By Wahyu Agung Prasetyo, Head of IT & Cyber Risk Management, Bank Mega
Cybersecurity: Moving Into a New Stage of the Digital Age
Digital transformation brings opportunities for businesses to grow. However, it increases opportunities for businesses to be disrupted. Artificial Intelligence, cloud services, and customer journeys are a few areas where a business can digitally evolve.
Cyber threats also continue to innovate and advance. Phishing campaigns are becoming more sophisticated. Technologies like deepfakes make it easier to impersonate someone. Reconnaissance, or the researching of vulnerabilities, is becoming more advanced. As if that weren't enough, stolen identities and credentials are becoming the norm in today's cyber-attacks.
From a defense perspective, there are a few key things that a business needs to do to stop disruption. These include the ability to predict when a disruption occurs, endure an attack, identify an attack, and stop the attack. Continuously improving on these will help a business get back to business as usual.
This is what Cyber Resilience is all about.
Moving Beyond Prevention
For many years, cybersecurity programs focused on designed to prevent unwanted cyber events. Organizations invested extensively to create barriers to protect endpoints, secure networks, and block malicious activity.
Although barriers to prevention remain vital, prevention alone is no longer sufficient. Organizations have to operate in complex, rapidly evolving, interconnected environments. New applications are continuously added, third parties are integrated to provide services, employees work from various locations, and interact with systems through different means. Customers access the organization and interact with it through numerous, often digital means. Data is sent, stored, processed, and transformed across multiple, often integrated and complex systems.
In these environments, attackers can have many potential entry points.
Cyber resilience begins when an organization starts preparing for the negative events that are likely to happen despite controls being designed to work as intended. The question has to change from “How do we prevent this?” to “What will happen if this happens? How quickly will we recognize it? How will we contain it? How quickly will the organization be able to recover from it?”
This change is gradually becoming the main element of effective cyber risk management.
AI Is Changing Both Sides of Cybersecurity
Artificial Intelligence (AI) is speeding up this transformation.
AI offers improvements to the scale and speed of social engineering attacks. It can help tailor social engineering messages to the recipient, circumvent language barriers, and aid in automating certain aspects of social engineering (e.g. the use of synthetic media to impersonate an individual). When combined with the leak of an individual’s personal information, the use of compromised credentials, Generative AI, and/or Deepfake technologies, users and organizations will find it increasingly difficult to detect and prevent fraudulent actions.
AI will also provide similar, if not better, opportunities to defenders. Security teams will use AI to perform advanced threat hunting, behavioral analysis, triage, and investigate incidents and automate aspects of the Security Operations Center (SOC).
Ultimately, it will not be the technology that will provide the advantage to users and organizations. The real differentiator will be how well organizations govern the use of AI, manage the quality of the data, validate automation, and maintain the right level of human oversight.
AI should enhance human judgment and not replace it.
The Security Perimeter Has Expanded
Another key development is the disappearance of the traditional security perimeter. Companies no longer operate within clearly defined technology boundaries. More and more of an organization’s critical services depend on a range of external parties, including cloud and software providers, fintech and SaaS partners, APIs, outsourcing providers, and others.
This means the organization’s cyber risk is essentially its ecosystem risk.
It is quite possible for a company to have good internal controls and still be exposed to a great deal of disruption due to risks outside the company in the digital supply chain. This means that managing the cyber risk of third parties should be extended to include supply chain management, and periodic questionnaires and compliance reviews are no longer adequate. There is a need for better visibility into key dependencies and data flows, as well as privilege and access management and concentration risk.
The resilience of a company’s ecosystem is as important as the steps taken to protect the company.
Identity Is Becoming the New Battleground
As technology environments become more distributed, identity is becoming one of the most important control points.
Traditionally in security, attackers needed to break through the front door. Now they simply need to look like they belong.
Credentials can now be stolen, accounts can be taken over, and devices compromised. The trust organizations have placed on user identities, biometric identities, and other existing identities can now be abused.
It is not sufficient for identity to be trusted on a single factor. When making access decisions, more should be considered. This includes the user, the device, how the user is interacting, the context of the transaction, the level of access the user has, and the overall risk of the transaction.
If extra controls are determined to be required, risk should increase, and controls should be strengthened. If the risk of a transaction is low, controls should be kept to a minimum to allow the transaction to be as frictionless as possible.
Cyber Risk Is No Longer a Single-Team Responsibility
The most important changes organizations need to make are probably not technological.
The lines between the functions of an organization are becoming blurred. Fraud can lead to customer dissatisfaction and operational disruption, and can trigger breaches of legal and regulatory obligations and loss of reputation.
Meanwhile, in most organizations, the management of cybersecurity risks, technology risks, fraud, third-party risks, operational risks, business continuity, and other related risks are handled as separate management responsibilities. This can result in a number of blind spots.
Strengthening an organization's resilience to cyber risks requires seamless integration of a range of management responsibilities. Real-time information flow and an appropriate decision-making process are paramount. A full range of options should be considered, and the decision should be made in the best interest of the organization.
Cyber resilience is, therefore, an enterprise capability, rather than a cybersecurity capability.
What Leaders Should Prioritize
For leaders, four things warrant special attention.
First is visibility. Organizations should understand their critical assets, identities, data, third-party risks, and emerging threats.
Next is preparedness. Incident response should not just live in policies and playbooks. Preparations should include regular, practice responses, red teaming, and recovery testing.
Third is integration. Functions such as cyber, fraud, technology, third-party, business continuity and operational risk should be integrated.
Last is the commitment to continuous improvement. Every incident, exercise and near miss should be used to inform and improve controls, processes and decision-making.
Cyber resilience is not something that can be completed and moved on from. It is about continuing to enhance preparedness and responsiveness to the ever-evolving risk landscape.
Resilience Ultimately Protects Trust (RUPT)
RUPT is the foundation upon which trust is built. It is especially applicable to financial institutions and other organizations that are digitally dependent. Cybersecurity ultimately protects the systems, applications and data as well as trust.
Customers expect that the digitally offered services are secure, reliable and available. Regulators expect that organizations understand and appropriately manage technology risk. Management expects critical services continue even when disruptive events occur.
Anticipating threats, quickly responding and effectively recovering should all be learned and improved for long-term cybersecurity resilience.
Strategically, for long-term cybersecurity resilience, effectiveness and responsiveness may take precedence over the assumption that most incidents can be prevented.
About the Author
Wahyu Agung Prasetyo is Head of IT & Cyber Risk Management at Bank Mega, Indonesia. His work focuses on cyber risk, technology risk, digital resilience, third-party risk, security awareness, and the responsible adoption of emerging technologies. He is also actively involved in professional discussions on cybersecurity, artificial intelligence, and digital trust.
Latest News
