Large scale adoption of digital and business transformation by global and regional enterprises and the associated cybersecurity vulnerabilities, has driven the realisation of the importance of keeping cybersecurity at the same levels as other strategic priorities of the enterprise.
According to IDC, security is now a board-level conversation and cyber risk has been elevated and is now recognised as a business risk. According to Gartner, the importance of information security is rising rapidly as senior executives become aware that poor security can cause irreparable damage to the business. Gartner forecasts that by 2026, 70% of boards will include one member with cybersecurity experience.
However, this rapid onslaught of digital transformation with migration to the cloud and adoption of digital platforms, followed by the more recent drive to embed Generative AI into business processes is not making things easier for cybersecurity administrators and decision makers.
Complex challenges for CISOs
The continued heightened threat environment, cloud migration and talent crunch are pushing security to the top of the priorities list and pressing cybersecurity administrators and decision makers to increase their organisation’s security spending.
As organisations continue to move to the cloud, Gartner analysts expect an increase in cloud security solutions, and the market share of cloud-native solutions will grow.
In reality, the emergence of Generative AI and other AI technologies are contributing to increased budgets for security offerings in 2024. Generative AI is driving an increase in cybersecurity spending to secure an organisation’s development and use of Generative AI applications, as well as to use Generative AI assistants to support security administrators in efficiency.
Adoption of AI and Generative AI continues to drive an increase in the investments in security software like application security, data security and privacy, and infrastructure protection. Generative AI will trigger a spike in the cybersecurity resources required to secure it, leading to an expected 15% increase on security software spending, forecasts Gartner.
Furthermore, organisations are currently assessing their endpoint protection platform and endpoint detection and response needs and adjusting to boost operational resilience and incident response following the CrowdStrike outage.
Since the release of Generative AI, attackers are increasingly employing tools along with large language models to carry out large-scale social engineering attacks. Gartner predicts that by 2027, 17% of total cyberattacks and data leaks will involve Generative AI.
Security spending will continue to remain strong and isolated from the recessive effects of a challenging macro-economic global environment and economic uncertainty.
Developing a cybersecurity framework
The way forward for cybersecurity administrators and decision makers is to build a forward looking cybersecurity framework that manages continuous digital and business transformation, helps to create new business value in the face of these changes, takes into consideration internal and external factors, and plans for growing risks and threats.
In the absence of such a forward looking cybersecurity framework, the role of cybersecurity administrators and cybersecurity decision makers may be relegated to merely managing technology solutions and technology implementations. This may have little relevance to the business of the enterprise, its position in global and regional markets, and its changing business value in the competitive market place.
A well thought and planned out cybersecurity framework has multiple components. These can be listed as:
- Overall strategy
- Collection of operational processes
- Accountability and governance
- Correlation to the rest of the enterprise
- Mandate for operational execution
A fully functional enterprise cybersecurity framework consists of security policies, security processes and security architectures. It defines users, systems and configurations. It provides guidance for future design, implementations and successful operations.
Amongst the forward looking steps is to build competency in reverse engineering of threats, determination of threat origins, monitoring of advanced threats, enterprise wide incident response capabilities, and action plans for employees in the face of threat actor intrusions.
A well-developed enterprise cybersecurity framework allows for future evolution and is adaptive to changes in the threat landscape. This exercise cannot be completed in a hurry and must be well mapped to the business organisation of the enterprise.
Developing this framework is a team effort from across the enterprise and involves business decision makers whose presence helps to collectively shoulder the risk and governance across the enterprise.
By following the above steps, cybersecurity decision makers can help the security function align with business and also showcase the importance of its role and the value it can offer today and, in the future, as well.
Discussion about this post