CISO Radar: Top security priorities for 2023

News of the last few months has confirmed the importance of cybersecurity for large organizations. Under the influence of new geopolitical dynamics and acceleration of digital transformation activities, international companies have become aware of necessary investments. Changes that have been initiated will accelerate in the coming months because of pressure from regulators and the need to align with new organizational practices and technological innovations.

On the government side, regulatory work continues to grow and the legal framework is being strengthened.

The emergence of new regulations affects cybersecurity players in a paradoxical way. On one hand, this regulatory attention is a lever to release funds and deploy large security programs. On the other hand, the prescribed actions are extremely mobilizing of cyber resources and take teams away from their focus on other high value-added cyber actions. Some measures required by newer regulations can become disconnected from current operational priorities; i.e., they can generate deep modifications of the information systems that make daily management more complex. In the years to come, the construction of a functional and legal framework will require a continuous and constructive dialogue with regulators.

Cyber strategies can no longer perform without a human factors perspective to effectively maintain their security level. The first question CISOs should ask themselves is “make or buy?” In other words, should the organization internalize the needed cyber skills, or outsource resilience or response activities to a third party?

Historically, the decision has been to turn to outside providers for such needs designated as temporary; while security was viewed as a necessary evil or cost center. Today, keeping cybersecurity in-house is becoming a growing business concernbecause of the increase in resilience issues, new ever-evolving levels of product security, requirements for additional financing of cyber solutions, and of course the omnipresent interests of customers and partners. Going forward, it seems essential to adopt a Smart Sourcing approach that flexibly encompasses all these needs.

In a tight market like the one we are experiencing, an effective HR strategy is based on two pillars: talent recruitment and talent retention. The former sometimes requires creativity! For example, you might decide to recruit non-specialist profiles who you believe can be trained. Or perhaps you can create new avenues of internal mobility, allowing people to enhance their skills without leaving the company.

Once the cyber team has been built, it becomes crucial to retain key employees.

• Salaries are certainly a lever for attractiveness. But beware, they are also a reason for departure. The cybersecurity sector reveals growing salary disparities between sectors and, on a larger scale, between countries.
• Knowing the key profiles, competencies and interests of your people allows you to arbitrate between skills expertise and management, while giving clear objectives and a career path adapted to each person. This is a real resource management transformation for cyber teams!
• Continuous training for each type of cyber resource profile is also a retention tool. It also benefits the organization’s ongoing security posture. Be sure your career path strategies include both initial training for non-cyber profiles and expertise paths for advanced profiles.

The security of industrial production sites is making strong progress, although there is still a long way to go in terms of the backlog and the lifespan of installations. On the other hand, while manufacturers are increasingly digitizing their production and selling associated digital services, product security remains in its infancy. It is an element of differentiation between manufacturers today; but will be a prerequisite for all manufacturers tomorrow.

This is the time to evaluate your manufacturing, sales, and after-sales cycles, and to take action on cybersecurity proactively. These developments also require the creation of separate communications and process channels that are integrated with the historical management of Information Systems.

The financial sector, for its part, is restructuring the cyber sector and related sectors (i.e., IT risk, fraud, security of goods and people, etc.) in response to the increased demands of regulators. In particular, resilience is becoming the focus of transformation programs, with its share of new issues: identification and mapping of critical services or ability to quickly exit a platform or a third-party service (a “stressed exit”). This phenomenon is growing in the United Kingdom but is only just emerging in the United States and France.

Organizational and sectoral transformations are broadening the responsibility scope of CISOs to include subjects that were not previously within their purview, such as anti-fraud, operational resilience and physical security.

The CISO profession is undergoing a profound change that makes it much more than a technical and legal expertise function. In response to the professionalization of cybersecurity, CISOs are now expected to adopt a managerial posture (budget management, team management, etc.). To support this change, companies and administrations are turning to specific training, internal coaching, or even the recruitment of a non-expert profile with knowledge of the organization to support the CISO.

This trend is expected to spread to other sectors in 2023 and over the next few years.

In addition to organizational issues, the market is adapting around new security solutions to support digital transformation. This transformation is driven by a generalized “Move to Cloud” in all sectors, a reconciliation between operational technology and IT within the industrial world, and expanding the access of information systems to numerous partners, acquisitions or customers.

This movement is leading to tactical responses in cybersecurity, with the emergence of tools to better control ongoing projects (see box below on the Cloud in particular). In the near- to medium-term, the atomization of the information systems continue and will require a rethinking of the security model – towards Zero Trust logic.

A simple philosophy, Zero Trust, has been gaining momentum for a long time. The principles are being translated into concrete measures, and new solutions are appearing; as an example, the publication of the first frameworks such as that by the Department of Defense (DoD) in the United States.

The feedback from this experience has been very positive, particularly in terms of remote access and micro-segmentation. For anticipated challenges to come, we think of identity and access management, for employees, partners, customers, and, increasingly, also for machines and data, with the established IDPs (Identity Providers). However, the road to a complete migration of information systems seems long and may not be of interest for legacy systems, which will need to be protected in other ways.

CI/CD applications and platforms are the next preferred areas of threats for cyber attackers. Therefore, putting them under control soon is essential. Security and DevSecOps approaches must be at the heart of development teams’ activities in order to integrate the necessary protections as early in their lifecycle as possible (with the widely adopted “shift left” movement, to position security as close as possible to developers and testers to make them accountable).

The agile mode has significantly integrated security teams into the application lifecycle starting with design. Hence it is necessary to increase the number of technological safeguards throughout the Software Development Life Cycle (SDLC). The issues concerned range from training to source code auditing, management of secrets on development platforms, securing containers, and the implementation of software bills of material (SBOM).

Many attackers take advantage of security holes in third-party systems to breach an organization. The first step in limiting this type of intrusion is to identify the partners and service providers that should be given priority in security remediation. The usual criterion of volume of revenue generated is not always the right one to evaluate the managed risk of data leakage or service interruption. Smaller third-party providers may hold more critical information or provide a link in a critical service.

For the most critical third-parties, it is necessary to consider reinforcing contractual commitments and reporting in terms of security. To go further, take into account this risk as it lives within your processes, whether it is the management of incidents affecting third parties, the ability to integrate them into access management systems, or even if viewed as their own level of cyber resilience.

Third party management platforms are one way to centralize these concerns and activities. Platforms that will be as useful in prevention for resilience analyses, or the definition and monitoring of requirements implementation, as in reaction when an incident does occur.