The growing number of cyberattacks assailing companies today is prompting many organisations to rethink their security operations, with a trend toward creating one unified response team.
Many companies have allowed separate security teams to develop for different areas of the business, but they’re now debating whether a consolidated approach would be more effective.
Although different security teams could specialise in combating the particular type of attack most common to their area of business, this silo approach could cause miscommunication and hinder the overall effectiveness, participants agreed during a recent C-suite digital discussion hosted by Obscure Technologies and Rapid 7. The debate focused “major security challenges facing risk detection and response” and highlighted how security teams are struggling with rising workloads and limited resources.
Several participants said their organisations were now dissolving the fragmented approach to security to better combat some increasingly advanced threats. Part of that involved reviewing the numerous tools and solutions used by different teams, which added complexity and made it difficult to obtain a clear view of their security landscape.
African Bank had operated with different security teams, but ran into challenges, said Clinton Fung, its head of innovation technology. “When you’re trying to enable your business to be more innovative, you need to grant more autonomy to the individual teams, which is a double-edged sword. Teams have the tools they need, but having no clear idea of what each team is doing creates a lot of sprawl,” he explained.
To combat that, a steering committee comprised of colleagues from risk, compliance, distribution, finance, human capital and other departments met periodically to discuss security issues, including different tools used by each team and by a centralised security team. “It’s not about dictating what has to be used and by whom; it’s about having an open discussion so people are able to put forward their needs, which allows us to look for both duplications and potential efficiencies,” Fung said.
American Tower Corporation started with a decentralised security model that varied with the product and the nature of the business, such as network security and app security teams. Now Tony Christodoulou, its regional vice president for IT and process efficiency, is trying to align them. “We started to realise that if you want to take a proactive approach to cybersecurity and ensure you’re a step ahead of your attackers, it takes a village,” he said.
“It’s also critical to continue to engage with the right people, particularly within the business, because most incidents happen through the ignorance of the user.
Around 10% of the risk came from third-party vulnerabilities, particularly in the telecoms sector where IoT integrations increase the risk. Attackers could get in if third-party suppliers were not aligned to American Tower Corporation’s standards, he said. “It takes the consolidated efforts of our centralised team in Boston to make sure we’re being proactive in the space.”
Christodoulou also stressed the importance of partnerships, with experts from third-party vendors adding different skills to help them to scan the dark Web, e-mail and systems.
Efforts to standardise the security approach across various divisions is underway at the Vitality Group, said Stanley Langa, its senior information security officer. The holding company, Discovery Group, had one framework, and Vitality Group had a slightly different framework. Vitality was working to adopt the parent company’s blueprint for standardisation and simplification. But it wasn’t a one-way street as Vitality could contribute its ideas to the overall information steering committee, Langa said.
He believes Vitality’s infosec and cybersec capabilities complement each other well and cover all aspects of enterprise risk management, including governance, security, operations, compliance and assurance. Other initiatives including continuous and agile penetration testing, continuous assurance activities and self-assessments improve the security, too, he said.
E-commerce platform Bidorbuy has one team that handles security for its payment processes and deals with suspected fraud. “They also deal with attackers trying to take over accounts and other physical attacks,” said its chief technology officer, James Ostrowick.
“When it comes to attacks on actual systems, such as attackers trying to run Burp Suites, my team handles that. They will look for users running cheap servers overseas that try to use penetration tools against us. We also get ‘script kiddies’ looking for vulnerabilities,” he said. “Generally, we have very few vulnerabilities or issues reported to us that are legitimate, perhaps three over the last six months, and we do we do pay bounties for them.”
The City of Johannesburg uses a hybrid model, relying on both in-house and outsourced skills. The end goal was to have a full internal Security Operations Centre (SOC), said John Bosco Arends, its group head of information and network technology operations. External service providers from the government security cluster were contributing some skills towards establishing the SOC, and helping the municipality to find the skills it needed.
“This has enabled us find the right people without the urgency of having to find them yesterday, allowing us to have an established, working, operating team,” he said. “We have a partner that builds what we need, and we operate in conjunction with them on a day-to-day basis, finally taking it over completely, with all the skills and the tool sets that go with it.”
As an entity subject to constant scrutiny, the South African Post Office (Sapo) had developed a coordinated approach to cybersecurity, so everyone knew what steps to follow to report an incident and who to escalate to. “There’s no such thing as being too prepared for a breach. You should always have your defences up and be on guard,” said Maclaud Mafaiti, Sapo’s GM of IT security & Trust Centre.
Security incidents at Sapo posed a major concern since a breach could be escalated all the way to the minister of communications, he said. “I really want to emphasise partnerships, because in this day and age there’s nothing that you can defeat on your own. A well-coordinated partnership can ensure that all bases are covered, and can also act as an early warning mechanism.”
Another public sector company, Sasria (the South African Special Risks Insurance Association), is also a strong believer in IT partnerships. Hulisani Mamphiswana, its IT security specialist, said attacks were inevitable, so you needed to find ways to prevent, or contain and mitigate them so they didn’t spread. Sasria’s security was divisionally based, and a partner managed its SOC that it operated 24/7. “They monitor our environment, our servers, firewalls, events and logs, and report to us if there is anything that needs to be done on our end. Educating users is also quite a challenge, and we rely on partners to do phishing simulation tests, as well as end-user and awareness training,” he said.
The biggest challenge for Niel Van Rooyen, head of information security at Vox, was to integrate security as a central function into all its subsidiaries. “There’s still a bit of a gap with several subsidiaries but we’re closing it,” he said. “From a breach point of view, the gaps have made it a struggle to respond appropriately, have processes that work properly, and have the ability to respond within the necessary timeframes. But we’re getting there.”
As a fairly new and small bank, the South African Post Bank has tried to establish a security function that’s integrated into everything it does, and becomes part of its core strategy. “Banking is all about customers and data, and security has to deliver the service to safeguard and protect that data, and ultimately, the customer,” said Kevin Maartens, its chief risk officer.
For any business to build a rapid response plan, it must identify what data it needs to protect, specify that data, and ensure that the response to a breach is appropriate, said Prien Pillai, head of group IT governance at RCL Foods. “Developing a cyber response plan is very different from developing an incident response plan,” he said. RCL Foods had 6 000 users, and had adapted and enhanced its incident response plan to form a cyber response plan. The toughest part wasn’t the process; it was the people underpinning that process, he said. “Policies are pieces of paper, but a response team is a set of people that have a vested interest in security.”
At one time, insurance company Hollard didn’t have the best security and suffered some breaches, admitted Zanele Mazibuko, its privacy information officer. “Since then, our IT and security teams have come together to make sure the environment is better secured. Hollard deals with a lot of personal data and its risk, for the most part, lies with its third parties and brokers. It is impossible to manage the security of these partners, you can only suggest that they should have specific controls in place but you don’t have a real view into their environment,” she said.
Mothibi Ramusi, CIO of the National Lotteries Commission, said his organisation also dealt with a vast amount of confidential information and his priority was to ensure that all the cybersecurity checks and balances were in place, and that appropriate infrastructure was deployed to keep it safe.
A big issue is support from your leadership, Ramusi said. “It’s critical to get buy-in from the decision makers, so when spending money it doesn’t appear as if you’re buying a ‘nice to have’ piece of technology, but something that aligns to the various institutions and properly safeguards information.”
An increase in security incidents had definitely been noticed at Transnet Port Terminals, with its threat intelligence partners fending off a significant spike since the lockdown. Phishing had become particularly common, said its head of security, Barend Pretorius. “By working with our partners, I would say 99.99% of those have been blocked. “The occasional zero-day attack sneaks through as expected, but we have controls in place to mitigate and catch those,” he said.
- This promoted content was paid for by the party concerned