In IT, network security is the act of maintaining the integrity of a computer network and the data within it. Network security is important because it keeps sensitive data safe from cyberattacks and ensures that the network is usable and can be trusted. Industry pundits share with Intelligent CIO Africa, several methods for enforcing security, evolving attack vectors and how to prevent breaches by limiting risk on the network.
Network security management may involve a wide variety of security tools, for both hardware and software. Network security becomes more important as networks become more complex and enterprises become more reliant on their networks and data to conduct business.
Methods for enforcing security should strive to evolve as networks and attack methods evolve, and aim to prevent breaches by limiting risk on the network.
James Hennah, Director, Security, BT, Asia Middle East and Africa, said as digital technologies evolve and companies across the continent more readily embrace cloud computing and the associated benefits, so too are threat actors becoming more advanced and persistent in their attacks.
“Take the prevalence of malware as an example. While the tools used to exploit weak points in the network might become more sophisticated, the fundamental premise still holds true – basic issues around phishing and poor patching remain the most popular methods of exploiting weak points when it comes to the integrity of business systems,” he said. “This is as much a human challenge as it is a technical one to solve. Constant vigilance remains key. The best network security in the world means little if employees are not informed about the latest cyberattack trends.”
Hennah said and with so many companies relying on the cloud for data analysis and collaboration, any weakness in network security can result in far-reaching compromises that impact the business bottom line as well as the reputation of the organisation.
Matthew Gaskell, Security Analyst, Synthesis, said as South African corporations seek to keep up with modern technologies, the demand for network security increases. “With the increase in demand, skills for implementing and maintaining network security remains behind the curve with skills and resources being sourced from outside Africa,” he said.
Edison Mazibuko, CTO at DRS, a cybersecurity specialist providing innovative agile solutions that deliver information security, IT risk management, fraud detection and digital forensics, said the economic fallout from the COVID-19 pandemic is well documented globally. Businesses around the world are pressured to do more with less which in turn will drive the consolidation of multiple security solutions.
Mazibuko said new technologies are encouraging a decentralised distributed architecture across multiple third-party service providers. The growing remote workforce expands the available attack surface for cybercriminals, as users connect through insecure networks.
He explained that a recent hack on a top cybersecurity firm resulted in the theft of critical security tools. “This brazen act will encourage more direct attacks on cybersecurity service providers and vendors in 2021. Attackers are aware every organisation has a weak link, even if it happens to be from a third-party. The rise of supply chain attacks will be more visible,” he said.
Threat vectors
Given the expanding threat vectors, CIOs and their IT teams are being urged to design robust network security frameworks.
According to Hennah, there is no universal cybersecurity strategy that works for every organisation. “Instead, each company must design a network security framework that suits its specific requirements and risk appetite, and reflects the overall digital readiness of the business,” he said. “An effective network strategy starts by carefully assessing the systems and processes already in place and identifying their weak points. Frequent audits become critical to ensure all these systems are running optimally.”
He explained that managed firewalls, malware protection and Business Continuity solutions form vital components of a network security strategy. “Part of this will also include on-going employee education especially when it comes to social engineering-based attacks,” he said. “If the organisation stays up-to-date with emerging cyberthreats, it can take the appropriate steps to future-proof its network security strategy. This could include frequent pressure testing of potential weak points, and the building and maintenance of a cybersecurity maturity matrix.”
Gaskell said communication and Internet technologies are becoming cheaper and more available to the African consumer. “This has been a major driving factor in the subsequent networking technologies in Africa. The underlying security and integrity of the underlying communication networks has become so important given the dangerous environment that is Africa,” he said.
BT’s Hennah said security must become the top consideration for any C-suite decision-maker. “The first thing is to get the basics right, making sure patching is up-to-date and the tools that you have already invested in are operating optimally. As networks become more complex thanks to the adoption of cloud and agile technologies, companies must rethink how they approach their proactive and reactive defensive measures and become less reliant on the outer perimeter but have a multilayer approach augmented by threat intelligence,” he said. “This will result in a more agile environment while delivering the flexibility needed to protect the data, assets and reputation of the business.”
Network security tools
With different types of network security tools on offer, CIOs are spoilt for choice.
Hennah said network security can encompass any number of tools, devices and solutions. “From access control all the way through to behavioural analytics, the environment is complex. Selecting the best tools depends as much on the type of business as much as it does on its level of cloud access, employee education, and solutions already in place,” he advised. “Managed security services offer an excellent option for organisations who want to benefit from a holistic view of vendors and the security ecosystem as a whole.”
According Gaskell, network security denotes the set of actions taken to protect the information transmitted on a network from various security threats. “These sets of measures aim to prevent unauthorised access and prevent any misuse of the network’s resources. IT teams need to design network security around network technologies and good architecture frameworks,” he said. “Security awareness and training should also be a featured factor when designing network security.”
Gaskell said a common mistake made by CIOs and CISOs is that network security can be implemented once. “For effective network security, this is not the case. Network security is an on-going concern that requires constant maintenance and monitoring. Good network security practices should be designed to reflect this,” he said. “Implementing modern stronger technologies and practices can go a long way to protecting against an ever-increasing amount and more complex threats. A common mistake made is that network security is a build and leave endeavour. Network security requires constant monitoring and protection. New technologies such as Machine Learning and modern practices such zero trust should be implemented to maintain a strong security posture.”
Pitfalls to avoid
With the complexities that come with different types of network security, what challenges and common mistakes should CIOs and CISOs avoid?
Hennah noted that being secure in the digital environment today requires a business to adopt an agile, proactive approach. “The days of simply installing a firewall and anti-virus to protect the network are long gone. CIOs must look beyond positioning cybersecurity as an afterthought. Instead, it is about having it integrated into the design of all business processes,” he said. “Securing the network does not happen after the fact. It requires a concerted effort to align all systems through the right understanding and intelligence to better anticipate trends and patterns. This will help the company better anticipate trends and patterns and implement the protection where it is most required.”
Given the growing and evolving attack vectors, organisations are being encouraged to improve their network security posture.
Gaskell said Africa presents a unique situation in that it is both a vulnerability and a threat. Given the lure of more lucrative regions such as Europe and America, Africa presents itself as a threat rather than a vulnerability. “With Nigeria the originator of the 419 scam, these have evolved into more advanced email phishing attacks and other African countries. However, Africa it is not completely safe. The rapid rate in which telco networks expand security skills have not been able to keep up,” he said.
DRS’ Mazibuko noted that from July 1, 2021, South African organisations will be compelled to comply with the Protection of Personal Information Act (POPIA). “Cybercriminals are aware of this and will position their ransom amounts below the fine amount an organisation would get for non-compliance. This will see an increase in the number of ransomware attacks as many organisations will not be compliant come July 1, 2020,” he remarked.
According to Mazibuko, there is no doubt the pandemic has influenced some trends such as the move to cloud services. “The pressure to rush Digital Transformation will also see many misconfigurations resulting in Big Data breaches,” he said.
He pointed out that with the increasing cybersecurity skills shortage, businesses need to automate and make the move from reactive to proactive security. “Technologies such as XDR – cross-layered detection and response technology – does a great job of breaking down silos, providing a holistic view of threats in an organisation and converting regular alerts into actionable incidents in real-time,” he said. “Taking this a step further, managed detection and response (MDR) services combined with XDR will see a big uptake. This will happen as more businesses come to realise this is one of the best ways to remain in the cybersecurity fight in 2021.”
Click below to share this article
