CIO POV: Building trust in cyberspace

Trust lies at the heart of every relationship, transaction, and encounter. Yet in cyberspace”, where we work, live, learn, and play”, trust can become elusive.Since the dawn of the internet nearly 50 years ago, we’ve witnessed incredible digital transformations paired with increasingly formidable threats. Knowing who and what to trust has become so difficult that the very notion of trust has been flipped on its head. This new philosophy of “never trust, always verify” is widely accepted, yet implementing zero trust effectively across technology infrastructure, partner ecosystems, and even daily digital interactions can still be challenging.I recently had the honor of discussing trust in cyberspace with a group of global technology leaders as part of CyberArk’s 10-year celebration as a public company at Nasdaq. Following are highlights from our wide-ranging conversation, along with some key considerations for building an anti-fragile digital ecosystem.

‘Trust is built in drops and lost in buckets’

I can’t take credit for this quote”, it belongs to Kevin Plank, founder of Under Armor”, but it’s one of my favorites. As CIO at CyberArk, building trust internally and externally is integral to my job. In fact, forging trust is THE most essential part of any software provider’s job. And as the world becomes increasingly interdependent, this also becomes the most challenging part.Virtually every organization relies on third-party products and services”, and for good reason. SaaS makes teams more efficient and effective and can strengthen security. Cloud platforms fuel innovation by lowering barriers to entry and eliminating back-end IT infrastructure headaches. Meanwhile, generative AI (genAI) has ushered in an exciting new wave of productivity, quality and creativity.

CyberArk With any technology disruption comes risk, and risk cascades downhill. According to research from data science firm Cyentia Institute, the average organization does business with 11 third parties, and 98% of organizations do business with a third party that has suffered a breach. Those numbers and associated risks quickly balloon when fourth-party relationships enter the picture: The average firm has indirect relationships with 200 fourth parties that have been breached.A compromise on one party can lead to a compromise on all. Consider the recent attacks targeting cloud storage firm Snowflake customers, which snowballed into a massive global breach.Yet the notion of trustworthiness goes beyond cybersecurity. Increasingly, the narrative is shifting to resilience. The July 2024 CrowdStrike incident”, in which a corrupt update file crashed millions of Windows-based machines worldwide”, highlighted an inherent trust gap in today’s interdependent cyberspace architecture. Though the internet’s early founders took decentralization precautions to avoid such catastrophic events, we’ve reached a point today where some significant single points of failure jeopardize its resilience.

Bridging the trust gap

In this environment, organizations must rely on partners who can demonstrate their ability to uphold service availability requirements, secure environments, and protect data. Building trusted vendor partnerships starts with a solid strategy and guardrails for good decision-making, such as certifications (i.e., ISO and SOC2), frameworks (i.e., SBOM), third-party risk scoring mechanisms, clear contract terms and conditions, and many other aspects (i.e., MFA, data at rest encryption and patch management requirements).As genAI use surges, organizations are increasingly focused on ways to understand and govern the AI-based tools of their third-party vendors. While frameworks are evolving, the most crucial consideration”, at least for now”, is that the customer organization’s data is safe. Some critical questions to ask potential partners include:

Ensuring a resilient cyberspace for our future

Bridging the trust gap to ensure a resilient cyberspace for all requires collaboration on many fronts”, beginning with stronger public-private partnerships. Recent strides made by the U.S. CISA, NSA, Cyber Command, and several major tech corporations to share threat intelligence, mitigate attacks, and promote secure by design practices are very encouraging. The behind-the-scenes collaboration to protect the U.S. 2024 election is a great example. In an unprecedented year marked by AI-based deep fakes and misinformation campaigns, these partnerships are crucial for defending democracy and preserving modern infrastructure.Building on these resilience efforts is what I call the Solution Hygiene Framework, another mechanism that organizations can utilize in their own cyber resilience journeys.

CyberArk This three-pronged framework includes:

Vendor validation that maps the organization’s complete vendor ecosystem and identifying critical ones. It’s important to establish an annual cadence (at minimum) for evaluating vendors to identify any changes, both good (such as a new certification with a better recovery time objective that supports its availability) and bad (such as a recent breach).Continuous regulation assessments because regulations”, from new AI acts to GDPR updates to MITRE framework changes to new NIST standards for post-quantum encryption”, are constantly evolving.System updates that happen over time in a phased sequence as the world continues to change and new lessons are constantly learned. Our digital landscape is defined by new attack methods, technologies, identities and regulations, and only through thoughtful, risk-prioritized updates can organizations build truly resilient digital infrastructures.

It begins and ends with trust

Trust is vital to business resilience and success. If we lose it, the internet will cease to be a powerful tool for good. But if we preserve it, we can unleash infinite possibilities.I’m optimistic that we can realize a brighter digital future together by focusing on trust”, building it drop by drop, maintaining it, evaluating it, and continuously investing in it.Additional content from Omer is available on CyberArk’s Security Matters | CIO Connections page.

First seen on csoonline.com

Jump to article: www.csoonline.com/article/3615961/cio-pov-building-trust-in-cyberspace.html