Cyber Insurance and the Threat Landscape
In the recent years, the threat landscape has significantly changed and will continue to do so. In the near future, healthcare and health insurance industry will continue to be a prime target for cybercriminals. We should now get ready for “Medical Identity Fraud”. Healthcare records hold an immensely rich content of valuable data for an attacker. No other single type of record contains as much sensitive information that can be used in a multitude of attacks and fraud.
Cyber Insurance will be a new norm due to the high profile breaches in the last couple of years that wreaked havoc on many enterprises. Cyber Insurance will be gaining velocity and popularity. The Board and the C-Suite will have an appetite for reducing risk by offloading it to insurance providers. Reduced Cyber Insurance premiums will be a new business benefit advertised by security vendors. Premiums will be reduced when a company demonstrates proof of having critical security controls in place.
Old code new chaos! New vulnerabilities will emerge from decades-old source code. Huge vulnerabilities such as Heartbleed and Shellshock have existed within open source code for years, but were discovered recently when scrutinized for weaknesses with a fresh pair of eyes. It cannot be assumed that they have not already been exploited before they were made public.
With so much code written and in use, it’s impossible to catch every dormant risk avenue until they’ve been exploited. Unfortunately, security is still not built into most development cycles. As the source code gets used and altered into a new application or service, another risk is added
Cyber security & challenges faced by the CISOs
A CISO’s role is now evolving to balance risk and business. In today’s world, a CISO needs to have skills to effectively communicate with the board as well as executives in various parts of the business. The biggest change in the CISO role is to be able to run security as a business to enable innovation and growth. Communication is the key, where CISOs need to be able to deliver the right message to secure investments. Instead of technicalities, CISOs must learn to express challenges and solutions in business terms, for example, cost of application downtime, amount of lost revenue due to a compromise. CISOs need to grow from just a subject matter expert to someone who can advise on how to improve business in a secure manner, someone who is a leader and a facilitator.
Rather than thinking of Cyber Security only during a breach, a CISO needs to locate cyber security issues within the business decisions that a Board makes, such as mergers and acquisitions, new product launches. Security should be a part of these decisions just as legal and financial issues.
Physical security as well, is becoming commonly grouped with traditional information security, as many threats are better dealt with holistically. Because of this, in some enterprises the job title is CSO rather than CISO
Cloud deployment of IAM solutions
The “cloudification” of IT is accelerating. We are seeing big organizations using the cloud. More and more financial institutions are offering services via SaaS platforms. Major initiatives that have worked in the favor of cloud are the new compliance mandates for the cloud such as ISO 27016, SSAE 16 etc. They are contributing to the Cloud phenomenon, because they enable businesses like ours to validate our security posture and risk levels. It has helped me turn the focus on Information Security from being a cost center to a revenue generator
Users and their identities are the most vulnerable link in the network. One of the major things to consider in a cloud deployment is identity and access management. A good Identity and Access Management (IAM) solution in place not only takes the burden of review management but also makes it efficient to manage a host of cloud applications, and an equally large number of types of users.
A flexible IAM solution that provides authentication and authorization services to Cloud, Mobile and Social Interaction within our enterprise IT solutions is a must have. It will enable im¬proved secure collaboration with our partners and vendors.
Initiatives to manage data vulnerabilities
I would list four most important initiatives to start with. The first and the most important initiative is to start with the “Data”. Follow the Data! We must be innovative and change.