3 Ways CISOs Can Maximize Cybersecurity Investments in a Tough Economy
We’re hearing from cybersecurity executives that they are under pressure to improve efficiencies while simultaneously maintaining security for their organizations. This often means defending against evolving cyber threats and managing increasingly complex attack surfaces with fewer resources.
Cost cutters beware, as Forrester Research Vice President and Research Director Merritt Maxim notes, regardless of whether the current economic downturn is a temporary dip or will continue for a prolonged period. “It’s a time for CISOs (chief information security officers) to strengthen influence, generate goodwill, and dispel the perception of security as a cost center, by relieving downturn-induced burdens placed on customers, partners, peers, and affected teams.”
This will require management to rethink their approach to cybersecurity investments. More CISOs will turn to AI (artificial intelligence), ML (machine learning), automation, and managed services for their cybersecurity solutions, so their organizations don’t just "have to” do more with less, but are “able to” do so, by reducing the administrative burden of cybersecurity.
I recommend cybersecurity leadership prioritize three specific areas: ZTNA (zero trust network access) solutions powered by AI and ML, software supply chain security solutions such as binary scanning, and MDR (managed detection and response) services. I will explain how in this article.
1. The Importance of Zero Trust Network Access
To appreciate zero trust network access, consider the challenges of today’s CISO. They must enable the business by providing secure remote access to employees wherever they are located, plus protect the organization’s cyber assets on-premises (“on-prem"), in the cloud, or in a hybrid environment. By extension, this means deploying trusted network and security tools everywhere, as well. And increasingly, boards and executive leadership must detect and handle the zero-day threats that regularly make headlines — all within a limited budget.
Fortunately, ZTNA is a cost-effective approach to meet these challenges. CISOs can use BlackBerry’s proven platform CylanceGATEWAY™ or consider other zero trust network access technology.
In terms of system infrastructure, ZTNA brings important security and network tools together into one holistic solution. This interconnectivity delivers a strong starting point for CISOs to modernize their entire cybersecurity program. Here are some of the core benefits of investing in zero trust network access:
ZTNA can reduce costs associated with on-prem. According to Forrester Research’s report, “Planning Guide 2023: Security & Risk,” on-prem security costs remain significant, despite the shift to the cloud. The guide’s authors state, “When expenditures for maintenance and licensing, upgrades, and new investment are combined, on-prem technology spending is by far the largest expenditure in the security budget.”
ZTNA can lighten the administrative burden of managing VPNs. Physical infrastructures, backhauled traffic, and behind-VPN network access all require valuable business resources, but these can be optimized by leveraging cloud-based ZTNA. Because zero trust network access not only permits granular control over which applications may be accessed, but also continuously monitors connection activity, administrators can deliver both security and productivity outcomes for their organizations.
ZTNA empowers companies to utilize SaaS (software-as-a-service). SaaS applications are business tools coded, owned, and managed remotely by third-party service providers, with the important benefit of delivering "whenever, wherever" access with any internet connection. Before the advent of zero trust network access, enterprises needed to route SaaS traffic through the on-prem network security appliances; unfortunately, this often overloaded the network and frustrated users. In addition, CISOs found that SaaS applications frequently rendered on-prem network and security appliances obsolete; this, in turn, would affect security controls or data governance and lead to a lack of visibility. Since ZTNA engages every user and device with clearly defined and granular protocols, access measures are implemented at the system level, allowing enterprises to reap the benefits of external SaaS applications without sacrificing either security or a positive user experience.
2. Software Supply Chain Security and Binary Scanning
The software supply chain is anything and everything that touches an application, or plays a role in its development, throughout the entire software development life cycle. Software supply chain security means securing the components, activities, and practices involved in the creation and deployment of software.
The challenge that many organizations struggle with is identifying the origin — and consequently, the potential vulnerability — of all the code contained in their software supply chains. A typical application can contain well over 100 software dependencies; this inherent complexity, bundled with a global cybersecurity skill shortage, easily turns software stack visibility into a Herculean task.
In cases like this, a binary scanning solution that performs both software composition analysis and security testing quickly proves its worth. Such solutions — BlackBerry® Jarvis® 2.0 is a prime example — let cybersecurity teams detect and list open-source software, as well as commercial software licenses, that exist within their embedded software and systems. By generating an SBOM (software bill of materials), administrators can obtain a clearer view of the software stack, identify real and potential vulnerabilities more easily, and save cybersecurity teams much-needed time.
3. Managed Detection and Response Services
Often referred to in the industry as MDR services, managed detection and response solutions augment an organization’s capabilities to both proactively and reactively monitor more of their potential attack surface. MDR services often eliminate the administrative burden required to build, operate, and maintain an in-house SOC (security operations center). BlackBerry research indicates the total cost of building a SOC ranges from nearly $900,000 up to $3,000,000 and can take two years or more to complete, depending on its sophistication.
In contrast, an MDR service such as CylanceGUARD® from BlackBerry can save your organization between $710,000 and $2,550,000 and be fully operational — providing 24x7x365, 360-degree monitoring of your total operating environment — in as little as three months. Regular security assessment bolsters prevention, mitigation, and communication, while freeing up limited in-house resources, and reducing the risk of sustaining a damaging cyberattack.
Final Thoughts
In this turbulent economic climate, organizations can’t afford to cut back on cybersecurity. Doing so makes them easier targets for cybercriminals, and potentially increases financial risk. So rather than spending less, spend smart. Invest in services such as CylanceGATEWAY ZTNA, BlackBerry Jarvis 2.0 binary scanning, and CylanceGUARD managed security that can enable your business operations to function effectively with fewer resources and less administrative overhead. For more information on how BlackBerry can help your organization’s unique needs, connect with a BlackBerry expert today.
For similar articles and news delivered straight to your inbox, subscribe to the BlackBerry blog.
Related Reading
About Sriram Krishnan
Sriram Krishnan is the Senior Director of Product Management at BlackBerry.
