RETHINKING
SECURITYCIO ADVISORY BOARD
SUMMER 2021

INTRODUCTION
DELIVERING SECURE BUSINESS IN A VOLATILE WORLD
The profound changes in the way we live our lives and conduct our business overthe last 18 months have fundamentally changed many things, but a central priority
continues to be security.

THE SECURITY
MARKETPLACE IS
ARGUABLY THE
MOST DYNAMIC AND
DIVERSE OF ANYACROSS THE
IT LANDSCAPE

Whether in the delivery of consumer services via digital channels or the facilitationof remote (and hybrid) working – security principles and architectures are beingredefined as we further exploit technology to support and enable the demands ofeveryone.
Underpinning this is a holistic transformation, not only of technology platforms, but
the way that it is deployed and operationalised to enable business outcomes.
Technology enables us to connect people and to obtain real-time access to information.
It has also been key to enabling businesses to rapidly redefine value streams that
service dramatically different customer needs, preserving jobs and livelihoods.
This rapid period of digital enablement has impacts upon security for businesses,and for consumers. Security and risk are always core business concerns, and theenvironment today feels like one in which the previous delicate balance has been
disrupted, and we must reconsider approaches to manage risk and ensure securityand compliance.
This pandemic era will have an additional footnote in history of fuelling a rapid shift indigitisation. Whilst security has long been a business imperative, it is hard to overemphasise the focus we must apply to it in the period ahead.
Security and risk, once the concern and responsibility of specific experts – is now
everybody’s concern and is part of every conversation and decision.

2

THE PURSUIT OF INTRINSIC SECURITY

MOVE TO CLOUD

The security marketplace is arguably the most dynamic anddiverse of any across the IT landscape. A typical enterpriseorganisation might have over 100 security tools and products,
many being well established products and brand names that infer
trust and confidence built over many years.

For years the move to cloud has occurred in the form of adoptionof Software as a Service (SaaS) solutions such as Office 365,
Salesforce and Workday to name but three. In many instances
organisations understand how to deliver this, through Identity
Management and Information Protection systems to protect
corporate data.

But the security landscape has been one in which we haveseen massive innovation throughout recent years. The security
ecosystem has literally thousands of technologies, with new
products being launched to market at an unrivalled pace. Each
new product seems to offer the solution to the challenges,
perceived or real, of earlier on incumbent products and tools. The
market also capitalises on the buzzwords and hype that pervades
the IT market, with the promise of Artificial Intelligence, Machine
Learning, and Observability embedded into next generation
solutions, surely providing an enhancement on what is alreadydeployed and the old ways of doing things.
All organisations are driven to resolve and mitigate any
potential vulnerabilities and security threats that exist in theirinfrastructure, but this is also mapped by a period of significant
technology transformation taking place, generating newchallenges and considerations for security professionals.

DRIVERS FOR SECURITY CHANGE

The next phase of the cloud journey is mainstream adoption ofcloud platforms – IaaS and PaaS services, and the delivery ofnext generation cloud-native solutions. This area will accelerate
in 2021 and beyond as businesses look to drive operational
efficiency and generate agility through IT, but creates newquestions around how security should be designed and delivered
and how responsibilities should be divided between the provider
and the customer.
The move to cloud also keeps topical the questions of data
governance and sovereignty – particularly relevant not only in theface of recent drivers like Brexit and GDPR.

ALL NOTIONS OF A SECURITY‘PERIMETER’ HAVE VANISHEDHYBRID WORKThe most obvious driver today is the remote and ‘hybrid working’world we find ourselves in, and that we must work through inthe period ahead. In the face of urgent demand in Q1 2020, ITorganisations enabled mass remote working rapidly.
However, few organisations had architected for a hybrid working
use case, so security systems and controls may deliver anineffective user experience or be operationally cumbersome tosupport in a highly distributed model. All notions of a security‘perimeter’ have vanished – with lack of visibility and evenunderstanding of when, where and how people are remotelyconnecting to corporate resources. The volume and varietyof endpoints is increasing, a mix of both corporate and noncorporate devices impacting the ‘front line’ of security strategies
in Endpoint Security. The core network is now the public internet,
with access and controls required to provide flexible, user friendly
access to on-premises and cloud (SaaS) resources.

DATA AND INFORMATIONThe explosion of data growth, and its usage over past years haspresented opportunities for businesses in many ways. This has
also dramatically increased the importance of securing all kindsof data stored in company systems and apps, in order to protect
customer information, and secure intellectual property and othercorporate assets.
This data, the ‘crown jewels’ of an organisation, has made it acompelling reason to attack organisations to steal it, or to holdthe business to ransom. Allied with the shifts in architecture being
deployed, use of SaaS platforms, business partnerships andecosystems has made the management of risk, compliance andsecurity associated with data a primary concern.

3DIGITAL ENGAGEMENTTHE SECURITY RESPONSE

The digital channel is now the primary channel in many instances.
From retail to hospitality to healthcare, consumer engagement via adigital app or website now provides a faster and superior experienceto face-to-face contact.

ENSURE THE ‘BRILLIANT BASICS’Smartphones create opportunities for consumers to accessservices in any place, at any time – but generates an explosion
at the back end for security departments to track, predict andunderstand user behaviour and validate the integrity of theinteraction. This mass use of digital engagement opens new vectors
for attacks on an unprecedented scale.
Add to this debate the human angle. We are living in a period ofheightened fear, uncertainty and doubt. The ability to capitaliseon the lack of digital skillsets of users or obtain success throughincreasingly sophisticated attacks such as spear phishing are real,current concerns.

SECURITY NEEDS TO BE
INHERENT AND INTRINSIC– RATHER THAN ‘ADDED ON’
AS AN AFTERTHOUGHT

Cyber security and the dramatic implications of cyber vulnerability
was elevated to be front-page news in 2017 with the arrival of
WannaCry and NotPetya. These two attacks that demonstrated how
disabling a mega cyber security attack could be – particularly whena key victim of the attack was the NHS, as an example.
The back story here is simple. Software patches for vulnerable
systems had been available well before the attack, but a lack ofproactivity, concerns about the risk of disruption from updates aswell as deficiencies in asset visibility created a time gap opportunitythat these potent attacks capitalised upon.
What these events remind us of is that the basics of IT security
need to be a priority. Core operational discipline could reduce theimpact of different attacks. Providing continuous asset visibility,least privileges, hardened IT systems, secured DNS, and system log
aggregation and correlation via Security Information and EventManagement platforms (SIEM) help better prevent and detectattacks. All now core parts of the defence strategy that must bein place.
We must also change our mindset. Security needs to be inherent
and intrinsic – rather than ‘added on’ as an afterthought. Carefullybalancing the user experience against the core security controls tomaximise the protection at every stage of the user journey. Security
is when a system works as intended and only as intended.
Brilliant basics balance the requirements across technology
architecture and operations. Effective deployment andconfiguration; rigorous and sustained management and operations;an outward lens on what is happening outside your immediate
environment to ensure future threats are anticipated.

4THE ‘NEW’ WORLD OF SECURITYTECHNICAL TRENDS IN SECURITY

Brilliant basics alone are not enough. The labour-intensive approachto the implementation and configuration of security controls is now
fundamentally challenged by the dynamics of digital. Good control
delivers trust in the core platforms, which itself creates opportunity
to accelerate the use of new technologies in order to grow.

SECURITY CONSOLIDATION - PLATFORMS VS BEST OF BREED?

One of the major challenges is a critical shortage of skilled security
professionals. This challenge cannot be solved quickly - everyone
is fighting for the same people and skills. Human skills must beaugmented with highly-effective technology to succeed. Securityautomation is a key example of maturing capability, as is theadoption of DevSecOps as a model to break down the siloes andchallenges to delivering security effectively, whilst retaining pacewith the business.
The security marketplace is buzzing with new technology that
proposes to eliminate the pain and challenge of today; next
generation ‘data-driven AI or ML powered’ tools to improve the quality
and operational effectiveness of delivering security. The security
market is a confusing place to operate, and the conversation nearly
always focusses on the extra tool you need rather than delivering
better with what you have today.
The new model of security needs to consider new technology, better
operational processes, a fundamental recognition that the context
for security has changed, in terms of where and how services areconsumed. The limit for scaling human labour is being reached, yetbusinesses need to continuously grow and innovate, and security
must continually be enhanced and assured.

Security consolidation is no longer desirable, it is essential. The
level of complexity from platform and tool proliferation has madeit almost impossible to be operationally efficient and deliver greatsecurity.
The security world was founded in a ‘best of breed’ mindset. This led
inevitably to stranded investments, operational ineffectiveness andgaps caused by the integration cost of this approach.
More recently the ‘platform play’ emerged. Pick a ‘swiss army knife’
type product, and for minor functionality sacrifice you gain in thesignificantly reduced integration burden – for some maybe evenproviding a better outcome through simplicity in operations or UX.
Secure Access Service Edge (SASE) is currently ‘in vogue’. SASE
provides a new approach that delivers common networking
and security functions in an integrated platform approach.
SASE solutions are now commonplace across the leading security
vendors and are increasingly attractive based on the potential
to drive down security procurement costs, deliver combinedfunctionality across hybrid architectures and enable flexible
connectivity.

ARE MICROSOFT A SECURITY COMPANY? YES. BUT WHY?
In recent years, the acceleration of Microsoft’s position as a security
vendor has been significant. Notable acquisitions and investments
now see them placed firmly in the debate for modern security.
And aligning with their core client and cloud offers, they offer anengaging and compelling vision.
A key catalyst was Windows 10. This was but a fundamental
redefinition of user experience, and user and device management
and support. The continual (Evergreen) update approach creates
challenges for the third-party ecosystem to keep up, but creates anopportunity and benefit for Microsoft. And Microsoft capitalised on
their consumer footprint, leveraging the ‘telemetry’ from globally
deployed Windows 10 devices to deliver innovative security insights
and services.
Microsoft are not a new security vendor. They have built security
functionality in their products for many years. They have now
integrated and unified investments to deliver a platform solution.
Their incumbency within the customer technology environment
means you cannot ignore them, and we see many instances ofsecurity product displacement in favour of Microsoft alternatives inthe months and years ahead.

5

ARE ZERO TRUST MODELS THE NEXT TARGET?

STRIKING THE DELICATE SECURITY BALANCE

Zero Trust is also ‘in vogue’. The industry being quick to position
the importance of the Zero Trust model to deliver security in themodern world.

Delivering effective information security is complex, however, afocus on good operation practices to ensure security fundamentals
are maintained will deliver increased levels of cyber security
confidence.

Zero Trust describes a set of security principles underpinned by
the need to understand context. The context could be location,device, or user identity, and it is always verified before granting
access to resources, and most importantly can dynamicallychange. As the world has adapted to remote working, it is easy
to see why Zero Trust conversations are so prominent whenorganisations have much less visibility and control on where andhow people are connecting to their systems.
Zero Trust is not a singular solution or technology. The approachrelies upon many of the ‘brilliant basics’ such as Digital Identity
and the ability to quickly provision and de-provision access using
trusted automations.

SECURITY OPERATIONS
Proactive security operations are now a key part of a closed loop
approach and vital to the maintenance of security awarenessand response. It is impossible now to be secure by operating ina reactive manner, and the volume of security notifications andalerts from increasingly connected users and systems need you
to be able to cut through the noise to stand a chance of identifying
the real threats.
A drive towards SOC and proactive cyber defence services area key part of the strategy to protect both customer data andinternal data and systems. The common challenges of poor asset
visibility, proactive maintenance and support of technical assets
and a 360-degree awareness of the wider environment are key toongoing management of cyber risks.

6The use of cyber security compliance frameworks paired with an‘assume breach’ mindset is a good place to start. The frameworks
ensure that organisations benefit from the best guidance available
with the potential to gain certification to validate high levels ofsecurity are in place and maintained. CIS, NIST, ISO, cyber essentials
are a selection of well used cyber security frameworks andstandards that deliver guidance on the most effective approach to
cyber security defence, remediation and operations.
Delivering effective information security has always proved
challenging for organisations but never more so than today.
Defenders need to be perfect all of the time but cyber attackersonly need to be successful once. This means that maintaining an
up-to-date operating environment, leveraging and updating goodpractices, and seeking to simplify the environment is essential.
Security was once the responsibility of the technology team,
implementing perimeters and controls in a world where you knew
what was trusted and what wasn’t, and where it was. Today’ssecurity threat is more diverse – from more users, across more
locations, on more kinds of devices – and this amplifies thebusiness risk conversation and the implication that failure orvulnerability have on organisations as well as their consumers.

CYBER SECURITY AND
SECURITY RISK MANAGEMENTIS NOW EVERYBODY’SRESPONSIBILITY AND CONCERN

About Computacenter
Computacenter is a leading independent technology partner, trusted by large
corporate and public sector organisations. We help our customers to source,transform and manage their IT infrastructure to deliver digital transformation,
enabling users and their business. Computacenter is a public company quoted on
the London FTSE 250 (CCC.L) and employs over 16,000 people worldwide.

Computacenter (UK) Ltd
Hatfield Avenue, Hatfield, Hertfordshire AL10 9TW, United Kingdom
computacenter.com+44 (0)1707 631000