Intelligent Tech Channels Issue 29 - Page 50

Q&A EDITOR’S We have all heard the expression that the traditional firewalled perimeter is dead. In truth, the cloud, DevOps, mobile and IoT – next generation technologies that have helped enable the Digital Transformation – not only killed the traditional perimeter but actually expanded the bubble outside of our own physical data centres and brick and mortar buildings. The perimeter and the assets we consume are now outside of our physical and electronic control. We do not own or manage all the places they are present, and ALAIN PENEL – REGIONAL VP – FORTINET they may not even be within our own state, country or continent. With this in mind, assurances and management for security are outside of our control as well and subject only to best practices and regional governance like GDPR. Therefore, any risk from a vulnerability and exploit, to an insecure account or misconfiguration, can lead to an incident. If these threats are ignored or not identified, a breach or the loss of data and a persistent threat actor’s presence is possible. With the amount of news documenting breaches only getting worse, awareness needs to be raised to the highest level of management regarding the consumption of Digital Transformation technologies. The Making these resources suddenly available to remote users via the cloud introduces unexpected risks that may be challenging for organisations to address. location, security, sharing and proliferation of data is continuing to expand in the new bubble (perimeter) and a single pin prick (vulnerability or poor authentication model) can expose everything inside. This is the real security impact of Digital Transformation. Data can be in any place at any time. It can be at rest, in use or in transit. It may be copied unencrypted even when the contents are sensitive. It can be shared, staged, used for development and testing, or even sold and shared for monetary gain. It can be in the cloud, on a mobile device, shared through a file hosting service and have collaboration features for updates, edits and publication. The Digital Transformation is all of these and every egress and transmission point is potentially a security weakness. Security teams must map all the locations where Digital Transformation may have an impact on sensitive data and resources. Teams must secure each authorisation and authentication point with the best security practices possible. This also implies that all resources should be under strict vulnerability, patch, configuration and privileged access management. Security teams need to avoid any pin prick as they consider embracing Digital Transformation strategies. Even if they do not pierce an artery, the amount of blood loss (data) could be enough to get you in the news or worse, non-compliant with regulatory frameworks like GDPR. 50