A New Perspective on Digital Transformation and Security

by ZeroNorth on August 28, 2019

Sure, the concept of digital transformation has been around for a while, but it’s a lot more than just a buzzword. Virtually every organization today has at least started the process of planning and implementing digital transformation initiatives, if not fully embraced them, which means it’s a trend that won’t be fading anytime soon. And because most companies, from Netflix to Amazon to Starbucks, have now recognized how critical software is to their success, digital transformation has also proven that every business is now a software business. In fact, using digital technology to create brand new business methods, ideas and experiences has become the gold standard for all industries hoping to survive in today’s business environment. But despite its obvious value, it’s still a buzzword with a tricky definition, especially as it pertains to the world of cybersecurity.

Digital transformation isn’t a specific technology, but rather an approach—you could even call it a philosophy—to do exactly what the name implies: use digital technologies and data to transform the way business is done. Much like mechanization technologies in the late 18th to early 19th centuries drove industrial progress, digital transformation is essentially the modern quest for innovation to alter the traditional development and delivery of products and services—or maybe even bring a whole new offering to market. It is the thinking that finally came out of the box. It is the future—and it affects businesses in many different ways. From changing how an organization operates internally to drastically shifting cost structures, digital transformation is all about progress and the ability to shake up standard ideas with revolutionary ones. It is about re-thinking virtually every aspect of your business.

But… there’s a catch. At the same time digital transformation is storming the cyber-scene, the climate of ever-growing cybersecurity risks just gets hotter. In truth, securing your data, applications and systems is challenging under the very best conditions, which means many of the characteristics associated with digital transformation end up working against us to significantly increase our exposure to ongoing risk.

Digital transformation initiatives can mess with your security risk profile…

Just about any digital transformation initiative starts with the connection of more systems, data and, increasingly, things. And every new connection either improves the user experience or enables a whole new one, depending on the technology. But these initiatives can also create potentially dangerous attack vectors, while providing bad actors with a ton of new opportunities for access and the ability to move laterally through a network.

Some technologies driving digital transformation are developed explicitly with security in mind. Blockchain, for example, is secure by design—but the inherent security baked into most other technologies varies. Take the cloud, for example. Whether you decide to go with a public, private or hybrid cloud deployment will depend on the levels of flexibility and security your organization requires from such digital solutions.

Sponsorships Available

Further, digital transformation can lead to system and operational changes that require you to alter your security practices. When DevOps, which brings IT and developers together to deliver higher-quality software faster, works together with microservices, a development approach creating smaller pieces of functionality “as a service,” they can facilitate near-continual delivery of innovation. And with that quick delivery comes the need to ensure new features, as well as those that haven’t changed, while also introducing new security elsewhere in the system.

Even cybercriminals are using digital transformation tools and techniques. As sophisticated players, bad actors have access to the same technologies and approaches we do to change the way they operate. Hackers can use AI to identify system vulnerabilities more readily, and they can coordinate AI-enabled attacks—say, to launch highly personalized and relevant spear phishing emails that yield a higher click rate, or polymorphic malware that changes, or “morphs,” to evade detection.

Digital transformation requires security transformation

These increasing levels of connectivity create coverage challenges. Because these connections traverse traditional silos, current controls—which also tend to be siloed—are no longer sufficient. New technologies introduce new security requirements, which your existing controls may or may not be able to address. And when you operate on rapid release cycles, your testing capabilities must be able to keep up.

In short, you need more security, and faster. But the question is, how? You can’t throw an endless number of point security tools at the problem. Even with a massive budget, which few of us actually have, it would still be impossible to close all the security gaps hidden among the complexities. With the well-documented shortage of security talent, it’s not feasible to throw skilled people at the problem, either. And of course, the answer can’t be to rip and replace. Even if there were one do-it-all solution, which there isn’t, it likely would not be practical.

All this means organizations have to fundamentally change the way they think about and manage software and infrastructure security. It needs to be integrated into your security controls—eliminating silos and sharing risk intelligence—to improve visibility and coverage. Automating testing and assurance throughout the entire ecosystem to contain risk and maintain compliance is key, as these efforts must support your digital transformation consistently and continuously as they evolve over time. It’s no longer about just the individual components of your security framework; you must focus on how they are orchestrated to build a more effective security posture.

As they say, digital transformation is a journey, not a destination…

Businesses looking to maintain innovation will continue using digital technologies to transform what they do and how they do it. But as long as this process of transformation continues, which it surely will, we must also work to ensure security and compliance practices keep pace to minimize risk and promote our digital well-being.