Strategic Insights on Cybersecurity Risks with Emerging Technologies

 

By Omodiaogbe Samuel

Last Updated: December 2, 2023

Emerging technologies are disrupting traditional ways of doing business, new markets are being created, and with every innovation the world becomes more and more digitally connected. The digital transformation has led to new capabilities such as enabling e-health, e-governance, e-learning, smart cities, automated home devices, smart factories, autonomous vehicles, and general efficiency in service delivery. These capabilities are been powered by emerging technologies such as blockchain, cloud computing, quantum computing, internet of things (IoT), machine leaning (ML) artificial intelligence (AI), 5G technology, and robotics. These technologies not only enhance efficiency, but also effectiveness in value creation and delivery. Digital transformation is an ever-evolving landscape that requires leadership agility and adaptability. Therefore, the classical linear approach to strategy is no longer sufficient anymore to guarantee sustainable competitive advantage. Now business model rises and fall in rapid speed. Continuous disruption is going to be the new normal. And so, you will either disrupt or be disrupted

Most experts say that there are only two kinds of organizations today—those whose information security have been bridge, and those that don’t know that their information have been bridged. The sophistication of modern cyberattacks, the persistent nature of advanced threats, and the importance of managing business risk on a continual basis requires enterprises to reevaluate their entire security ecosystem. In the digital enterprise, everyone should be an IT expert, to some degree, as technology becomes core to all businesses. Organizations that prepare for uncertainty and approach their digital transformation with a security-focused mindset will be better positioned to survive this increasingly hostile connected ecosystem. As a result, cyber safety has to be imperative for any organization and it should be a comprehensive program that addresses the administrative, physical, and technical controls as an integrated suite. As a result, we need to have a deeper insight on each of the emerging technologies and the cybersecurity challenges they pose

Cloud Computing

According to NIST, “Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction”. The key benefits of cloud computing are flexibility, scalability, pay-per-usage, integrated data management, broad network access, resource pooling, rapid elasticity, and agility. However, cloud computing also poses cybersecurity risk despite the benefits if offers. Cloud misconfiguration occurs when computing assets are set up incorrectly, often leaving them vulnerable to malicious activity. Some common examples include unsecured data storage elements or containers; excessive permissions, default credentials and configuration settings left unchanged, standard security controls disabled; unpatched systems and logging or monitoring disabled; and unrestricted access to ports and services. Misconfiguration of cloud resources is a leading cause of data breaches and could allow deletion or modification of resources and service interruption.  Also, malicious actors may leverage cloud computing resources to target users, organizations, or other cloud providers. Malicious attackers can also host malware on cloud services.

As an increasing number of businesses move to the cloud, the security of the cloud has become a priority for organizations working with a cloud computing provider. Regardless of the deployment model selected–private, public, community, or hybrid—conquering security concerns is required for cloud computing to achieve its full potential as the next generation of IT architecture. Consequences of data leaks could include reputational damage, brand value degradation, legal liability exposure, and sensitive personal and business information disclosures. As cloud business models and cybersecurity management evolves, organizations need to be cognizance about critical data security issues. Developing security architecture and implementing a robust security strategy will provide organizations with a strong foundation to operating business activities in the cloud. Therefore, cloud computing strategy need be holistic and should comprise the security architecture and the business processes, with the overarching goal of building a culture of cyber-resilience for the organization.

Blockchain Technology

Blockchain is a technology for a new generation of transactional applications that helps establish security, trust, accountability and transparency. One of the key capabilities of blockchain is the ability to maintain a record of the history of all transactions in a way that cannot be manipulated. Decentralization is one of the main reasons why companies adopt blockchain technology. Traditional databases kept in a centralized location makes it easier to attack, as the coding is also concentrated in a single place. In the case of blockchain, when an unauthorized person tries to tamper with a block of data, the system checks each block to ascertain which one differs from the rest and simply discard the block it found to be false. With blockchain, trust come from the network itself instead of trusting a middleman institution like the conventional internet. On the blockchain―particularly the permissionless one― anyone will be able to issue, trade, and settle traditional debt instruments, peer to peer. This will reduce cost and risk, by increasing speed and transparency. So, rather than the internet of information, we now have internet of value. The first era of the internet was driven by computation, and communication technology. The new era powered by blockchain is a combination of computer engineering, mathematics, cryptography, and behavioral economics. The key benefits of blockchain are faster speed, lower cost, greater security, fewer errors, and elimination of central point of attack or failure

Blockchains are exciting from a cybersecurity perspective since they are currently perceived as much safer than traditional databases and less impervious to manipulation and fraud. While the core capabilities of blockchain add tremendous efficiency and de-centralized authorization of transactions, these same properties, like many other innovations, have also been used for nefarious purposes. For example, blockchain enabled cryptocurrencies, such as Bitcoin, are the preferred financial instrument of cybercriminals focused on executing ransomware. With this technology, is easy to move the funds multiple times and difficult to map the underlying holder of a bitcoin wallet to a true individual. Also, cryptojacking campaigns targeting victims’ computers to mine cryptocurrencies is fast increasing. Other families of malware have also been discovered. For example, CookieMiner, that uses a sharing code with a past campaign aimed at stealing wallets and credentials has also been discovered. Therefore, the blockchain as exciting as it might seem also poses some technical and security challenges. Therefore, the right strategic approach is not to see blockchain as the panacea to all cybersecurity challenges, but as part of the broad-based security architecture 

5G Technology and Internet of Things (IoT)

5G (Fifth Generation) technology is designed to be the getaway to the automated and interconnected components of critical industrial and societal networks.  5G telecommunications networks promise download speeds of 10 to 20 times faster than legacy networks. Although 5G includes new hardware, it is first and foremost a virtual network that brings a convergence of networks and wireless communication into reality. The technology has the capacity to unleash a wave of innovation, but the greatest impact will perhaps be felt through new or enhanced uses of wireless technology. We are on the threshold of a world supported and connected by 5G-enabled massive Internet of Things (IoT) connectivity. An era where the technology provides the bedrock for 4IR (4th Industrial Revolution) operating models such as smart cities, smart homes, smart transportation, smart healthcare and myriad other potential use cases. However, keeping 5G networks secure will be key to realizing the full potential benefits for consumers, businesses and entire societies alike, and for ensuring the safety of end users.

The Internet of Things (IoT) refers to system of connected computing devices, along with mechanical and digital machines. IoT devices have the capacity to generate, store, and send data, or act on remote commands. These devices can transfer data over a network without requiring human-to-human or human-to-computer interaction. IoT involves many technologies and has evolved to include a convergence of technologies ranging from analytics, to machine learning, to embedded systems. However, as the IoT opens new windows of opportunity for businesses, it also introduces new types of risk. Many IoT devices were not designed with security in mind. Some lack the onboard processing power or memory to provide robust security controls. As more IoT devices are produced, the attack surface and potential vulnerabilities is expected to expand quickly and therefore outpacing current methods to defend against them. The digital nature of 4IR technologies makes them intrinsically vulnerable to cyberattacks that can take a multitude of forms—from data theft and ransomware to the overtaking of systems with potentially large-scale harmful consequences

It’s important to note that many of the security vulnerabilities commonly laid at 5G’s door are not actually specific to the 5G technology itself but to the connected devices. Therefore, effective security in a 5G world requires every participant in the value chain to play their part. Such approach lays the foundation of a sound cyber strategy and will ensure that companies can roll out 5G quickly and safely. For IoTs, three strategic lenses can help executives set their organizations up for success in managing cybersecurity risk. First, they need to understand what IoT security means for their specific industry and business model by considering where it lies in the value chain, and the industry structures in which they operate. Secondly, they should set up clear roles and responsibilities for IoT security along their operations by considering all layers of the application, communication, and sensors. And thirdly, they should engage in a strategic conversation with the regulator, vendor, standard bodies, and other industry players on how to make IoT more cyber-resilient  

Artificial Intelligence (AI) and Machine Learning (ML)

Artificial intelligence (AI) is wide-ranging branch of computer science concerned with building smart machines capable of performing tasks that typically require human intelligence. AI is an interdisciplinary science with multiple approaches, and its scope comprises but not limited to machine learning and deep learning that are creating a paradigm shift in virtually every industry. AI offers huge opportunities for cybersecurity. Tools that use AI can help organizations become more effective in combating cyberattacks by bridging the skills and resource gaps, thereby helping them identify and prevent cyber threats. AI in cybersecurity is a set of capabilities that allows organizations to detect, predict and respond to cyberthreats in real time using machine and deep learning. It can be used to identify vulnerable areas within different parts of a business and remediate errors within them. This is because you move from detection, manual reaction and remediation towards an automated remediation, which organizations would like to achieve. Using AI for cybersecurity enables organizations to understand and reuse threat patterns to identify new threats. This leads to an overall reduction in time and effort to identify incidents, investigate them, and remediate threats.

However, there are fundamental limitations to AI algorithms that attackers can exploit to make the system fail or misbehave. The algorithms that make AI systems work well, also contain imperfections, and these limitations create opportunities for cyberattacks. Adversaries can use capabilities in AI to perform a wide range of tasks. AI can be used to automate capabilities that formerly required human analysis for high levels of effectiveness. For example, AI can be used for spear-phishing whereby the technology is used to craft a message that the victim will trust or interact with. AI also can be used to build customized content automatically for a specific user based on content found within their social media information or other feeds. Moreover, AI capabilities is very well suited for classification and scoring based on input data such as determining which of a set of potential targets or environments would be viable to breach. Attackers can train their data based on attributes about their environments and the effectiveness of past attacks and then focus their efforts where they will attain the highest return on their investment. It’s obvious that AI is already being deployed by both network defenders and those attacking them, and therefore it’s difficult to tell where the balance of advantage lies. This gamification is part of an accelerating arms race between AI attack and defense methods.

Machine learning (ML) on the other hand is a sub-field of artificial intelligence that aimed at empowering systems with the ability to use data to learn and improve without being explicitly programmed. It relies on mathematical models derived from analyzing patterns in datasets, which are then used to make predictions on new input data. Whereas, deep learning (DL) is part of a broader family of machine learning methods based on learning representations of data. One of the promises of deep learning is replacing handcrafted features with efficient algorithms for unsupervised or semi-supervised feature learning and hierarchical feature extraction. By incorporating machine learning in the security work flow, man-machine can join forces and accomplish things at a degree of speed and quality that would have been otherwise impossible. However, there have been cases where cybercriminals leverage on machine learning to create intelligent malware that can outsmart current intelligent defense systems. Hence, as the field of machine learning progresses at a rapid rate while offering promising solutions for cyber defense, it also makes it possible for cybercriminals to use it in carrying out more sophisticated attacks at scale

Quantum Computing

Quantum computing is a form of computing that relies on the principles of quantum physics to solve specialized classes of mathematical problems that were not practical to solve on traditional computers. Quantum computing could dramatically reduce the time needed to solve the mathematical problems on which encryption techniques currently rely—from months to minutes and seconds. Quantum computing holds the promise of solving complex problems that are practically insurmountable. Today’s key exchanges, encryption and digital signatures that protect financial transactions, secure communications, e-commerce, identity and electronic voting all rely on mechanisms that would be made redundant by quantum computing.  Quantum algorithms have the potential to bring about major advances and transformative benefits in a range of use cases across industry.

However, it is still early days of quantum computing and the full potential is still years or decades ahead. Therefore, it is not yet fully understood how quantum cryptography will affect the balance between attackers and defenders, nor how this will play out commercially or politically. Also, there has been much skepticism about the prospect of a large-scale quantum computer in the foreseeable future. It is likely that quantum computing would be misused for malicious purposes. Criminals would seek to access quantum in exploiting computational power to advance cyberattack capability, although the extend has not yet been fully known. Significant investments are being made in quantum research and development by major technology corporations, national governments and venture capitalists, but the extend of its impact is yet to be fully comprehended. One possible solution is sometimes known as post-quantum cryptography, and refers to conventional ciphers based on mathematical problems other than factoring and discrete logarithms. The possibility of that I believe is secure against quantum attack.

Cybersecurity Strategies for Competitiveness

Hacking has become a burgeoning global industry that generates billions of dollars in illicit trade annually. The business is fueled by market for zero-day vulnerabilities as well as strong reseller’s market in which criminals and criminal organizations sell hacking tools and stolen data to others who possess the desire but not the ability to harvest the valuable intellectual property.  According to McKinsey report, every year, hackers produce some 120 million new variants of malware. New attack methods and malware are shared readily on the ‘dark web,’ each more sophisticated than the last. The game theory between attackers and defending organizations is no longer a competition, the adversaries have pulled ahead. Information security professionals have realized that eliminating the possibility of a breach is an unrealistic goal in today’s environment. Therefore, a new approach is needed in order to prevent modern cyberattacks. This new approach must account for the realities that today’s attacks are not only multidimensional in nature but are also increasingly using sophisticated set of techniques that are constantly in a state of change. The truth remains that, so long as we continue to try to address the cybersecurity issue from a technocentric perspective and ignore the fundamental economics that is driving it, we are destined to continue to fail. The problem is not that the technology is bad. The problem is that the technology is under attack. And the reason the technology is under attack is because all the economic incentives favor the attackers.

There are certain myths in cybersecurity that need to be corrected. First, ‘the more we spend, the more secure we will be.’ Throwing money at the problem may seem like a good idea in the short term—particularly when an intrusion occurs—but in the long run, such approach is not sustainable because a holistic cybersecurity goes beyond money, but involves processes, compliance, people, and cultural shift. Second, ‘external hackers are the only threat to corporate assets.’ According to McKinsey report, threats from inside the company account for about 43 percent of data breaches. The very people who are closest to the corporate assets can often be the weak link in a company’s cybersecurity program. Insider, whether they are poorly trained, distracted, angry, or corrupted, can compromise many of the most effective technical solutions. Particularly when they share passwords or files over unprotected networks, click on malicious hyperlinks sent from seemly known or unknown email addresses, or otherwise act in ways that open up corporate networks to attack. Third, ‘the more advanced our technology, the more secured we are.’ When companies invest in advanced technologies, but do not understand how best to use them or cannot find properly skilled administrators to manage them, they end up creating significant inefficiencies within the cybersecurity structure, thereby compromising the cybersecurity program overall. From the above myths, it could be discovered that most cybersecurity programs fail due to wrong approach and misperception about the program

The ever-evolving threat landscape and new methods hackers use to conduct a breach, combined with the growing shortage of skilled security professionals means organizations need to have a prioritization approach to cybersecurity. With mounting vulnerabilities and sophisticated nature of the adversaries, organizations can no longer protect against all risks equally. The idea that some assets are extraordinary and of critical importance to a company must be at the heart strategic approach. As a result, the strategy should promote alignment, clarify objectives and priorities, and help focus efforts around them. The right cybersecurity strategy therefore should be built one step at a time, based on the understanding of relevant business processes and the mindset of prospective attackers. This requires effective leadership, and so, top executives must lead an enterprise-wide effort of protecting the critically important data, software, and systems as part of an integrated strategy to achieve digital resilience. The executives need to ensure that the strategy protects the most valuable assets, where a breach would pose the greatest potential business damage, whether in terms of reputation, regulatory intervention, or the bottom line.

All stakeholders in a company’s ecosystem— board of directors, executive, management, IT leaders, staff, vendors, and suppliers must come to a mutual understanding of the risks the company faces and work together on the best approach to addressing them. Regardless of who is appointed to oversee cybersecurity efforts, cybersecurity should be a shared responsibility across the entire enterprise, including senior management, staff, consultants, partners, and clients. There should be a collaborative effort across the board, and in particular, the IT personnel need to work together as a team. The teams of the chief information officer (CIO), the chief information security officer (CISO), and the chief risk officer (CRO), as well as the other members of the IT units, all need to work collaboratively to manage cybersecurity risk. There need to be trusting relationship among all the stakeholders about how to secure the critical business and the best approach to responding to the ever-advancing cyberthreats. Also, security must be a shared responsibility across the business units. It must be embedded in various business processes, with the overarching goal of building a culture of resilience. Cybersecurity management can no longer be a concern delegated to the information technology (IT) department alone. It needs to be everyone’s business — including the boards.

The cyber threat landscape is continuously evolving with the advancement in technologies such as blockchain, 5G, IoT, AI, ML, DL, quantum computing, cloud computing, and the proliferation of digital platforms. Keeping pace with emerging technologies and the threats they potent are bound to overwhelm many organizations and the risk mitigation mechanism that they might have currently deployed. Organizations might have the best cybersecurity infrastructure in place, but could still be hacked through the weakest link―the people. What the adversaries do is to target the employees with well-structured social engineering and phishing based on reconnaissance on the target. The method could look so authentic that even a highly aware employee could fall prey to clicking on an innocent-seeming email, downloading a legitimate-looking attachment, or revealing information to a seemingly trustworthy source. For an organization to be proactive in the era of technological proliferation and be on top of the game for its cybersecurity posture, continuous training is mandatory. A well-trained staff can serve as the first line of defense against cyber-attacks. In general, people are not aware of the risk that they face every day and therefore, there is need to communicate to the employees the complexity of their daily work. The mind needs constant reminder, and so single awareness briefing is unlikely to be sufficient, it has to be on regular basics

Conclusion

As technology continues to revolutionize the world and threats to business operations become increasingly complex, organizations will need to rethink how security is integrated across the components that makeup the modern infrastructure. New technologies are disrupting traditional ways of doing business, new markets are being created, and with every innovation the world becomes more and more digitally connected. In the age of the “Internet of Everything”, we are headed for a collision as emerging technologies coupled with billions of devices being brought online, thereby creating new vulnerabilities and headaches for executives. Certainly, no cybersecurity program can ever be 100 percent foolproof because the threat landscape is changing too quickly. And no one group alone within a company could manage the number and types of internal and external threats. The complex technological landscape, and the many actions needed to address vulnerabilities associated with people and technology seems overwhelming. In view of that, organizations need to keep abreast how the new technologies will affect their exposure to cyber-risk and ensure that the necessary mitigations are put in place to keep risk within a tolerable and sustainable level. Therefore, a collaborative approach from all the stakeholder in the ecosystem is required to make an organization cybersecurity resilient. Also, policy interventions are required that encourage collaboration and accountability on the part of both businesses and governments.

 

Omodiaogbe Samuel, MSc. CMC, ChMC, FIMC

Omodiaogbe is a Strategic Management Consultant, and he the Principal Consultant/CEO at Vast Thinking Consults Ltd where he help organizations and business leaders to create superior value. Omodiaogbe holds BSc. and MSc. in Economics. Also, he is a Certified Management Consultant (CMC), a Chartered Management Consultant (ChMC), and a Fellow, Institute of Management Consultants, Nigeria. He is an Instructor on Coursera, where he teaches 25 courses in Strategic Management. Omodiaogbe is one of the world’s leading MOOCs learners on Coursera and Edx with over 500 Certificates from top-ranked Universities and Business Schools. His areas of expertise centers on Strategic Management

Contact him:
Email; somodiaogbe@vastthinking.com.ng
Visit: www.vastthinking.com.ng

Vast Thinking Consults Ltd is a Strategic Management Consulting firm that is into Partnership with a reputable Indian based cybersecurity company to bring top quality cybersecurity solutions to Africa.

Services include:

  • Cyber Security Consulting
  • Awareness & Training
  • Managed Security Services

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top
×