Last year, we saw the world change almost overnight and inevitably shaped by the global pandemic. Over the last 12 months, enterprises across Asia Pacific (APAC) witnessed how cyberattacks increased in frequency and sophistication, as business leaders were scrambling to ensure continuity and resilience amid unprecedented change and challenges.
According to the VMware Carbon Black Singapore Threat Report, 80 percent of Singapore enterprises suffered a data breach as a result of a cyberattack in 2020. Also, the cyberthreat landscape seemed to have outpaced Singapore businesses, no matter how fast they were adapting new security tools. In the same report, 67 percent of security professionals noted that attacks have become more sophisticated, and 22 percent said that they have become significantly more advanced.
Forrester predicts that cybersecurity concerns will dominate the agendas of businesses and governments in 2021 as well, with an increased adoption of Zero Trust. As enterprises now face evolving threats in the business and information technology landscapes, these are the main emerging trends in the cybersecurity arena across the APAC region.
Fortifying the supply chain
Island-hopping, otherwise known as supply chain attacks, are emerging as the next style of attack enterprises need to be prepared for. This involves an attacker infiltrating an organization’s network to launch attacks on other businesses along the supply chain. Attackers use vulnerabilities in the first company’s defenses as a point of entry to the second, third and so on. More often than not, these attackers use compromised software which can be very difficult to detect if it has been altered at the source, making it harder for organizations to respond and contain the threat before the attacker infiltrates the entire supply chain. This also means today, a third-party provider may be the weakest link for an enterprise’s security posture.
The Singapore government has already stepped up to take preemptive action against supply chain attacks. The Monetary Authority of Singapore (MAS) recently announced a new set of central banking rules for all financial services and e-payment firms in the wake of a similar attack. This vulnerability exponentially expands the enterprise attack surface, and enterprises that previously adopted a multi-vendor approach for different areas of technologies now face significant risk exposure across these varied vendors.
To mitigate risks, we expect to see enterprises consolidate vendors to reduce supply chain vulnerabilities with a shift towards strategic vendors and platforms that can cover more ground. While the onus of accountability and security patching remains on the vendor, enterprises should also conduct regular risk assessments and threat hunting to ensure environments are secure.
Balancing a hybrid workforce
While some organizations had some parts of their workforce on a remote arrangement, many were not prepared to support a fully remote business. The rushed adoption and transition to work from home in 2020 posed major cybersecurity challenges for enterprises. The blurring line between personal and work devices and a workforce reliant on scantily protected home Wi-Fi networks have created multiple exposure points and vulnerabilities that are a major cause for concern for IT and security teams.
These disparate endpoint devices can pose a significant risk to enterprise network security, especially as we consider the new learning curve and cybersecurity awareness for many employees.
Enterprises that loosened cybersecurity infrastructures to support remote work for their employees have also created security gaps. For example, an overreliance on public clouds by a remote workforce creates the opportunity for cloud-jacking, which may become the new island-hopping strategy of choice for cybercriminals in 2021. The responsibility of security is now distributed to everyone within these enterprises and every user must be prepared for malicious attempts such as phishing attacks.
According to IDC, creating digital parity will be a priority in 2021. By 2022, the top 2,000 public companies in the world will spend an additional USD$2 billion on desktop and workspace-as-a-service. 75 percent of these companies will be incorporating employees’ home network and workspace as part of the extended enterprise environment. Hence, it will be essential for organizations to rethink their cybersecurity defenses and training to ensure secure operations.
Accelerating Cloud Journeys Securely
In addition to having employees work remotely, enterprises have been migrating their applications and data to the cloud for some time now. However, the impetuous shift to remote work has accelerated cloud migration journeys as organizations rushed to support the distributed workforce and drive business continuity.
This hastened cloud migration requires enterprises to adjust to securing their remote users, applications and data storage, while also building the security to reinforce exposure points. To do this, enterprises may actively ramp up their cloud security options to consistently identify risk, prevent, detect and respond to threats across the business, as well as secure access services as part of their remote working infrastructure.
One of the main challenges that comes with this migration is the pressure on IT and security. A hybrid workforce (home and office) involves different work hours, locations and variable spikes in network traffic, making threat identification a newfound challenge. Many organizations have looked to integrate development, security and IT operations teams to create a DevSecOps team. The integration enables these teams, who traditionally work in siloes, to collaborate better with the same tools while driving greater efficiency.
Evolving Cybersecurity Requirements
The Lunar New Year is traditionally seen as a herald of new beginnings. However, the global health crisis is not yet over with many countries seeing second or third waves of the virus. Enterprises are likely to continue remote work or hybrid work arrangements this year. Also, cloud technology will remain a sought-after technology for enterprise IT teams as they prioritize support for a distributed workforce.
Enterprises will need to refocus their cybersecurity strategies to address the ongoing changes and challenges that comes with business during a pandemic. Adopting a bullish and strategic cybersecurity posture will allow enterprises to focus on driving growth and resilience in the year ahead.
