Protecting Collaboration Channels for Remote Work

As COVID-19 unfolded in the first half of 2020, many of us set out to explore its long-term ramifications and imagine what the ‘new normal’ could look like. We also wanted to understand the second- or third-order effects of remote working and accelerated digitalization. Cybersecurity became one of the key areas of focus. As many in the enterprise began to look at upgrading their applications and architectures, the security of those applications would have to follow close behind. This opportunity was validated by hackers themselves; in the first few months of COVID-19, phishing attacks increased by more than 600% in under a month.

New Communication and Collaboration Tools Need New Solutions

The reign of email as the sole communication and collaboration tool for the enterprise is long over. Even before COVID-19 hit, the average enterprise organization used more than six different enterprise communication and collaboration (EC&C) applications. The prevalence of these applications has since exploded further, and usage has expanded from internal collaboration to include customers, partners and subcontractors. From the hacker’s perspective, EC&C apps are a dream come true for three reasons:

• They are used for sharing content (for example, text, files and URLs)
• They are perceived as being safe by the users (unlike email)
• Usually, they have little to no built-in or third-party security

As a result, these EC&C platforms, such as Dropbox, are the perfect distribution channels for malicious files or URLs, since any uploaded content is instantly propagated to all members of a shared folder.

The ‘API-ification’ of Software

Shifts in technology paradigms often disrupt existing, mature industries and produce higher quality products and services at cheaper prices. When that disruption fuses with an opportunity, like the one we see now, to serve entirely new markets, it becomes particularly interesting.

My team and I believe the next generation of significant software companies will be created through the ‘API-ification’ of software, where application programming interfaces (APIs) are used for integrating one piece (or pieces) of software to another (or others). APIs have existed for decades, but we believe their impact on the broader economy is still in the early days, as Markus Suomi investigates in his recent article here.

API-ification impacts both the development and consumption of software. On the development side, APIs allow software to be built modularly by stitching together both internally and externally built components. This leverages the comparative advantage of each company – why build a global telecommunications infrastructure yourself when you can integrate with, say, Twilio? On the consumption side, API-based SaaS companies create value by abstracting a business capability, such as document data extraction, and provisioning it over an API rather than providing a UI for a human to interface with.

API-based approaches have not yet been widely adopted in cybersecurity – it is an industry that is dominated by incumbents with broad end-to-end platforms. In email security, for instance, secure email gateways, provided by the likes of Proofpoint and Cisco, have been the gold standard. The issue is that these platforms are based on an old architecture – they struggle with detecting advanced attacks, they operate at the perimeter without any visibility into internal traffic, and typically, they can only protect email.

Sophisticated attackers know how to use social engineering or other means to circumvent these incumbent security solutions. If you do security correctly, the defense can handle the changing threat landscape. If you fixate on taking the fight to the adversary, they will gain the upper hand. We need to focus on ‘getting the code right’ by adding security tests into the DevOps process and embedding them into the applications via scalable and adaptable APIs.

In the new normal, API-based, cloud-native SaaS solutions secure any communication and collaboration channel against any type of attack, including phishing, malware or business email compromise. That approach provides users with several key advantages.

Using Q, our AI software, we have identified 15 companies with high potential that are poised to grow in this space: