CYBERSECURITY REVIEW8 DECEMBER - JANUARYIN MY OPINIONBy Frankie Shuai, Director, Cyber & Technology Risk, A leading global bankTHE ART OF ENHANCING ENTERPRISE SECURITYAs a seasoned cyber security and technology risk leader, Frankie brings about two decades of experience in the banking and IT industries. He regularly speaks at industry events and is a practical advocate for bridging the gap between cybersecurity and the business agenda. He is also a digital transformation and innovation catalyst with a wireless networking patent filed at the USA patent office as the sole inventor. He received the IDG (International Data Group) CSO30 ASEAN award in 2021 by being recognized as one of the top cybersecurity leaders in the ASEAN region.CHALLENGES AND TRENDS IMPACTING THE ENTERPRISE SECURITY SPACEThe cyber security landscape has evolved significantly in the past few years. When digital transformation becomes the mainstream across industries, cyber security has also become a critical agenda topic, even in the boardroom discussion. Let me name a few challenges we have seen so far across the industries: Firstly, attack surface exposure has been increased when we are moving the system and data to the cloud, when our employees are connecting to the corporate network at any place by using any device, and when there are more connections and dependency on the third-party partners and suppliers in the whole product or service ecosystem.Secondly, cyber-attacks have also been more sophisticated in the form of phishing, malware, ransomware, etc. Do not forget when we are on the digital transformation journey, those cyber attackers are also on their digital transformation journey. Many years ago, they might have had people manually draft and send you phishing emails to conduct the social engineering attack. Nowadays, they might even use Artificial Intelligence to generate sophisticated and tailed phishing emails to you; that is spear phishing.Last but not least, for the industries heavily regulated, like the financial industry, regulators are also paying more attention to cyber security, data privacy, operational resilience, etc. A good cyber security leader should also be an expert to understand clearly what the expectations from regulators are, what is the cyber security risk appetite in the organization, and what the cyber security advice could bring to the business to enable business growth in a compliant manner. MAJOR PREDICAMENTS IN THE ENTERPRISE SECURITY SPACECyber-attack is no longer the matter of `whether,' but the matter of `when.' So, when a cyber-attack happens - What is next? Do we have plan B? What are the critical processes and critical assets impacted we have to prioritize and recover from the attack first? What are the key stakeholders we have to engage and notify? The list of these questions is growing and keeping us up at night. But as cyber security leaders, we have to prepare them, not randomly but based on the protocol we have well-defined, trained, and exercised.Frankie Shuai
< Page 7 | Page 9 >