By Josiah Habwe, Director Process Automation, Schneider Electric East Africa

As the world adjusts to the next normal, the importance of all things digital has never been made more clear. To keep the basics of our society running – from power and water services to online shopping, telemedicine. remote learning and entertainment – digital touchpoints provide vital help in coping with everyday life and mitigate some of the impact current crises have on people’s daily lives. Subsequently, the coronavirus pandemic has accelerated the scaling up of technology both in the public and private sectors. In a world where lockdowns have become the norm, digital is the strategy. However, the growing connectivity of everything presents challenges on the security front.

Cybersecurity threats, defined as an ill-intentioned act to damage or steal data and disrupt operations, are on the rise, everywhere. The Communications Authority of Kenya (CA) recorded 35.1 million cyber security incidents detected between July-September 2020, representing a 152.9 per cent jump from the previous quarter. In the US, the FBI’s crime complaints centre was receiving up to 4,000 cybersecurity complaints a day back in April; before Covid-19 that number was 1,000. It’s fair to say that cybercrime is one of the fastest ­growing ­businesses right now.

In the rush to digital, cybersecurity must not be an afterthought. That is because every new connection, every newly connected device is a potential entry point for bad actors. Operations can become more vulnerable as large numbers of employees work remotely. The main challenge IT (Information Technology) and OT (Operational Technology) leaders are facing right now is to maintain a balance between business needs and keep their organizations safe from threats while ensuring business continuity. So that means when a company sets off on its digital transformation, cybersecurity can’t be an afterthought. There’s too much at stake for them, financially and operationally. Implementing the technology that will converge their IT and OT demands rethinking their approach to cybersecurity.

To support IT/OT and business leaders in effectively tackling these challenges, we have made available an e-Brochure designed to help organizations establish a pragmatic approach and create a multi-layered cybersecurity strategy that will reduce business and digital risk whilst taking into account best practices to protect people, processes and technology.

Here are some steps of a cybersecurity journey, IT/OT and business leaders should be adopting:

1. Secure Your Digital Ecosystem: Understanding digital risk means looking well beyond a sole connected object or database. IT/OT and business leaders must review all the potential risks across the extended digital enterprise, which includes the supply chain and partners. They then have to craft and communicate a digital risk strategy that will be understood by management. We recommend the five-part cybersecurity framework developed by the National Institute of Standards and Technology, which helps organizations identify, protect, detect, respond and recover from threats.
2. Establish End-to-end Cybersecurity Practices: Cybersecurity is not just about your hardware and software. The best approaches with mitigating digital risk take into account people, processes and technologies. As part of putting together a cybersecurity strategy, organizations must begin with identifying risks across this extended enterprise. Take the time to understand where the greatest potential risks are, and what impact any unaddressed vulnerabilities will have on your business. Ensure your suppliers understand and comply with your security policies.
3. Strengthen your Cybersecurity Culture: A defense-in-depth approach is essential to protect all your stakeholders. This will require the support of the entire organization. There are a number of ways to gain buy-in. Firstly, cybersecurity must be framed as a business issue. IT/OT and business leaders must work with other stakeholders to ask questions about the bottom-line and reputational impact of a cyber threat. Look beyond your own boundaries and consider your supply chain and your customers – their safety is your safety. Adapt an always-on, “secure-by-design” mindset and address security proactively during the development and rollout of new processes and technologies, as opposed to a reactive, costly afterthought.
4. Detect and Respond in Real Time: Whilst the focus is on digital transformation, organizations must remember to ramp up their detect-and-respond strategy to be able to counterattack breaches and threats in real time. Technology today allows organizations to monitor threats 24/7, which helps them to anticipate and reduce their impact. Organizations must look to adopt tools such as Security Incident and Event Management Systems (SIEMs) to monitor threats in real-time. As organizations pivot to the Internet of Things (IoT) and increase the number of connected devices in their networks, they should consider including anomaly detection technology to flag anomalous behavior. Rapid response plans will help limit the damage caused by a cyber-attack and help protect your people and assets.
5. Recover and Share Lessons Learned: An incident will occur, and leaders must learn as much from the incident as possible to ensure that future risks are mitigated. Organizations need to put together recovery plans that will include processes to mitigate the cause of the breach, minimize its impact, and outline steps the organization must take to get back up and running as safely, securely, and quickly as possible. One of our key learnings is the need to have everyone in the organization both aware of threats and what they need to do about them. Given that about 90% of malware is still delivered by email, do your people know how to handle online risks?
6. Secure your Digital Transformation: Today, nearly every industrial firm worldwide wants to use digital technologies such as Augmented Reality (AR) and predictive maintenance to improve efficiencies and reduce costs. They are incorporating smart devices that are connected to the internet. This digital transformation journey will need a new approach to cybersecurity. Organizations will need to rethink their approach, with consistent and holistic security updates across devices. IT and OT leaders will need to look beyond their own networks towards risks throughout their entire supply chain.

Cybersecurity will always be a challenge for organizations and it will become increasingly more difficult as digital transformation accelerates and cyber criminals attempt to exploit weaknesses and actively target the growing networks of connected devices. It is time to prioritize developing and implementing a holistic, dynamic cybersecurity strategy that can help you identify, reduce and mitigate threats across the operations lifecycle.

 

 

The writer can be reached on the email: [email protected]