Cybersecurity in the World Economic Forum’s Agenda

If you are an enterprise, you were probably engaged in one way or another in the cybersecurity agenda at the World Economic Forum (WEF) 2021. Surprising, isn’t it, that the eminent global think tank has been including cybersecurity in its agenda these last few years? Given the sophisticated attacks of the last decade, I’d say it’s not all that surprising.

How Cybersecurity Moved from Being Government Agenda to Enterprise Priority

Historically, cybersecurity has been high on the agenda of governments globally. With strong cybersecurity postures, they safeguarded themselves against cyber espionage and information warfare. But take the example of the Equifax breach of 2017 – when enterprises were nudged into action for the first time. From that to the recent SolarWinds attack, breaches have only become increasingly sophisticated and more motivated towards financial gain or cyber warfare. Attacks like these have been a clarion call to the industry at large – security vulnerabilities in private entities can be leveraged for larger, sophisticated attacks on nations and can cause significant financial loss. Even as governments rapidly adopt modern information security techniques, many enterprises lag. They continue with patchwork or lock-and-moat approach to security. If you look at information in the context of larger cyber warfare techniques, activating enterprise and industry response to cybersecurity is an idea whose time has come. This is just what the WEF is doing: bringing global organizations to the table and discussing the long-term implications of weak enterprise security, challenges, and vision to tighten cybersecurity postures across government and businesses. There are certain challenges that enterprises need to address before they can get put this vision into action.

• The pressure of rapid digitization

  This is especially true in the face of the pandemic. Organizations have had to change their ways of working almost overnight. Digital transformation at the workplace became a matter of now or never. However, in the race to digitize, cybersecurity often takes a backseat. That needs to change.

• Fragmented regulations

  Although governments’ approach to cybersecurity globally is highly sophisticated, regulations continue to be fragmented and different as per geographies. In a flat world like ours, where most work and workforce are now location-agnostic, fragmented regulations can often throw a spanner in building formidable enterprise security.

• Lack of expertise

  Even though cybersecurity is high on the agenda for enterprises, the skills they have access to don’t quite match up to those at the end of the intruders. Upskilling in the cybersecurity space is an urgent need now, without which, enterprises will continue to be laggards in cyber readiness.

Where does this leave enterprises? What can they change and how can they address the challenges that lie ahead of them?

Cybersecurity is a Business Imperative, and Not Just an IT Issue

The pandemic turned out to be a goldmine for intruders in the cyber threat world. It also revealed how ill-prepared organizations were for a remote workforce and a rise in digital interactions. Today, we are at a point in the cybersecurity journey where we have the opportunity (but alas, not the luxury of time) to take a holistic view of cybersecurity as a business imperative and not just an IT issue. This is exactly why cybersecurity became a critical agenda at Davos. It initiated the much-needed conversation in the direction of adopting policy-led frameworks for cybersecurity. Here are four must-dos for organizations as they take a renewed approach to cybersecurity.

1. Involve your Board

   Educating board members about a cybersecurity policy framework is an urgent imperative. Their involvement would speak volumes about the urgency with which organizations need to transform their cybersecurity posture. It would also bring in the much-needed financial investment faster.

2. Quantify your risk

   Every organization today needs to know – in dollars and cents – how much their cybersecurity vulnerabilities can cost them. This risk quantification can enable a quicker response to vulnerabilities because a strong cybersecurity posture is essential for business continuity.

3. Empower your CISO

   Putting the responsibility of a strong security posture on the team accountable for it makes sense for business. The CISO must be given the time and space to rethink the security strategy for the organization.

4. Move the needle to a holistic security strategy, not just tools and tech

   One of the biggest pitfalls of cybersecurity discussions at the enterprise level is that it quickly slips into variables like tools and technologies. But what enterprises need is a renewed, holistic approach to building a cybersecurity strategy.

What’s Next for Enterprise Cybersecurity?

In all of this, what is clear is that it is just the right time for enterprises to shift their perspective from perimeter-based security and explore new strategies. This is where Zero Trust strategy for cybersecurity comes in. Cyber-attack statistics and threat events offer a word of caution and hold a mirror to the effectiveness (or lack thereof) of traditional solutions. A business’ security architecture must stay a step ahead of the hackers and its systems must be able to apprehend, prevent and contain any malicious activity. Enterprises should design their cloud architecture with a security-first approach for an uncompromising breach-proof infrastructure. Zero Trust architecture can play a significant role in ramping up security at the enterprise level. The Zero Trust model offers a context-based approach to trust and makes access authorization extremely context-based, thus safeguarding organizations from cyber-attacks. This model strengthens the security posture at the enterprise level. It allows security teams greater bandwidth to test and apply flexible mobile- and digital-led touchpoints not only for customers but also for employees. With workforce, as well as business operations, moving into location-agnostic models, this geographical agility is a must-have for cutting-edge organizations. If organizations want to get away from the rut of traditional reactive models of security, they have to open up to the Zero Trust approach to cybersecurity. It is the present and the future of cybersecurity. Today, cybersecurity has proven to be a strategic enabler. A business imperative. Drop the lens that makes you look at it as an IT issue, and you’ll be ready for the road ahead.