Over the last few years, trends in cybersecurity have forced the responsbility of keeping networks and systems secure to shift from a handful of IT and security professionals to the entire organization. Now, cybersecuirty is becoming a significant part of any business in the digital era.
Organizations are hard-pressed to do anything new or innovate without considering the cybersecurity implications, and business executives are making sure–or at least should be making sure–that innovation happens with the consent of the cybersecurity team.
“Now what we’re being told as a line of business, is that we have to be in lock step with cybersecurity,” says Theresa Lanowitz, head of evangelism and portfolio marketing for AT&T Cybersecurity.
Things have shifted dramatically over the last handful of years, with the previous model of investing in cybersecurity as needs or incidents arise becoming a risky practice that could spell disaster for any organization.
Now, the “sweet spot” for security investment for any new initiative is between 11% and 21% upfront, says Lanowitz, citing companies’ testimonials to the telecommunications giant.
Because of the heightened importance given to cybersecurity, there is a growing level of cross-functional support in both the culture and budget of organizations.
“We’re seeing cybersecurity step out of the shadows, become a full business partner and become something that the line of business is investing in and expecting,” Lanowitz says.
In short, cybersecurity should have the proverbial full seat at the table at any organization.
However, that strategy is now a baseline, and organizations must be in line with current trends in IT and cybersecurity so they don’t fall behind. According to Lanowitz, there are eight key trends shaping the cybersecurity landscape in 2023.
5G and the edge
According to Lanowitz, the new era of computing is underpinned by 5G and edge technologies. While vendors and businesses have different definitions of edge, Lanowitz says the technology can largely be defined as a software-defined distributed model of management, intelligence and networks with applications, workloads and hosting close to users and assets that are generating or consuming the data.
Edge use cases are generally driven by the Internet of Things (IoT) to collect and transmit data to make logical decisions to derive an outcome, and the new year should bring about an accelerated full-scale roll out of use cases. Those use cases include real-time fraud detection for financial services, automated warehousing with real-tine inventory management and near real-time visual inspections for manufacturing lines, border crossings and available parking spaces, to name a few.
However, these edge use cases require connected systems from the network layer through to application monitoring and management, and each component needs to be secure.
“With more democratized computing, security is no longer isolated,” Lanowitz says. “It is central to delivering strong business outcomes.”
For successful implementations with security at the core, decades-old siloes such as networking, IT, app development and security will need to fade away to enable more cross-functional work, Lanowitz says.
Disaggregation of the Network
According to Lanowitz, disaggregation of the network, or separating it into component parts, means that security tools can actually become part of the network. New types of networks will have more inherent security built in than previous generations.
With the move to the edge, which is software-defined, disaggregated networks can bring in the security components needed at a specific time, Lanowitz says.
“So if somebody accidentally clicks on a malicious link, rather than having that malware spread through the whole network, with a disaggregated network, what you can do is you can say, ‘All right, I know there’s a problem here.’ And it’s going to basically self-heal. It’ll disaggregate into itself and spin up a new version.”
While new and still conceptual, Lanowitz predicts this cybersecurity trend to emerge in 2023.
Securing the Data Lifecycle
According to Lanowitz, edge computing is all about the collection, use and enrichment of data. In edge use cases such as manufacturing assembly lines, the data is hosted and consumed right there using a series of cameras and sensors.
“You’re not backhauling data to the data center for some sort of analytical program to go through it,” Lanowitz says. “It’s near-real time.”
With that near real-time data the most important part of edge computing, it must be protected, in-tact and usable. Organizations should expect to see more solutions designed around the data lifecycle and to help organizations make sure that data governance policies are automated and enforced.
That is especially true as more edge applications are deployed and the amount of data being generated multiplies at a rapid pace.
Applications: Built-in Security
Applications are central in the new software-defined business world, but applications are the last frontier of an ecosystem built with security in mind, Lanowitz says.
In 2001, the Open Web Application Security Project (OWASP) was formed to identify the most common web app security vulnerabilities. In the 21 years since, the OWASP’s top 10 web application security risks have not seen meaningful shifts.
The application is the last mile connecting the user, and as organizations move to the edge, we’ll start to see more applications that are non-GUI based and aren’t traditional transactional types of applications.
“Devices running on the edge will be running headless applets, which will have to transfer data back and forth,” Lanowitz says. “So, the idea of building security from the beginning becomes incredibly important.”
That will force different departments in organizations to work more closely, as software development teams will work in tandem with security, operations, networking and business teams.
That will also put more emphasis on securing the software supply chain and software bills of materials (SBOM).
“The SBOM, the focus on software-defined and the edge coming together will hopefully create that perfect storm … and really spur on the idea of application security and make it more mainstream,” Lanowitz says.
Biometric Security
The cybersecurity community is trending towards multiple and different types of authentication methods, including biometrics such as face scanning, fingerprints and more.
According to Lanowitz, most people have pictures of themselves online, even if they are not active on social media. This makes it relatively easy for bad actors to create digital twins of a person based on a quick internet search. The technology to do so will only improve over time.
“This is one of the next frontiers,” Lanowitz says. “One of the next opportunities for security is the idea of being able to secure biometrics and digital twins.”
The more we use biometrics for authentication methods, the more we’ll give bad actors an opportunity to create deep fakes.
“Biometric security is going to be something we’ll see a lot more of, and I think we need to get used to it,” Lanowitz says.
Threat Intelligence
Gathering information on attacks from a variety of sources and publishing those findings for the entire IT and security community to consume will continue to be an essential part of cybersecurity.
However, that threat intelligence this year will become more relevant and curated. For example, the manufacturing industry should be less concerned about attacks impacting the financial service sector and more concerned with security risks faced in their particular market.
“We’re going to get to this point of relevance and then curation,” Lanowitz says. “You have all this data coming at you and all this information coming at you, but the more curated and relevant it is for you, the more it will help you make those decisions.”
IoT Cybersecurity
Along with protecting digital assets from hackers and keeping data safe, another cybersecurity trend defenders now have to think about how to keep devices capable of causing physical harm out of the hands of bad actors. For example, machines connected to the internet such as a construction tool or a medical device must be secured.
As new AI-driven, internet-connected technology finds its way into cars and other vehicles, these physical devices are now considered endpoints. As such, they need to be protected like a regular endpoint. However, organizations now also need to ensure that these new categories of online devices are also free from physical harm.
“Safety critical devices are the ones that should really give you more pause,” Lanowitz says.
Moving to the Edge
As companies continue to move to the edge, data and application security will be increasingly embedded from the beginning, and Lanowitz predicts 2023 as a big year for that movement.
Companies “born on the edge” will continue the tech disruption that we’ve seen with companies “born on the web.”
“Companies born on the edge aren’t going to have to deal with legacy software,” Lanowitz says. “They’ll have application security built into everything they’re doing. They’ll have data governance and data security built into everything. They’ll have biometric security built into everything.”
If you enjoyed this article and want to receive more valuable industry content like this, click here to sign up for our digital newsletters!
Leave a Reply