The rapid pace of digital transformation that businesses have undergone in the last few years has unlocked multiple benefits: greater resilience, agility and flexibility. Using the cloud as the driving force of this change has also brought with it greater accessibility, scalability and security, especially as remote and hybrid work has become more of a reality.
The good news is that businesses will continue to enjoy these and other advantages as the velocity of transformation speeds up. The other side of the equation is that this new environment brings with it a wider and deeper security landscape that will also continue to evolve at speed.
According to a recent IDC Cybersecurity survey commissioned by Microsoft, cloud security is top of mind for South African chief information security officers (CISOs) and other security leaders in this new world, and will continue to be a top priority for investment for at least the next two years.
Ensuring that cloud resources, workloads and apps are securely configured is security leaders’ biggest concern – and 52% cite data security concerns, in particular, as a barrier to further cloud expansion.
Data breaches are a growing threat. IBM Security – a strategic partner of Microsoft’s – found in its Cost of a Data Breach Report 2021 that data breaches now cost South African companies R46-million on average – the highest average total cost in the 17-year history of this report.
It revealed that the most common initial attack vector was compromised credentials, and that this was responsible for 20% of breaches. It also showed that the average time to detect and contain a data breach was at its highest in six years for organisations in South Africa – taking 237 days overall: 184 to detect, 53 to contain.
Hefty price tag
These breaches also came with a hefty price tag. It cost businesses R2 300 per lost or stolen record, on average. Companies who were able to contain a breach in under 200 days managed to bring the cost of an attack down, saving almost R7-million according to the report.
The cost, complexity and severity of attacks will only continue to grow in the coming years. So what then does this mean for CISOs and what do they need to prioritise going forward?
- Adopting the Zero Trust principle remains the most effective security measure. Security architecture is now being designed around the model that involves trusting no individual or system and needing to verify identities explicitly. The Zero Trust principle uses least privilege access to give people access only to what they need, for as long as they need it, and always assumes breach. It is now the de facto guiding security strategy of businesses worldwide, and organisations operating with a Zero Trust mindset across their environments have been found to be more resilient, responsive, and protected than those with traditional perimeter-based security models. In fact, 96% of business leaders and security decision makers say it is critical to their organisation’s success, and will remain the most important security priority for at least the next two years – especially as a tool to assist in the shift to a hybrid workplace post-pandemic.
- Identity will remain the number one place where people are vulnerable as human error and insider risk show that well-meaning but untrained employees can pose a business threat. The IDC Cybersecurity survey found that confirming users’ identities, together with an additional layer of security, is the top security priority for businesses in the next 6-18 months. The foremost concern is protecting a user’s identity to minimise identity attacks. This means modernising identity and endpoint management and putting the controls and processes around authorisation, authentication and privileged identity management in place. A recent Forrester Consulting study commisioned by Microsoft, The Total Economic Impact of Microsoft Endpoint Manager, backed up the business value of securing an organisation’s identities and endpoints: increased security and productivity, with a 45% reduction in the likelihood of a data breach.
- But, to enjoy the reduced likelihood of a data breach, people, process and technology need to be in harmony. This means not only investing in the most advanced and up-to-date end-to-end automated and intelligent security tools and solutions to build layers of security and enable pre-emptive and real-time monitoring, threat detection and incident response, but also in skilling and training people to keep pace with new types of attacks from multiple different vectors. The IDC research showed that business and security leaders are increasingly prioritising this, with 49% saying they are investing in building a security culture and increasing understanding of security’s value to the business.
Now and into the future, CISOs need to consider security transformation to ensure that it is not a barrier to the accelerating digital transformation that organisations in South Africa need to embrace to remain competitive, agile and adaptable in a changing world.
About Microsoft
Microsoft enables digital transformation for the era of an intelligent cloud and an intelligent edge. Its mission is to empower every person and every organisation on the planet to achieve more. Visit Microsoft South Africa on Twitter or Facebook.
- The author, Colin Erasmus, is Modern Workplace and Security Business Group lead at Microsoft South Africa
- This promoted content was paid for by the party concerned