworks such as Abu Dhabi’s Safety and Security Planning Manual (SSPM) and bigger priorities like the UAE Vision 2025.

Amantra FM is focused on sustainability through energy management, improving the air quality by using ion technology, and promoting the usage of green products.

In a nutshell, you can call the current period in the industry ‘the great re-engagement’. This juncture calls for FM companies to re-engage customers, align with their evolving expectations, and reconcile their budgets with larger goals such as sustainability. Simultaneously, there is a pressing need to re-engage employees as well, empowering their personal aspirations, ensuring their health and well-being, and creating a sense of community in the workplace.

Powered by

Ours is a sector making use of increasingly intelligent technology, one inherently involved in collecting sensitive data, and as impacted by geopolitical issues affecting international trade as any. Yet we’re still resolute in our view that our innovations will create a smarter, safer world. We believe following 6 key trends will affect the security sector in 2023.

A move towards actionable insights: “From analytics to action”The increasing application of AI and machine learning have seen a focus on the opportunity for advanced analytics in recent years. Moving forward, the shift in focus will move from the analytics themselves, to the actionable insights they deliver in specific use cases. It’s less about telling you something is wrong, and more about helping you decide what action to take. The use of analytics can drive real-time actions which support safety, security, and operational efficiency. From prompts to call emergency services in the case of incidents, to redirecting traffic in cities to alleviate jams, to redeploying staff in busy retail outlets, to saving energy in buildings through more efficient lighting and heating, analytics are recommending, prompting, and even starting to take the actions that support human operators.Beyond ‘live’ actionable insights, analytics can support forensic analysis post-incident. Again, given the vast amount of data being created by surveillance cameras, finding the relevant views of a scene can take significant time. This can hinder investigations and reduce the likelihood of suspects being found. Assisted search addresses this issue, helping operators quickly find individuals and objects of interest among hours of footage. Proposed actions promoted by analytics are increasingly forward-looking. Downtime in industrial sites and factories can be costly. A combination of sensors allows intelligent analytics to propose preventative maintenance ahead of outright failure.Use case-defined hybrid architecturesAs we’ve highlighted in previous technology trends posts, it’s now commonly accepted that a hybrid technology architecture is best-suited for security systems, mixing on-premise servers, cloud-based compute, and powerful edge devices. No one architecture fits all scenarios, however. But here lies the solution: first assess what needs to be addressed in your specific use case, and then define the hybrid solution that will meet your needs. A number of factors need to be considered.Of course, there are the requirements – often define by regulation – around data privacy and storage that vary from country-to-country and region-to-region. These can define the difference between on-premise storage and the use of the cloud. What’s essential is not to tie yourself to a single architecture. Remain open, give yourself the flexibility to create the hybrid architecture best suited to your specific needs.The emergence of cybersecurity sub-trendsThe importance of cybersecurity is also highlighted through the requirement to remain compliant. For instance, the proposed European Commission’s Cyber Resilience Act will place greater demands on producers of hardware and software across all sectors to ensure the cybersecurity of their products, through fewer vulnerabilities at launch, and better cybersecurity management throughout the products’ lifecycles. The security and surveillance sector will, of course, be included.The Act demonstrates both the importance and the complexity of cybersecurity. No longer can it be seen as one subject, but rather several interlinked areas. Some of these are well established, but others are emerging. In the video surveillance sector, cybersecurity measures that ensure the authenticity and safety of data as it is captured and transferred from camera to cloud to server will be essential to maintain trust in its value.We will see a more proactive approach by technology vendors in identifying vulnerabilities, with ‘bug bounty’ programs becoming commonplace to incentivize external parties. And customers will expect transparency regarding the cybersecurity of security solutions, with a Software Bill of Materials becoming standard in assessing software security and risk management.Beyond securityOne of the most significant trends for the security sector, and with it an equally-significant opportunity, is the move beyond security. Surveillance cameras have become powerful sensors. The quality of video information they capture, in all conditions, has increased year-on-year for decades. Today, through advanced analytics, they also create metadata – information about the video data – which adds another layer of detail and value.The opportunity now exists to combine the data created by surveillance cameras with that from other sensors – monitoring temperature, noise, air and water quality, vibration, weather, and more – creating an advanced data-driven sensory network.We’re already seeing some use of such networks in industrial environments through the monitoring of processes and supporting proactive maintenance. But the use cases in which this network could be applied are limited only by our imaginations, but without doubt they can help improve almost every aspect of our lives, including our safety.Sustainability always, climate change at the forefrontSustainability has been featured in several of our annual technology trends predictions, and we see no less of a need to maintain momentum behind sustainability initiatives in their broadest sense over the coming year. Ensuring that organizations continue to measure and improve the environmental, societal, and business governance practices of their businesses will be essential in respecting people, being a trusted business partner, innovating responsibly, and protecting our planet. All these aspects will come under increasing scrutiny from customers of security and safety solutions.However, given the extreme conditions of the past year, we do expect a more acute focus specifically on addressing climate change in 2023. It’s clear that we are not yet doing enough to stop the acceleration of global warming, and every sector will be expected to double its efforts.For technology companies, however, scrutiny of their own business operations will be just one side of the climate change coin. They will also be expected to demonstrate how their products and services support the sustainability goals of their own customers, creating efficiencies that also help those organizations reduce emissions. For Axis, a key step has been committing to the Science-Based Targets Initiative (SBTi) which will see us setting targets for reducing emissions, not only in our own business but through our entire value chain. An increased regulatory focusInevitably, given its pervasiveness and power, the technology sector as a whole and specific technologies are coming under more regulatory and policy maker scrutiny. We still believe that the focus should always be on regulation of the use cases for technology, not technology itself, and will always comply with local, regional, and international regulation. But it can be a complicated picture.The European Commission is one of the most active in looking to regulate technology in an ongoing effort to protect the privacy and rights of citizens. Its proposed AI Act, part of the Commission’s European AI Strategy, aims to assign specific risk categories to uses of AI and would be the first legal framework on AI. Like the Commission’s AI Liability Directive, the AI Act will no doubt be the subject of much debate before it becomes law. But whether in relation to AI, demands around cybersecurity, data privacy, curbing the influence of ‘big tech’, or establishing tech sovereignty, it’s clear that technology companies in the security sector will increasingly need to adhere to more stringent regulations.

Powered by

With the global economy shifting to self-service, a growing demand for instant purchase and delivery, and everything moving to the cloud, there are some big shifts happening in the world of sales. But where do these changes leave the channel? Forrester has observed channel sales as representing more than 75% of world trade, and in a lot of cases, the channel makes up a significant portion of an organization’s sales strategy. So what strategies will the channel have to adopt to succeed in this changing economy?In reviewing these trends and other market shifts, I’ve developed a few channel predictions that can help us better understand the new channel requirements. Here are the top things I see coming that will force us to adjust our channel strategy.Partner Discounts Lose Steam in Favor of Stronger Enablement ProgramsUntil recently, partner discounts have been the most important element of a partner program. In the next year or two, the priority of partners and vendors will shift to partner enablement.In the SaaS world, the initial transaction is becoming less and less important to the partner. Clients are engaging partners further down the funnel during the sales cycle. Post sales, the adoption of the product is paramount to avoiding customer churn. This means technical training and enablement of partners will be more important than the discount itself. Partners will need to be enabled with the information that is most important to the customer, not just to land the deal, but also to be successful post-sale with the implementation to drive adoption.This will represent a big shift for partner programs. It will be reflected in the way we design our programs and where we allocate our channel budgets. We all have a limited amount of funds that we can put into our partner programs. Most of this budget is put into partner discounts. Going forward, a lot more of these funds will need to be allocated to partner training and enablement.The type of sales enablement training will need to shift as well. Sales enablement can no longer simply be training on the elevator pitch. Partners will need to be trained to speak to what is most important to the customer in terms of customer success. We have to enable our partners to drive business outcomes. Your traditional product sales and technical training will no longer cut it.Partners will need, want, and ask for a lot more help on the technical side, as their business models shift to a services-oriented model. Their business will depend on their ability to provide high-value services that drive customer success. That means rethinking our enablement programs and increasing our investments in enablement so we can deliver better training not just to our customers, but also to our partners.New Success Metrics Shred Metallic TiersIn our partner programs today, the top metric for measuring partner success and partner rewards is sales revenue. Partners move into different tiers, often called metallic tiers, based primarily on how much volume they are selling. As transactions become less important, however, customer success will become the top metric for measuring and rewarding partners, over and above sales revenue.We’re already seeing companies that are moving away from the classic metallic tiers. Microsoft just announced they are shifting to a point-based system based on competencies, certifications, and partner success. While certifications and competencies are important, and will still be counted and tracked, the really important part of that equation is final customer success and a high customer satisfaction (CSAT) score.It is a big challenge for companies to accurately measure how well partners are driving that business outcome. Was the partner able to drive business success with a high CSAT or Net Promoter Score (NPS)? The need to accurately capture these metrics will have a significant impact on channel technologies. In the coming years, we need to see existing customer success platforms, like Gainsight and Catalyst, move into partner success. I also expect to see the entrance of new technologies, and new partner success firms in the channel tech space that will be able to help us track this and measure these higher-priority metrics.CAMs Displaced in the Partner EcosystemOver the next year or so, Channel Account Managers will be replaced by Partner Ecosystem Managers. Accenture sites partner ecosystems as being the cornerstone of business growth. Accenture and other large consulting firms now offer ecosystem consulting services to help companies adopt this business model. This creates a new business reality. Channel managers will have to expand their thinking and their ability to work with different partner types.Today, the most popular position in the channel is the Channel Account Manager (CAM). The classic CAM role involves managing Value-Added Resellers (VARs) and Value-Added Distributors (VAD) and driving transactions to achieve sales targets. Companies, however, are already in the process of expanding their partner ecosystems to include regional and global system integrators, managed service providers, cloud hyperscalers, and a variety of referral and influence partners. This is a much broader role than what CAMs typically had before. CAMs will have to upgrade their skills or be replaced by partner ecosystem managers. Ultimately, we’ll have to redefine the meaning of the word channel from that of the transactional partners to a much broader and more diverse partner ecosystem.

Powered by

As 2023 dawns, security leaders across EMEA will have to deploy a variety of new policies, strategies, and approaches to keep attackers at bay. I feel:

Increased cloud credential attacks, unless… The big shift to SaaS has fragmented more than a decade’s worth of work to simplify and consolidate corporate Identity and Access Management (IAM) systems. What’s more, many new SaaS applications don’t integrate with organizations’ existing single sign-on (SSO) solutions, yet organizations continue to accelerate adoption of new SaaS software, even without the security controls of SSO. Consequently, adversaries will increasingly focus on finding these weaker access points (new SaaS applications) to gain access to corporate and personal data, unless IT and Security departments manage to get IAM back under control.

Deepfakes play a larger role in blended attacks. With end users becoming more aware of social engineering, we can expect more sophisticated attackers will increasingly turn to deepfakes to trick end users into clicking on malicious links, downloading infected files, and the like. It won’t be long before deepfakes become yet another common and core element of the blended attacks being used in the cybercrime kill chain.

The fifth generation of ransomware emerges. A recent report by Cybereason found that 73% of organizations suffered at least one ransomware attack in 2022, compared with just 55% in 2021. As the world reaches saturation of ransomware, adversaries will explore new methods to get money from the same victims. This will be the fifth generation of ransomware.

Lawmakers refocus regulation. In the coming year, regulation in the E.U. will have more of an emphasis on ensuring businesses have truly identified and remediated breaches. This regulatory focus will close the gap between shutting the attack door in the immediate aftermath of an incident and understanding the attack’s impact.

Ransomware will test cloud storage access controls. Cloud storage can give organizations a significant data protection advantage, along with more flexible recovery options. But as ransomware moves from the endpoint to target cloud-only spaces, it creates new risks for organizations, especially those that accelerated cloud adoption during the pandemic and lost sight of where sensitive data lives and who has access to it. This creates weaker credential management, leaving room for ransomware to infiltrate.

Cyberattacks will be transferable between smart devices. The typical cyberattack moves from hacker to device, but 2023 may bring the first cyberattack that jumps between smart devices, including smart cars. We haven’t seen the in-smart environment replication just yet, but with the pace of innovation, a smart car attack could be riding shotgun to the vehicle next to you.

The risk of a significant attack on critical national infrastructure rises. This risk is most presently in EMEA, but it’s certainly top of mind among cybersecurity and national defense experts globally.

Burnout will impact cyber resilience. Security teams around the world have been working long hours from home, adapting their organization’s security posture to support all the shifts in key business systems. Security leaders will need to develop new strategies for supply chain threats.

In the new year, the cybersecurity industry as a whole should re-examine its threat posture and adjust its readiness footing by seeking out the right partners and implementing best practices.

Powered by

In recent years, the role of the CISO has shifted dramatically. With the rise of cyber attacks, CISOs are now expected not only to protect data, but also to be proactive in identifying and preventing potential threats. In addition, CISOs are now often tasked with developing and implementing security strategies for the entire organization, not just the IT department. A decade ago, those who are now referred to as “CISOs” were not considered nearly as important as they are today. Quite often, at the time, they got answers such as, “Can’t you see I’m working?” or, “Oh no, not you again!” Today, the same people get a dedicated seat in that same boardroom. And, many CEOs ask them important questions, valuing their response. These questions actually call for answers, and perhaps the most amazing change is in the tone that is now used. “Can you provide insight into whether or not we can buy this company?” or “If you wouldn’t mind, can you prepare metrics regarding our cyber posture to present to our stakeholders next week”? The newly regarded CISO gets a budget, a team, and the right to directly recruit. Sometimes even, the voice of the CISO prevails over other long-standing professionals established on the upper floor. In fact, over the last few years, the teleworking policy, the collaborative database, legal reporting, and even the development roadmaps of innovative core applications have been placed under their direct leadership.The shift in the role of the CISO from an operations focusIn recent years, there has been a shift in the role of the CISO from an operations focus to a strategic one. This is due to the increase in demands placed on CISOs to protect organizations from cyber threats. In order to be successful, CISOs must now have a deep understanding of the business, its risks, and its goals. They must also be able to build and maintain relationships with key stakeholders.One example is that the board wants more than just a service-level agreement on security incident response. Instead, they are looking for a protection-level agreement to ensure digital assets are continuously patched and protected to proactively react to cyber incidents that may cause business disruption.Gradually, the CISO has become more involved in the decision-making processes. Almost systematically now, when innovation is involved, the CISO’s voice makes a difference. Rather than speaking from the voice of “Mister No” the CISO has turned into a source of inspiration for innovation, rallying data analysts and software developers under the same banner of secure operations development.

Important strategies for CISOs in 2023CISOs should always keep in mind the importance of strategy when demonstrating business value. This means considering both the short- and long-term effects of decisions, and making choices that will benefit the company as a whole. In the short term, it may be tempting to cut corners or take shortcuts, but doing so could jeopardize the company’s security in the long run. It’s crucial to remember that the goal is to protect the organization’s data and assets, not just to save money. An effective way to demonstrate business value is to understand the “kill chain” of a business. Most CISOs are very familiar with the technical concept of the cyber kill chain in cybersecurity, but it’s important to also understand the impact a cyber attack can have on critical operations and the revenue or reputation loss that may result from it.

CISOs should keep the assets or data being protected top of mind, ensuring they are prioritized according to the business value kill chain. They should keep in mind a holistic approach when considering the benefits of the solutions. However, the overall benefit of a whole infrastructure dynamically protected by a holistic ZTNA strategy is far superior to securing the session, the application, or the segment. The CISO must be fluent in articulating these benefits and expressing them in terms of risks so that the stakeholders understand that the pros outweigh the cons.New roles “expected” of CISOs in today’s organizationsThe role of the CISO has evolved and expanded to meet the ever-changing needs of organizations. Today, CISOs are expected not only to be technically savvy but also strategic thinkers who can help organizations navigate the complex cybersecurity landscape.In addition to traditional CISO responsibilities such as developing and implementing security policies and procedures, they are also expected to have a deep understanding of business operations and objectives. They need to be able to align their security strategies with the goals of the organization and create programs that effectively protect against cyber threats. As the cybersecurity landscape continues to evolve, so too will the role of the CISO.In today’s organizations, it is important for CISOs to serve as a leader of change rather than a manager of technologies. Digital transformation is such a big wave that the successful deployment of advanced cybersecurity solutions involves the entire company, all employees included. Policies that change the way people work, such as teleworking, ZTNA, or DevOps need to be explained before they are enforced. Explaining the why of cybersecurity becomes just as important as implementing the how.ConclusionThe CISO’s role is no longer just about protecting the organization from cyber threats. CISOs are now a key business enabler, tasked with delivering business value. Further, they act as an effective communicator to the board of management to help close the organization’s cybersecurity gaps. Today’s CISO is not only an expert in technologies, but is also a strategist, an influencer, and a source of inspiration throughout the entire value chain.

Powered by

Vectra AI releasing its predictions for 2023, revealed the emerging trends that will shape cybersecurity next year. Christian Borst, EMEA CTO at Vectra AI commented, “Next year, organisations will face more unknown cyber threats targeting on-premises systems, cloud infrastructure, and SaaS applications. The skills shortage is worsening too, causing analysts to become overloaded and burnt-out. Combined, this is creating a perfect storm, leaving organisations more vulnerable to a breach. Organizations must adopt an effective detection and response strategy that reduces the burden on analysts, prioritising the most high-risk alerts. This means using tools that can identify the suspicious behaviors that an adversary will exhibit as part of an unfolding attack, flagging up these signals so organizations can stop an attack before it becomes a breach.”

Supply chain attacks will continue but hackers will look beyond the ‘usual suspects’ to cause havoc: Attackers will continue to cause maximum disruption in the form of supply chain attacks, but instead of targeting key suppliers, they will look beyond the ‘usual suspects’ to gain access into networks. For instance, this could include legal or accounting firms. A holistic approach may help turn the tables on the matter: supply chain means partnership — partnership means collaboration and supporting each other. Only as a ‘mesh’ interconnected structure with consistent resiliency can companies thrive in the digital economy. This includes ensuring that they review the security policies of all those in the chain.

Organizations will use automation to recover from ransomware attacks: Traditional restoration procedures following a ransomware attack are both costly and time consuming for organizations; this is why in 2023 we will see organizations look to automation, via infrastructure as code (IaC), to reduce downtime. Through IaC, organizations can develop scripts that enable key infrastructure to self-heal so they can automatically return to action. Ultimately rebuilding broken infrastructure from scratch is a far quicker process than restoring as a result of automation.

Increased analyst fatigue and resignation will see the tides turn away from protecting the castle walls to detection and response: Attackers are continuing to breach the castle walls, creating fatigue and eventual resignations amongst cybersecurity professionals. Instead of working on preventing these attacks from happening and to prevent employee burnout, we will see a needed shift to focus on reducing the impact of an attack. This means building resilience within the organization covering people, process and technology and focusing on early detection and sound response as opposed to protection & prevention.

Multi-Factor Authentication (MFA) will continue to be a prime target for attackers: With identity attacks on the rise, in 2023 attackers will continue to take advantage of vulnerable MFA methods. As companies continue to roll out MFA, attackers will continue to take advantage, either by flooding end users with requests to brute-force their way in, or by skilled phishing campaigns. End users will be the ones directly targeted by attackers. This means not just organisations, but also consumers will need to be more aware than ever of the risks to their digital identities. Meanwhile, organizations must ensure they have tools in place to detect suspicious login activity and stop it in its tracks.

Attackers will begin to steal and keep encrypted data to decrypt in a post quantum world: Advances in quantum computing will force the hand of security leaders in 2023 to start thinking about this sensitive encrypted data in a post-quantum world. However, this approach will also grab the attention of attackers, and instead of bypassing encrypted data that was previously safeguarded, they will attempt to grab the data and keep it stored for sale or to be later decrypted. Defenders should not rest on the laurels of encryption and start to take note of what NIST is doing in post quantum encryption this year for action in the coming years.

As the war for talent increases, security companies will need to develop creative ways to recruit and retain workers: As an industry that is no stranger to burnout and stress, cybersecurity companies will have to ensure they can demonstrate they are an attractive outfit to work for. This is in order to fend off competition from tech companies that can often offer lucrative salaries and superior work-life balance. To achieve this, cybersecurity companies must adopt a more forward-thinking approach, this could include offering flexible working arrangements, performance incentives and health and wellness policies.

Private and Public sector will batten down the hatches against nation state cyberattacks: Cyber warfare will remain a real threat in 2023, from a broader use of known TTPs to an unknown equity of zero days just waiting for the strategically right moment to deploy against one’s foes. Leaders of private and public sector organizations will start to really pay attention, investing more in the incident response and speed at which vulnerabilities are being handled in the coming year to limit the blast radius of such a cyber weapon. Posture, detection, and quick response will be paramount this coming year.

Software and IOT device labelling take a foothold: Labels should state clear facts about the privacy and information security parameters of the product and organization. One key piece of information on labels should be how long a company will support its software, because a physical device may outlast the time a product is supported.

“While the threat landscape might seem daunting, there are technologies out there to give organizations the decided advantage, but action has to be taken now. Regional SOCs need to introduce AI into their security mix — AI that eliminates the noise found in most of today’s IT environments,” Brian Neuhaus, CTO, Americas, Vectra AI added. “The right data, analyzed the right way, will open the door to a new era of visibility and control for security teams. In this Attack Signal Intelligence framework, cyber actors’ TTPs (tactics, techniques, and procedures) become more obvious and allow security professionals to be more effective threat hunters.”

Powered by

Evolved cloud and Multicloud 
The multicloud will increase in importance as more services move from on-premises to the cloud. According to research firm Gartner, it’s expected that on premises versus cloud spend will flip by 2025. While this continued migration to the cloud isn’t surprising, I anticipate cloud adoption will continue to accelerate in 2023 because of supply-chain issues requiring buyers to look beyond on premises hardware to ease procurement challenges and the need to pursue aggressive sustainability objectives. The rapid adoption of multiple clouds is even more interesting. In fact, 89% of companies are using multiple clouds* to manage IT services, operations, and infrastructure. This seems to be a place some companies have “landed” out of necessity, or even by accident, as they worked to mitigate supply-chain issues by linking to multiple cloud providers who could each help them drive innovation and ensure security, scalability, and flexibility outside their data center. This has brought about unnecessary complexity that companies will look to address through the adoption of common services across clouds. (*Flexera 2022 State of the Cloud survey)

Skills Gap
More companies adopting multiple clouds means the skills gap will move from fierce competition between employers to retain top talent, which I’d noted would be an issue in 2022, to one where niche skills will be required to succeed. It’s difficult finding talent that can work skillfully within one cloud. Creating teams skilled in managing multiple clouds becomes a significant challenge and can take extended periods to develop. Companies need teams that can innovate and build. If employees are only spending time on operations, they can’t innovate. This need will only intensify, and companies will need to become more comfortable in hiring for potential over talent, and be willing to provide the team members with the training they need to succeed.

Sustainability 
Sustainability will only become more important to IT buyers, and they will require more data to support claims from their vendors. Vendors will need to show they are working toward (and achieving) greater sustainability throughout their value chains and delivering product features that enable their sustainability. They will have to work harder to increase energy efficiency with their facilities and on-premises equipment and provide improved methods for data categorization that enable buyers to look across their entire data estates and tier data, which is particularly effective in the cloud. When we consider that 68% of data is used once and then never again, we can see how moving this unused data to the cloud, where it can be tiered and moved to cold storage, is beneficial for the planet. Last year, I noted that sustainability was increasing in importance, but it has been interesting to see the level of sustainability specifications and feature granularity that buyers now demand when making purchasing decisions.

Cyber resilience and data protections
The current challenges in terms of health, economy and war mean that cyber-resilience is more crucial than ever before. Businesses and organisations will rely more than ever on IT resources to provide round-the-clock protection and quick recovery for their data. This is because the question is no longer whether they will be attacked, but rather when and how often, so we need to address the problem head-on and a small number of small and medium-size companies are still not prepared. Previously, a business’ cyber defence strategy focussed on anticipation of the attack, but today it is more about reacting during the attack and quick recovery after it. Detection, protection and remediation will be the watchwords of cybersecurity in 2023.

Quantum Hybrid Computing 
Quantum hybrid computing will start to move from ideation toward practical application, problems such as elements of AI will be broken out and passed over to quantum systems for processing, we’ll start to see a blend of traditional HPC and Quantum to solve some of these most complex issues. This will also force us to better address cybersecurity. Companies need to think about data encryption now more than ever. Criminals are increasingly sophisticated, and companies need to be equally sophisticated when it comes to their security measures. While this won’t happen overnight, the wheels have been set in motion for quantum to be a threat to encryption on sensitive data. For example: Imagine designing and building a military fighter jet, which can take more than a decade; Then it’s in service for 20 years and all the data associated with the plane and its missions remains classified for another 20 years. That data needs to be protected for upwards of 50 years. And a criminal only needs to steal that data once during that protracted timeframe and wait for the necessary Quantum power to decrypt to catch up. We need to be thinking much, much more carefully about how we protect data today, from simple data theft to more advanced kinds of encryption and decryption techniques. Normal computers, even high-powered computers, would take decades to “break” these encryption algorithms. Quantum hybrids will be able to break existing encryption protocols in less than a decade so new encryption protocols and algorithms can be developed sooner. While I predicted in 2022 that companies would look to quantum to address more complex computing challenges. I’m pleased there is this level of progress and forward thinking within cybersecurity and a cloud-based approach to now solving security issues that once seemed unsolvable.

Powered by