The US National Institute for Standards in Technology (NIST) defines cyber resilience as “the ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that include cyber resources.”
As part of our effort to push the cyber resilience topic into the mainstream of tech, security and business discussion, FutureCIO spoke to Peerapong Jongvibool, regional senior director, Southeast Asia and Hong Kong, Fortinet, about cybersecurity and the need for cyber resilience
Jongvibool says: “To boost cybersecurity posture, we need to look at cyber resiliency, which involves not just the technical aspect of it but also the processes within the business.”
In his mind, Jongvibool sees the linkage between cybersecurity and cyber resilience. Like his peers in the information security industry, he also believes that technology alone will not be sufficient to achieve cyber resiliency as it needs help from people to support the technology.
Visibility is of paramount importance to any cybsersecurity strategy. Only then can an organisation have the insight to execute whatever the next step needs to be.
“Implementing cyber resiliency requires a more proactive approach. At times, cybersecurity is viewed as just threat detection alone, and there is no response plan to mitigate the impact of the threat. Cyber resiliency requires a well-defined cyber threat response strategy and follows a more tactical approach by leveraging the solutions available within the organisation,” he explained.
Cyber resilience during a pandemic
Cybsersecurity solutions can often be seen deployed in a command-and-control setting. It does not have to be in the scale of a Security Operations Centre (SOC) or Network Operations Centre (NOC). Before COVID-19, most organisation’s information security team
According to Jongvibool, security often covers both assets and data. It is important to be able to identify any potential attack surface. However, remote working, forced upon us by the pandemic, expanded the attack surface and risk levels.
“Organisations need to have visibility on their critical infrastructures and define their vulnerabilities. By doing this, organisations can then introduce the security parameters and the processes that will help protect their infrastructure,” he added.
The ‘good’ thing that came from the pandemic
Tradition has it that organisations maintain a limited scope in terms of how they build their infrastructure. Typically, this means a centralized view of assets and data – everything is behind a walled structure protected with every known technology. There was also a rhythm or pace at which new technologies are introduced.
The pandemic changed all that. Today, organisations need to implement sufficient steps and scope to cover their parameters. With remote work and more customers and organisations working online, security teams now have to think of both external and internal vulnerabilities in equal measure. Hence, the growing discussion around zero trust approach to security.
Security trends after 2021
Jongvibool sees the digital transformation trend to continue as organisations navigate the changes happening in our current environment.
He noted that remote working has resulted in an increase in the adoption of endpoint detection and response (EDR) solutions compared to the previous year. With remote work continuing, he anticipates the expansion of EDR solutions. Finally, he foresees more devices and technologies connecting to the company network.
“To strengthen cyber resiliency, IT leaders need to establish a holistic view of the company's infrastructure. This means IT teams need to map out everybody in the organisation, including remote workers, onsite employees, and devices across the platform whether on-premise or in the cloud,” he opined.
He also believes IT teams will need all the help in monitoring the entire company network and with this, organisations would need to leverage an integrated and comprehensive platform.
Click on the podchat player to listen to Jongvibool elaborate on the evolving nature of cyber resilience.
- Let’s start with definitions: what is cyber resilience and how is it different or related to cybsersecurity?
- What are the benefits of cyber resilience?
- What are the key elements of cyber resilience?
- What are organisations doing wrong when it comes to cyber resilience?
- We are in the second half of 2021. Can you name 3 trends you think will be important to organisations in Asia as they look to strengthen their cyber resilience posture?
- What is your advice to CISOs and CIOs as they look to enhance their cyber resilience strategy?
