Cloud ERP, business AI, and even emerging technologies like generative AI (GenAI) have changed the way we do business. However, they have also introduced new cybersecurity challenges. In 2023 alone, data breaches inflicted an average cost of $4.45 million on businesses, with the average time to detect a breach being 207 days. This evolving threat landscape demands more sophisticated security measures.
The security challenge
Traditionally, castles had thick walls as the first line of defense. Similarly, firewalls and their access control list or intrusion prevention systems provided perimeter defense for digital assets. However, today’s advanced persistent threats, or APTs, are more likely to find new ways to circumvent these defenses.
Although AI can be misused, its potential to defend against cyberattacks is enormous. There are successful use cases where AI has been trained on large data sets and can now actively identify threats within complex systems.
getty
Cloud ERP and Business AI have created complex systems, making single-wall security strategies insufficient. Additionally, more than 60% of business data is now stored in the cloud, creating a vast network. This extended network, with remote workforces accessing beyond traditional secure perimeters, adds another layer to the challenge.
According to Gartner, GenAI is one of the top 10 cybersecurity trend drivers in 2024. Developing and fine-tuning GenAI requires access to a lot of data. Without strict data classification, sensitive data could be accidentally incorporated into models, increasing the risk of data breaches.
GenAI is like an intelligent tool that learns and imitates our way of thinking. But like humans, it can also have blind spots. For example, fake data can mislead GenAI and can then be used to create fake articles and news. These weaknesses, coupled with potential security flaws in the models themselves, make GenAI a tempting target for attackers.
Building a secure digital domain
To address these challenges, it is essential to rethink our existing cybersecurity strategies. We must take proactive steps to protect our systems.
Adopt security frameworks: Frameworks such as the NIST CSF provide a structured approach, moving beyond the check-the-box compliance mindset and creating a more proactive security mindset in the face of ever-evolving threats.
At SAP we use NIST 2.0 Cybersecurity Framework as our safety roadmap. This framework encourages businesses to take a more methodical and holistic approach with its core principles: govern, identify, detect, protect, respond and recover. These pillars serve as the foundation for a mature and sustainable cybersecurity strategy capable of withstanding the complex and persistent challenges posed by cyber threats.
Zero trust: At its core, Zero Trust simplifies the security system. At its core, Zero Trust assumes that breaches happen. It verifies every user, every time, using various data points such as user identity, location, device status, etc. This step is about giving people only the access they actually need and only when they need it. It assumes that breaches occur, emphasizing the need to compartmentalize data and apply encryption to improve security.
With Zero Trust, employees can work securely from anywhere, at any time. It also ensures a smoother and more secure transition to the cloud by closing all security gaps and minimizing risks related to data movement.
Patch Management: Like any well-oiled machine that requires regular checks and repairs, so does the security system. Patch management is the preventative action that identifies and fixes vulnerabilities before they become a problem.
The benefits are clear: avoid costly data breaches, including exposure of sensitive data leading to financial and reputational damage. This avoids production stoppages or system failures that affect productivity. Regular patches prevent software issues, ensure smoother, more efficient operation, and overall a more responsive system.
The future of security: AI and collaboration
Although AI can be misused, its potential to defend against cyberattacks is enormous. There are successful use cases where AI has been trained on large data sets and can now actively identify threats within complex systems. When a potential security breach is detected, machine learning algorithms can automate the work of creating multiple isolated environments to test the threat’s behavior.
This allows for faster investigation and rapid response to the incident. There’s even a use case that creates an AI-powered report that summarizes and prioritizes vulnerabilities, allowing security teams to focus on strategic issues.
Collaboration between cloud service companies, security providers and businesses is essential. Sharing threat intelligence and best practices helps identify and address vulnerabilities faster and more effectively.
A defense on several levels
In conclusion, just as castles have evolved from thick walls to a multi-layered defense system, our approach to cybersecurity must evolve. As the cloud and AI have expanded our digital landscape, so have the threats. By adopting robust security frameworks like the NIST CSF, implementing Zero Trust principles, and leveraging AI for threat detection, we can build a layered defense.
