Future thinking: technology is changing the way organizations manage IT security

eSentire has partnered with noted BBC journalist and technologist Ben Hammersley to present BlackHatWhiteHat, a podcast mini-series that dives deep into everything cybersecurity. Each episode features global industry experts who analyze the breach cases dominating today’s headlines, lifting the curtain that conceals the black hat culprits and the white hats working to stop them.

In celebration of the series’ launch, I recently sat down with Ben to learn more about his technological predictions and how those new tools will change the way organizations think about data protection and IT security.

Mandy Bachus (MB): As a technologist, you live on the cutting edge of technological innovations. What sort of trends are gaining popularity?

Ben Hammersley (BH): It’s not a cop out to say, “it depends”. Technological innovations don’t happen at the same time for everyone, and especially in the corporate world. It takes a generation for the major shifts to flood through the system, as it were. So we end up with two types of trend. The first are the buzzwords we read about in magazines - Big Data, Internet of Things, Artificial Intelligence - but these appear more often in PowerPoint decks about Disruptive Innovation than in real life. The second don’t appear to be cutting edge but are the things that are actually, truly, trending: web-based internal process infrastructure, Bring Your Own Device (BYOD) policies, customer service moving to social media, and so on. To the technologically savvy, these appear as decades-old, but to the majority of businesses and normal people worldwide, they’re radically new. Most of the world isn’t adapting to Slack on their Apple Watch: they’re just getting off Lotus Notes.

MB: Of those trends, which do you predict will impact the workplace and how?

BH: I think it’s the shift to the open internet as the network for corporate infrastructure, and the BYOD policies that come with it, that makes the biggest difference. It’s ultimately liberating for everyone concerned, reflects the availability of new services and tools, and respects the sophistication of employees’ 21st century media and social lives. That might be a generational thing to concentrate on, but things like access to Facebook during the working day, or the ability to use WeChat or WhatsApp as legitimate professional communication tools, are proving to be key, especially in recruitment. It’s increasingly hard to recruit talented graduates, for example, to a social-media blocking corporate environment.

MB: What sorts of security risks do these applications pose, particularly in relation to work environments?

BH: It radically increases the number of attack surfaces, both computational and social. In other words, there’s just a whole lot more to hack, and a whole lot more to protect. Computationally, there are many more exposed interfaces, and a device environment that’s increasingly heterogenous and out of the control of traditional IT departments. Socially, it’s so very much easier to find exploitable information about employees and their families, leaving them wide open to sophisticated phishing attacks.

MB: Obviously given the rate of technological adoption, we can anticipate that businesses will integrate new tools quickly; what considerations should organizations bear in mind as the risk associated with these tools grows?

BH: Totally right, and that adaption is accelerating too. I think the main issue is one of mindset, from the boardroom on down. Service industries, without critical physical infrastructure like factories, are entirely dependent on the sanctity of their data and the contents of their employees brains. The core of the business walks out of the door every evening. So the issue is one of balancing the need to keep that data safe, the applications secure, and the so on, with providing the working environment required by a transient workforce. That’s not simply a job for a CTO, but one for the CEO. In fact, it’s increasingly arguable that the difference between the CEO and the CTO in such firms is negligible. Anyway, the core thing, I think, is for that leadership to be aware of, and emphasize in a mature way, the importance of good practice and the risks, especially, of social engineering. But this has to be in a way that respects the possibilities of the tools of the modern world. It requires the leadership to be aware of the true working practices of their employees, and to be undertaking a constant reassessment of how their company actually works. That’s hard work, and rarely done.

Ben Hammersley is a veteran of TV, print and radio. He most recently presented the award-winning Netflix and BBC World flagship series Cybercrimes With Ben Hammersley. He's the author of five books, including the international best-seller, 64 Things You Need To Know Now For Then: How to Face the Digital Future Without Fear (UK title; 2012, Hodder). He is credited with inventing the word ‘podcasting’ in a 2004 article for The Guardian newspaper. You can find him at benhammersley.com.