David Ng, Area Director, Asia, SecurityScorecard

A proactive approach to increasing the cyber resilience of critical infrastructure is necessary to ensure the continued delivery of vital services. And a move towards metrics, regulations, and strengthening the supply chain would create a more reliable and trusted digital future. One where all stakeholders will benefit by improving their individual cybersecurity health for the sake of the greater good. With a more transparent and measurable view of cyber risk, critical infrastructure institutions can not only become more sustainable but preserve trust as well.

Anticipating any significant shifts in IT infrastructure design or cybersecurity strategies

It is likely that there will be significant discussion around cyber resiliency, which takes into account being more resilient against, not just cyber security events, but anything IT related, like this incident. More companies will consider Endpoint Detection and Response (EDR) alternatives, like air gapping and isolation. More companies will consider completely blocking automatic over-the-air updates and opt for systematic and controlled updating to critical software applications. You will potentially see organisations take a more heterogeneous approach too. Mixing more Mac versus Windows and maybe using multiple EDRs across their footprint.

The risks of relying heavily on a single vendor for critical cybersecurity services and how businesses can diversify their cybersecurity strategies to mitigate such risks

Goldman Sachs used to have a policy to get tools from multiple vendors. This way, if one firewall goes down by one vendor, you have another vendor who may be more resilient. This global outage is a reminder of the fragility and systemic ‘nth-party’ concentration risk of the technology that runs everyday life: airlines, banks, telecoms, stock exchanges and more.

SecurityScorecard, in collaboration with McKinsey, produced research showing that 62% of the global external attack surface is concentrated in the products and services of just 15 companies. What this means is you need to have diverse systems, know where your single points of failure are, and proactively stress-test through tabletop exercises and simulations of outages. Consider the “chaos monkey” concept, where you deliberately break your systems – e.g., shut down your database or make your firewall malfunction to see how your computers react.

Emerging technologies or cybersecurity practices that could significantly improve the resilience of critical infrastructure against similar events

Understanding and managing your supply chain is critical in mitigating these risks. By proactively identifying dependencies and potential vulnerabilities within your ecosystem, you can strengthen your organisation’s resilience against such disruptive events.

Melissa Bischoping, Director, Endpoint Security, Tanium

This event was a reminder that although we all benefit from the speed of real-time connectivity and information, we must also balance that with the risk of problems that can spread at the same speed. Going forward, we must be focused on resilience and redundancy in the technology we build and deploy across the globe. It is inevitable that failures will happen so having layers of resilience, real-time visibility, and business continuity plans which account for the most complex remediation must be at the centre of every risk management conversation.

This was a rare occurrence that the entire industry will learn from. Increased attention to detail in software delivery coupled with real-time visibility of changes on endpoints, and autonomous capabilities to alert – and stop – problematic updates will be a critical part of the future of safe, reliable software delivery and enterprise IT management. The world needs to run on solutions that co-exist together and provide support when one fails.

We place a lot of trust in the providers that deliver software to our organisations. It’s imperative that we have conversations about allowing the customer to remain in control of changes to endpoints and balance the need to deploy the most up-to-date information with each environment’s unique risk acceptance strategy. Allowing organisations some level of control over the rate at which endpoints receive change is critical component of risk mitigation, and one that helps build trust between a software provider and their customers.

Alexander Liskin, Head of Threat Research, Kaspersky

The world has been following the news of the recent global IT outage affecting thousands of businesses, including airports and banks. To prevent such situations in the future, information security vendors must be highly responsible for the quality of updates they release. It’s crucial to adhere to the principle of granular update release. This means updates are not rolled out globally to all customers simultaneously, but gradually. This approach allows for faster localisation and resolution of any unforeseen failures.

Additionally, continuous monitoring and the ability to immediately halt updates are essential. Should any unexpected issues arise that affect users, they must be registered with the appropriate priority, and measures for resolution should be analysed and implemented promptly. Addressing the problem becomes a top priority at all levels within the company. As with any cyber incident, it’s vital not only to mitigate visible damage but also to identify and rectify the root cause to prevent similar incidents in the future.

Todd Inskeep, Founder & Executive Cybersecurity Advisor, Incovate Solutions

Companies, and particularly business leaders, need to step back and recognise that events like this are very rare – yet incredibly impactful. The last time we had a similar global event was in 2017 with NotPetya. Even 45 minutes in seven years is less than six sigma quality across the combination of cloud and IT technologies. Business and IT leaders have to combine third-party risk reviews with wargames to explore what-if scenarios. What if this technology (and the associated business process) is unavailable due to a cyber-attack, an update, misconfiguration, or another type of incident?

For industries like finance and health care, we also need to think about the recent CDK Global and Change Healthcare events which had significant impact on US-based auto dealers and health care providers. Both events impacted and affected businesses for most of two full weeks with significant revenue impact. How would businesses be impacted by a longer event?  How quickly could you shift to alternate technologies for critical business processes?  These are important questions that IT and business need to answer together.

Cloud Diversity vs. Business Agility: Striking the Balance

“The cloud enables companies to diversify IT and cybersecurity strategies although scalability and efficiency are often more important business considerations. Companies should review which underlying cloud platforms their SaaS services depend on and consider whether consolidation on a single cloud platform will best meet long term business goals. We’ve already seen financial services pull back from going all-in on the cloud to maintaining their own critical data centre operations. The real goal is ensuring the resiliency of business operations which encompasses more than IT diversity.

Cybersecurity is critical across the IT systems and also requires reslience as attacks could come from many directions. After more than 30 years of the Internet we should be better at anticipating which types of incidents are most likely, including the occasional errant patch. Consider, while IT has largely shifted from on-premise to the cloud, the dangers of building a business on one technology (or one cloud) remain. This event affected only one half of one percent of Windows machines (8.5M/1.4B) globally. Imagine your business (and third parties) if three percent of Windows systems were impacted for hours or days in a global event.