Andrew Rose. Image: Proofpoint
Proofpoint’s Andrew Rose discusses the ongoing cybersecurity challenges companies face and how automation can help with the industry’s skills shortage.
Andrew Rose is resident CISO for the EMEA region at Proofpoint. His core responsibility is to build and maintain relationships with the wider CISO community, using their first-hand experiences and real-time feedback to ensure Proofpoint is making the correct strategic decisions with regard to product, features, priorities and platform architecture.
“As part of this, I advise CISOs on how to best develop robust cybersecurity strategies and, crucially, how they can communicate to their board the importance of investing in the right defences,” he told SiliconRepublic.com.
“We recently surveyed 1,400 CISOs and found that only 51pc of global CISOs believe that their executive board sees eye to eye with them on cybersecurity issues. This lack of alignment leaves organisations vulnerable to the increasingly complex threat landscape, so my aim is to share knowledge and guidance on how CISOs can better demonstrate the value of cyber resilience as a business priority.”
‘The human factor in cybersecurity is the one challenge that is not going to go away any time soon’
– ANDREW ROSE
What are some of the biggest challenges you’re facing in the current IT landscape?
I think the overarching challenge that everyone in this business is facing is complexity. No matter how big your organisation is, your data is not all conveniently stored in one place. It is spread across multiple networks, owned and handled by a multitude of third parties and SaaS platforms, and applying consistent security measures and policies across all these becomes a real challenge.
Similarly, if you are unable to easily identify all your assets, it’s difficult to gain an informed understanding of all your potential vulnerabilities, such as those in the OS stack of your SaaS provider, the Log4j tool embedded into you application code, or the many Office 365 vulnerabilities which crop up on a regular basis.
Now, not only do organisations have to worry about managing their own security, but they also need to be concerned about the security of every other business they work with, whether it’s their outsourcing partners, SaaS platforms or any one of the suppliers that provide vital elements of their key product.
Each part of the chain increases an organisation’s total attack surface and the more complex the chain, the wider the attack surface and the more difficult it is to gain visibility into the real risk, and to apply robust cybersecurity strategies.
The ‘human factor’ in cybersecurity is the one challenge that is not going to go away any time soon. The World Economic Forum’s most recent data shows that about 95pc of cyberattacks can be traced back to human negligence – but I’m still not seeing enough focus on tackling people-centric vulnerabilities in the cybersecurity industry.
What are your thoughts on digital transformation?
Digital transformation is fundamental to modern society and there is no way back from where we are now. Marc Andreessen’s much-quoted assertion that “software is eating the world” continues to ring true, with the World Economic Forum estimating that 60pc of global GDP will be digitised by the end of 2022. And even when the asset is strictly physical, we’re often creating digital twins to model and manage them.
We’re at a point where these digital platforms are a key part of the expanding critical infrastructure that supports the population and must have security at their heart if we are a cohesive and resilient society.
At Proofpoint, we focus on the major threats we see targeting both critical and value add infrastructure. Every day we see millions of attacks targeting people within organisations over major attack vectors such as email, and we’re working with our customers to address the increasing challenge of protecting vital services from disruption, or vital data from being stolen or misused.
One of our key focuses is also preventing insider threats, whether malicious or simply negligent, from severely damaging an organisation from within.
How can sustainability be addressed from an IT perspective?
The good news from an IT perspective is that there are now many far more energy-efficient and sustainable options for running a digitised business. Outsourcing is delivering huge benefits in this area – no longer does each firm need to maintain its own hardware stack, which has traditionally been run on inefficient old hardware.
We are now able to take advantage of the most modern, virtualised systems, held in energy-efficient colocated data centres. Positioning these data centres in cold climates further reduces energy usage.
While the global move to remote and hybrid working certainly brought its fair share of IT and security challenges initially, you can’t deny that reducing the number of users commuting to a central location has been beneficial in reducing carbon footprints of those individuals and their organisations.
Going forward, organisations should be demanding more from their suppliers when it comes to sustainable practices, while equally demonstrating with greater transparency the actions they are taking to reduce their negative impact on the planet.
What big tech trends do you believe are changing the world?
In the cybersecurity industry, we have been facing a skills shortage for some time now, and I see automation as essential to tackling this.
At the same time as working to bring more talented people into the industry, there are ways we can use automation to reduce the overall workload and burden on our existing staff to reduce the gap.
By automating time-consuming, manual processes, security professionals can spend more time on delivering value for their organisation and as defenders we can claw back the advantage that the attackers have.
One exciting part about automation is its potential for implementation in wider society, such as driverless cars, drone deliveries, airport check-in, medical diagnosis and much, much more. Of course, the success of all of these initiatives will be dependent on security!
It’s hard not to get excited about the potentials of artificial intelligence and machine learning. We now have the ability to rapidly identify anomalies and outliers in vast amounts of data, which allows us respond to cyber threats in a much quicker timescale.
Hand in hand with automation, AI and machine learning has changed the cybersecurity industry for the better and is a vital technology in our arsenal of defences.
How can we address the security challenges currently facing the cybersecurity industry?
In the past couple of years particularly, we have seen cybersecurity companies themselves being targeted by very sophisticated attacks. As a company that our customers depend upon to protect them, it means we have to work even harder to protect our own services and infrastructure and practice what we preach.
Alongside that, as the regulatory compliance landscape develops, focusing on the provision of localised services is key to make sure we can meet our customers’ unique needs.
It’s important that we leverage AI and machine learning to continually improve the security controls we can apply to protect not only our customers, but their customers as well.
An increasingly digital-dependent society inherits complex cybersecurity threats, and they are woven into the fabric of our daily lives, so we need to be on top of our game.
10 things you need to know direct to your inbox every weekday. Sign up for the Daily Brief, Silicon Republic’s digest of essential sci-tech news.
