Industry executives and experts share their predictions for 2023. Read them in this 15th annual VMblog.com series exclusive.
Cybersecurity and B2B Relationships – A Crystal Ball for 2023
By Jake Bernardes, VP Security and Compliance for Whistic
As a technology leader with experience in funding rounds, security transformations and the building of best-in-class security functions, I have an interesting perch from which to observe the business community at large. As VP, Security and Compliance for Whistic, I understand what makes businesses tick, how to take them from startup and growth to enterprise-level security, and in particular, a keen sense on what it takes to optimize sales regardless of whether the economic climate is good or bad.
As we look at the advent of 2023, however, we have some interesting data points to observe. According to new survey data, CEO confidence in corporate America is falling in the Q4 2022, but not to the levels we’d traditionally expect in a recession. The newest Business Roundtable survey of chief executives at 142 major U.S. corporations shows confidence in the economy declined 11 points to 73 on a scale in which scores above 50 represents anticipated expansion. However, the trend for the index also fell 12 points in Q3, signaling the lowest point in its long-run average since the pandemic started in 2020.
Other findings included the following:
- Plans for hiring in early 2023 decreased 17 points, to 61.
- Plans for capital investment decreased 7 points, to 68.
- Expectations for sales decreased 8 points, to 91.
While my own view is perhaps somewhat more optimistic than these executives, these sentiments do have a bearing on the predictions I will make for the state of cybersecurity programs and sales in 2023.
To that end, I believe CISO’s top priority in 2023 should be the following: Investing in the right areas, with a particular focus on automation of common processes and procedures in order to stay ahead of the curve going into 2023. In times like these, the best CISOs are able to focus on building the case for continued investment in cybersecurity and not fall victim to consolidation and technology stagnation.
Why is this this priority so essential?
By all indications, we are heading into a recession, or to a near recession, in which cash is king, which indicates that companies will put a high focus on reducing spend. But at the same time, all indications are leading to the need now, more than ever, to further invest in cybersecurity in order to protect our organizations and customer data.
How do we tackle this priority best?
We should leverage cybersecurity data and market data, which all points to an increasing (not decreasing), number of attacks in 2023, and educate our leadership teams on the importance of continued investment in cybersecurity as attackers prepare to ramp up during challenging economic conditions. Focus on making an internal case for key investments and be prepared to explain why your organization should be viewed differently during these times.
In summary, 2023 will be a year to focus on getting more for less, but this doesn’t necessarily need to mean that you are relegated to a reduced budget or consolidation of your headcount and resources.
Now I’d like to examine the way these priorities will apply most specifically to increasing cybersecurity posture and to higher success in achieving B2B technology sales. The following are some guiding principles I would like to suggest:
- “Fix a data breach when it occurs” is only a part of the answer. Yes, this is something we must do, but the statement itself suggests this is the cheaper option for proceeding, without considering that the potential costs of regulatory penalties, lawsuits or reputation damage will likely far exceed the cost of proactively creating a better security posture right now. Simply put, yes, even in a challenging economic time period, we must continue to invest proactively in maturing our security posture with a focus on people, technologies, and processes that meet not only the current trends/issues but also prepare us for what might happen next.
- Reactive security is the past. In a world where we once consumed off-the-shelf products that we installed in our Data Centers on legacy servers (probably IBM, running Linux) we didn’t have to worry about what might happen as we build our walls high and strong. Reactive response used to be easy when we controlled the environment, the variables, and the defenses. It simply meant dealing with things when they happened. If something were to happen, we could quickly isolate and confine it, and take the time we needed to react to it in a measured and considered way.
- Proactive is King for 2023. The world is changed. We now live in a world of SaaS that has made attack vectors and means wider, easier to transgress and more difficult to protect against. Security measures and technologies are now focused on identifying anomalies and suspicious behaviors to prevent attacks before they happen (or at least before they can do serious damage). This is a far more proactive in approach. But our current and new reality must be proactive – a complex and interwoven ecosystem with minimal knowledge (let alone control) of what’s happening, where it’s happening, and who’s securing our systems. So, we need to get out ahead of things and defend against threats before they surface.
- Compliance is good. Following NIST, SOC 2, and ISO 27001, etc., shows that you are covering the bases and basics. But as we know, it doesn’t make you immune from hacks. In fact, compliance often masks a host of shortcomings in the simple and routine processes that simply aren’t covered, or aren’t covered not in sufficient depth, by those standards. Real investment needs to be more than simply meeting requirements. It means investing in best-in-class people and supporting and encouraging their growth in knowledge and skills in both technical and non-technical arenas. It means investing in cutting edge technology that addresses not only existing problems but also the arising new issues.
- CSPM, SaaS stack security, compliance automation and vendor risk management are the key priorities now. This is about building robust, repeatable, and scalable processes that are routinely tested, widely understood, and followed throughout the organization. Beyond this, to be proactive, we need to build a security focused organization that continually raises awareness through training, engagement, internal marketing to permeate the IT department priorities through the wider organization. A business can only be secure when its weakest members of staff constitute a strength, not a weakness, to its security posture.
- What does this mean for Whistic (and vendor risk management? My own company, Whistic, is focused on expediting trusted B2B relationships by proactively sharing our security posture with our customers, vendors and stakeholders so they can understand in real time who we are, what we do and how we secure ourselves, our customers and their data. And for the sake of today’s supply chain, we need to create and support an ecosystem in which all organizations that participate together do the same. All should share their posture with each other in a transparent manner, giving us visibility into our vendors, or potential vendors, and allowing us to make risk-based decisions on what we do or do not introduce into our supply chain. The future is learning from one another about how we each approach our different problems, and sharing this information so that together, we can create a culture of security leaders built on trust, who strengthen one another through sharing and learning to create a better whole.
- Trust is king. Reactive or proactive, the truth is that right now, trust must be earned. Our agenda is to move closer in 2023 to a world where we can assess vendors in B2B transactions instantaneously, based on their proactively shared security posture, without even needing to talk to them. That is the single element that can move us from zero trust to “zero touch assessments” and from reactive to proactive in our security stance.
##
Watch this video to learn more:
ABOUT THE AUTHOR
Jake Bernardes is a technology leader with significant experience security transformation and best in class security functions. He is VP Security and Compliance for Whistic, provider of the Whistic profile. Whistic is a founding member of the Security First Initiative which aligns leading security vendors committed to proactively sharing their security profiles through the Whistic profile.
