The Massive Challenges of Digital Transformation

To get to that Promised Land described by many as the 4^th Industrial Revolution (4IR), businesses must be willing to sacrifice security.

Fortinet recently described the problem space in pretty comprehensive, though highly technical terms. I have tried to tame their exposition in the language most folks can understand, without an advanced degree in Cybersecurity.

By the way, no one wants an advanced degree in Cybersecurity anymore. What hiring CISOs want is actually earned certificates of achievement in specialty learning paths that act as warrants to a candidate’s grasp of the topical issues. One can study hacking and pentesting in college, but for the vast majority of programs, the experience lacks the hands-on time spent in simulated trenches doing battle with enemy incoming. The certification testing preparation coursework in cybersecurity has matured dramatically in the past 5 years and now represents a much truer reflection of a candidate’s actual capabilities. In an era where no one has time to reflect and practice academic exercises, it comes as a welcome relief.

The 4^th Industrial Revolution

In a 4IR world, speed and availability are critical. In a cybersecurity world, speed is the enemy and availability can’t happen in chaos. Chaos is caused by complexity. The more complexity, the more chaos. Organizations turning to digital innovation to stay competitive, dumping their legacy systems for hybrid networks and digital processes, including cloud and business application adoption, are resulting in the most sweeping transformation of business networks in 40 years. And we’ve only just begun.

The benefits of 4IR are clear and indisputable. Our digital acceleration and hybrid architecture strategies enable organizations to roll out new products and services at scale and speed, minimizing time to market and optimizing user and customer experience. The goal is to establish and maintain market differentiation by improving processes faster than competitors, allowing organizations to improve efficiency while improving stakeholder value.

Rapid Digital Transformation empowers organizations to build systems enabling more acceleration, at faster speeds.

Newer Technologies Must Be Adopted

The impact on traditionally separate networks is vast. Organizations need to quickly create highly efficient hybrid environments by seamlessly tying physical data center networks to private and public cloud environments with security built-in, connecting branch offices on a secure set of networks that provide safe and ubiquitous access to the rapidly growing number of remote users. Traditional VPNs no longer have a porous role to play in this new network architecture.

ZTNA must be embraced and the impact on the journey can’t be easily dismissed. It takes time and effort to set up: It might be challenging to reorganize policies inside an established network since it must continue to function during the change. It is frequently easier to create a new network from the ground up and then switches over. If older machines are irreconcilable with the Zero Trust architecture, it will be essential to start from scratch.

Employee users must be more tightly controlled, with access provided only when absolutely necessary. Furthermore, users are not limited to workers. Consumers, clients, including third-party suppliers, devices, printers, servers, storage units, Polycom conference room systems and mobile phones will also access or utilize the company’s resources. This means that there are numerous entry points and a Zero Trust framework necessitates distinct regulations for every type of user.

There is more complexity to accommodate. Today’s workplace environment comprises not only a broad range of human variants, but alongside, it means various types of gadgets for each of them. Multiple devices may have unique features and communication methods that must be managed and secured accordingly.

Similarly, applications vary. Apps are frequently cloud-based and are used across numerous platforms. They must be disclosed to third parties. App customers should be scheduled, evaluated and adapted especially to user needs in accordance with a Zero Trust mindset. And, data is being kept in several locations, which implies there are more places to safeguard. Data configuration must be done appropriately and in accordance with the highest security requirements.

But at day’s end, these hybrid, dynamic environments allow IT teams to create fast lanes for building, implementing, interconnecting and managing critical technologies and processes, whether internally or externally, designed to deliver better outcomes.

Hybrid Everything

How we do business is also changing. Online retailers now allow customers to place orders using a variety of apps, enabling such things as online ordering, same-day delivery and touchless curbside pickup. Most insurance companies now offer no-touch claim filing and inspection. And enterprises must support a hybrid, work-from-anywhere workforce with secure access and consistent security.

Regulations are also changing to support these innovations. To enable folks to engage in legal transactions remotely, e-signatures now must meet compliance regulations. Even OT networks are embracing digital innovation, enabling real-time production. Traditional IT has no choice but to evolve. Static perimeters and fixed networks are useless to new applications and services that provide greater access to critical information for any user on any device from any location. The adoption of hybrid IT architectures connects traditionally fixed network environments such as campuses, data centers, branches and retail locations. By combining physical and virtual networks across private and public domains, hybrid IT offers true end-to-end, scale-on-demand capabilities to meet escalating business needs.

But interconnected networks are not enough. To ensure a consistent user experience for users and devices everywhere, especially for the sudden growth of a hybrid workforce, IT teams have had to interconnect their hybrid IT networks with the cloud. Hybrid cloud connects traditional networks and private cloud environments to public clouds. Open and integrated APIs have allowed IT teams to combine resiliency and operational efficiency with agility and availability. Hybrid data centers, for example, can now deliver critical data to distributed users and devices anywhere. This has enabled streamlined workflows and allowed networks to adapt to shifting business demands in real-time.

This transition to hybrid strategies—networks, clouds and users—has stretched legacy security systems and pushed them beyond the breaking point. Most traditional security systems were designed to analyze and secure data at fixed points in the network, with clearly defined perimeters and reliable sources and destinations. New hybrid environments, spurred on by the need for ongoing digital acceleration, have changed all that. Rather than protecting businesses, the inherent limitations of traditional security systems now restrict an organization’s ability to securely evolve its networks at the speeds that today’s digital marketplace demands.

Seven Critical Security Issues

Thanks to Fortinet for identifying seven critical security issues that any organization looking to successfully adopt digital acceleration strategies and deploy hybrid network solutions must address:

1. Increased attack surface: Hybrid networks and a diverse workforce mean that today’s networks have more locations, applications and services to protect. The effort to continually deploy new security technologies to protect the expanding network has overwhelmed many IT teams already struggling to cope with the ongoing cybersecurity skills gap.
2. Diverse and sophisticated attacks: Today’s threats not only employ increasingly sophisticated attack strategies to exploit vulnerabilities and evade detection, but they also target multiple points across the network, looking for the weakest link in the security chain. And new API-based attacks specifically target applications designed to interact with each other within the same domain or that work with partner applications using vulnerable APIs to quickly spread from one area of the network to another.
3. New threats targeting OT networks: IoT/IIoT-based attacks are emerging that are designed to target 4IR and such things as AI for robotics control, near-real-time digital twins, production line automation and more. And because of the growing number of high-profile OT and critical infrastructure attacks, we have also begun to see OT attacks—traditionally the domain of very specialized criminals—being sold on the dark web as a service. This means that organizations should expect to see the volume of OT-targeted attacks rise as novice cybercriminals gain access to sophisticated attack technologies.
4. Inconsistent security: Users, devices and applications can be anywhere. Not all security solutions can say the same. And when security solutions and platforms cannot be universally deployed or centrally managed and orchestrated, it is impossible to deliver consistent and location-agnostic security across the hybrid network.
5. Lack of visibility: The growing number of security systems that cannot interoperate, combined with the ever-increasing volume of encrypted traffic, means that IT teams are increasingly trying to combat today’s threats while blindfolded. Multivector attacks exploit the inability of security solutions to share and correlate threat data. And attackers know that most security solutions cannot inspect encrypted traffic to find malware or exfiltrated data without seriously impacting network performance and user experience. And that when it comes to choosing performance or protection, most organizations opt for business expediency.
6. Complexity: With few exceptions, multivendor security systems cannot talk to each other, which means IT teams must rely on hand-correlating threat intelligence to detect and respond to threats. And trying to stay ahead of an ever-evolving threat landscape using multiple management consoles not only increases operational costs but also makes it difficult to troubleshoot issues, identify exploitable configuration gaps or initiate a timely response to identified threats.
7. Lack of integration and coordination: Disparate security systems that do not share information can make it impossible to make effective decisions. In most networks, on-premises applications and physical infrastructures struggle to coordinate and communicate with cloud applications and networks. As a result, if one gets attacked, there is no integrated mechanism to even notify the other, let alone initiate appropriate protections.

The Road Ahead

Modern networks require an integrated approach to security. It starts by developing and deploying a security fabric that can scale in lockstep with the network to provide consistent protection and policy enforcement everywhere. We need tools able to converge networking and security into a single solution so protections can seamlessly adapt to changes in the underlying network and a security platform that includes a full suite of security tools designed to work together as a single system, along with open standards and APIs so it can also interoperate with third-party solutions.

We also need the ability to deploy anywhere, in any form factor, from home offices to large campuses and hybrid data centers to distributed branches and across every public cloud. This enables value like true end-to-end automation for the rapid detection and coordination of response to threats, centralized management and orchestration to eliminate troubleshooting and configuration errors and hyper scalability so security can quickly and easily adapt to ongoing digital innovation efforts.

We’re not there yet, but at least we know where the road goes and how difficult certain sections will be. Nothing beats informed planning, not because our plans will overcome the reality we discover when we get there but because the act of planning itself reveals a surprising number of things we thought we knew but didn’t.