Technology isn’t the only weapon for effective cybersecurity
Credit to Author: Jay Abdallah| Date: Mon, 14 May 2018 20:32:27 +0000
Technology can serve as a solid tool to ward off cyber attacks, there is no doubt, but what really comes into play is superior knowledge in recommending the proper devices, creating a plan and then executing on a solid security solution.
That is why we are talking about cybersecurity lifecycle services.
Services play the most critical role if you are looking at large enterprise and industrial users. Anyone can buy a firewall and anyone can implement a firewall, but when you take into consideration best practices, industry practices, experience, international standards, national criteria and you combine those into the way you configure these devices, you can assuredly know the solution provider has done it right. Services is the answer to that.
It hasn’t always been that way as the paradigm has shifted over the years. At first users were thinking security doesn’t look too confusing, but that has changed as manufacturers want the OT service provider to interface with the IT group and the security group. They are saying we want you to have the responsibility for the design and implementation.
Users are saying “I want to focus on refining oil, I want to focus on creating specialized chemicals, I want to focus on clean food and beverage manufacturing, I want to focus on water and wastewater treatment. I don’t want to focus on security, that is not my core niche. That is what I want you to do.”
A more intense focus on security services truly comes into play with the understanding there are not enough security professionals to go around.
Indeed, the cybersecurity workforce gap is on pace to hit 1.8 million by 2022 – a 20 percent increase since 2015, according to a Global Information Security Workforce Study. On top of that, 68 percent of workers in North America believe this workforce shortage is due to a lack of qualified personnel.
Additional takeaways from the study include:
- 66 percent of respondents reported not having enough workers to address current threats
- A third of hiring managers are planning to increase their departments by 15 percent
- 70 percent of employers around the globe are looking to increase the size of their cybersecurity staff
That is where a solid OT services plan comes into play.
Organizations have come to the realization they need specialization when it comes to running the business and protecting the system. There are two different disciplines there.
That is why different assessment services and managed services are starting to see a steady increase because manufacturers are realizing there are not enough hours in the day to keep up with the steady flow of work orders around a continuous process or a batch process and to also make sure the whole thing is operating in a secure fashion.
With different tools coming out like secure remote access, it is possible to say, “we are doing the heavy lifting” and instead of flying to your site, give us a couple hours of your time and we will be there to support you remotely through these processes.
That idea is starting to catch on with some of the small to medium businesses.
Let’s face it, with all the data coming in it is possible to get data overload with all these systems feeding information and not really realizing what is happening and what an operator should be paying attention to.
They have got thousands of alarms of themselves to deal with, they don’t need to worry about why is somebody failing a log in 20 times and then they finally realize somebody is fat fingering a HMI. That type of information could cause operators to continuously go down rabbit holes. That is why they would prefer to have someone else look into the security issues where they could provide the expertise, saying “Here is the cause, here is the resolution, assign it to somebody to go and fix on site.”
The managed security operation center is the next evolution of the next technology that is integrated into the business processes, and integrated into the lives of people you are working with. It is already integrated into the other solutions where they are all talking and communicating together. Now you can have the people on the security operations side monitor and manage security so the operator is not inundated with multiple security alerts so he or she can focus on keeping the operation running at the most productive state as possible to increase the company’s profit level.
Over the next two three years there will be a steady increase in managed security playing a key role. To date, there has been a 30 percent increase in users asking for that and purchasing services. At first, they are saying “Help us manage our firewalls because we don’t have a firewall expert in house, or help us manage our patch management or our systems.” That conversation will only expand as manufacturers realizes how outside experts help solidify a security solution.
Get more information and ideas at our Cybersecurity Virtual Academy, with new material and webinars on the way.
The post Technology isn’t the only weapon for effective cybersecurity appeared first on Schneider Electric Blog.