NEXTDC : Security in the ‘digital age’ means being ‘ready-for-anything’

By George Dionisopoulos, Head of Security

In a disrupted digital world - with advanced known and unknown threats everywhere - adopting a proactive 'ready-for-anything' approach to security is crucial. 

Australia's critical digital infrastructure relies on international digital supply chains, meaning exposure to threats both locally and globally. For example, the American subsidiary of a Brazilian meat processor was hacked from Russia, an attack that brought the company's operations down all over the world, including here in Australia.

Meanwhile, ransomware attacks continue to be targeted for maximum effect. NSW's Department of Education's remote teaching portal came under attack in early July (2021) just as teachers were preparing for a home-schooling response to the state's most recent lockdown.

Research from ESG (State of Security 2021) highlighted that 49% of organisations say keeping up with Multi-Cloud security is harder than two years ago, while 48% of organisations see the threat landscape as exponentially more sophisticated.

As organisations modernise, transform and morph into 'elastic cloud enterprises', security has to evolve in-step with these accelerating risk complexities. In the same way that cloud migration is enabling automation, scalability, flexibility and agility, security must follow suit.

Security central to digital strategy

Key considerations when optimising a 'ready-for-anything' security approach include: 

• Merging physical and cyber security;
• Realigning security, risk and compliance strategy to flexible, agile and scalable infrastructure and connectivity;
• Ensuring security frameworks are layered with multiple built-in security principles;
• Partnering strategically to bolster finite skills, resources and capital;
• Establish automated, proactive, low touch response mechanisms addressing present and future threats;
• Understanding the risk mitigation role of physical security.

This means robust physical environments, supported by cutting edge technology and education to create awareness and vigilance is still the most important component of holistic security strategy.

Evolving landscape

Never underestimate the damage a security incident can create. ESG's State of Security 2021 report found 39% of organisations have experienced a data breach within the last two years. Consequences include:

• Cost of remediation;
• Lost productivity;
• Service interruption;
• Process breakdown; and
• Confidentiality breaches.

These disruptions come with significant bottom-line and reputational risk. There has been a raft of high profile cyberattacks recently, including 1500 companies across the world exposed to a ransomware attack through a vulnerability in Kaseya's MSP platform.

In June this year, personal health-related information was stolen from NSW Health following a cyberattack while late in 2020, 59 Aged Care Royal Commission documents were impacted in a cyber security incident.

Between January and April of 2020, cybercrime experienced a frightening 630% increase in incidents as new ways of working ushered in new vulnerabilities to exploit. It's impossible to know where the next accidental breach, vulnerability or attack will emerge.

The 10 top threats to information security are: 

• Human error
• Physical and environmental security
• Malicious insider
• Document management
• Pathogens
• Phishing
• State actors and foreign intelligence services (FIS)
• Access control
• Inadvertent disclosure, and
• Hostile third parties. 

Merging 'physical and virtual' security

Digital systems, infrastructure and data are now so intrinsic to risk management and organisational success that security has shifted gear from important to mission critical. When we think about an organisation's security posture, it should not be underestimated how important physical security is and how it aligns with the cyber security strategy. 

Physical and cyber environments have merged. You can't have one without the other. In fact, you need to have the right people, processes and technologies in place across both disciplines to enable holistic real-time monitoring of infrastructure..

Additionally, access management must be governed diligently, with the capability to forensically look back at past events to understand how breaches happened and remove the potential for it to reoccur.

Where to next?

Managing security in alignment with cloud migration strategy changes the game completely and it is getting harder to address as fundamental laws of demand and supply push the cost of appropriately skilled personnel to unprecedented levels.

Staying on top of an evolving threat landscape can be made less complex by partnering strategically with service providers who tick off core elements of a proactive, elastic security posture for you.

Locating as much of your critical infrastructure as you can within facilities that meet all critical certifications circling digital security is a great start. Achieving compliance with frameworks and standards managing physical security minimums such as ISO27001, SOC1 and SOC2, PCI DSS and SCEC is not easy to achieve or maintain, so look for service providers that introduce this as part of their standard SLAs.

Getting behind these barriers should also land you in a connected ecosystem where the additional cyber defence service providers are colocated and waiting to support your risk mitigation. Defence postures are dramatically improved when you are just a cross-connect away from service providers specialising in flexible, proactive and always-on cybersecurity threat management.

The main thing to take away from this discussion? Security in a Multi-Cloud world is an evolving beast requiring flexible, agile strategy where you're ready for anything and prepared to minimise the impact that breaches have on business continuity.

Reach out to NEXTDC if you want to better understand how partnering strategically will ease the stress that inevitably accompanies security vigilance and allow you to get back to a focus on core competencies.