Challenging the myths and embracing change for secure sustainability transformation

What are your key take aways from the recent Gartner Security & Risk Management Summit?

The Gartner Security & Risk Management Summit, a 2-day event hosted in London end of September 2023, is an annual event that helps leaders in the field of security and risk management gain know-how on upcoming trends and threats in the field. Gartner reinforced the tangible value that cyber security can, and should, generate for the enterprise while simultaneously challenging cyber security professionals to rethink outdated security principles and practices to enable transformation.

Gartner proposed a paradigm shift for cyber security professionals to rethink many of the current principles used for securing the enterprise and challenge us to reconsider the approach to cyber security across business engagement, technology, and talent. By having a ‘minimum effective mindset’, which is a ROI-driven approach, we can deliver maximum effect and debunk four myths, namely:

The perpetual pursuit of maximum effort in cyber security operations takes its toll on CISOs, security leaders, and their teams. The reality for most organizations is that they simply cannot focus on perfecting all aspects — more data, more people, more controls, and more technology — given limited resources and budgetary constraints. The analogy here is if we consider four attributes of a car — chassis, suspension, brakes, and engine — then there has to be a balance of the investments and development, or we could end up with a very fast, great handling car that you cannot stop due to no investment in the brakes.

Swanson: “With a minimum effective mindset, the focus is shifted away from trying to be absolutely perfect at everything, but making sure your security meets the requirements of the organization, thus unlocking tangible, valuable outputs.”

Another take away from the summit was about what was important for CIOs and CEOs from a cyber security perspective and the implications for security and risk leaders. The view was that company boards are willing to increase risks but want tangible dividends from their digital investments. In other words, this means that they need their CISOs and their teams to ensure they are working on the key initiatives that offer the greatest business impact. This explains the shift to more human-centric design practices in cyber security programs. What is then needed is not necessarily security for security’s sake, but rather security that is best aligned to what the business is trying to do and visibly so.

What did you learn about Zero Trust?

Zero Trust, which is one of the most often used terms in the cyber security industry, is a strategic approach to cyber security built with continuous authentication with access control based on the principle that there shall not be trust by default. It’s based on trust and constant verification, and it's a powerful principle; however, from a Gartner viewpoint, the execution is far from straightforward due to the complexity of organizations, the tactical demands taking priority over strategic initiatives and not having a lifecycle approach.

Convergence and consolidation will help simplify some aspects of increasing maturity; however, organizations need to recognize that Zero Trust is a strategic initiative and not a technology led approach; hence, this initiative needs to be underpinned with plans and measures to be seen to be increasing maturity and delivering benefits.

John Watts, Gartner: “By 2026, 10% of large enterprises will have a mature and measurable Zero Trust program in place, up from less than 1% today.”

Conclusion

The Gartner Security & Risk Management Summit offered invaluable insights into the evolving cyber security landscape, urging professionals to challenge conventional wisdom and embrace change to safeguard enterprises effectively in the digital era. This not only reinforced our understanding of emergent risks and threats, but it has also allowed us to consider key strategic points such as the minimum effective mindset. It also helped us understand organizational and Board-related needs and drivers. Our participation in these sorts of events helps Fujitsu retain our market-leading position by inspiring confidence and trust in the services we provide for our customers, so that they may grow their business, but in a secure and sustainable way.

To learn more about our cyber security offerings, check out our webpage here.