Beyond Technology: Addressing Emerging Threats with Security by Design

In today's digital environment, technical security measures alone aren't enough. Emerging threats such as deep fakes and social engineering are targeting our processes and exploiting human vulnerabilities. A recent example underscores the urgency of this issue:

According to Hong Kong police, a finance employee at a multinational corporation was tricked into transferring $25 million to fraudsters who used deepfake technology to impersonate the company's CFO during a video conference. The sophisticated scheme involved the employee joining a video call and believing he was interacting with several colleagues, all of whom were actually deepfake creations, Hong Kong police said in a briefing.

This incident demonstrates that security must go beyond technology. It's clear: Security by Design must be applied to processes, not just systems.

Shared Responsibility

As CISOs, we are often seen as the primary responsible parties for security issues. However, this responsibility must be shared with process owners. Security by Design is not just the responsibility of IT. Every manager has a role to play. Building security into every business process is essential to protecting our organizations from sophisticated threats. This means designing secure workflows, continuously educating our teams, and implementing policies that strengthen our defenses.

The Challenge of Unsecure Technologies

As long as we rely on unsecure technology like email and video meetings, we have to implement non-technical measures to mitigate this risk. Email and video meetings are inherently insecure due to their susceptibility to phishing, spoofing, and man-in-the-middle attacks. These technologies were not designed with robust security in mind and cannot be easily fixed due to their widespread use and the complexity of integrating enhanced security measures without disrupting business operations.

Emerging AI technology is increasing the risk associated with these unsecure technologies and will continue to do so, making it even more crucial to adopt comprehensive security measures. Therefore, implementing non-technical measures such as clear verification protocols, regular training on identifying phishing attempts, and establishing strong policies for confirming identities through multiple channels is critical to mitigate the risks associated with these technologies.

Avoiding False Confidence

A quick technical fix often implemented is the use of email filtering software to block phishing emails. While this can reduce the volume of phishing attempts that reach employees, it can create a false sense of security. Employees might believe that all malicious emails are being caught, which can lead to complacency. In reality, sophisticated phishing attempts can still bypass filters, and without proper training and verification protocols, employees remain vulnerable.

Relying on such quick technical fixes for every problem caused by technology can lead to false confidence, as it creates the illusion of security without addressing the underlying vulnerabilities. This approach fails to consider the human factors and process weaknesses that sophisticated attackers exploit.

Practical Steps for Enhanced Security

A simple policy could have prevented this incident. For example, implementing a verification protocol for large transactions, such as requiring secondary confirmation through a different communication channel (like a phone call or a secure messaging app), could have exposed the fraud before the transfer occurred. This kind of policy ensures that critical actions are double-checked, adding an additional layer of security.

Elevating Security Responsibility

As risks evolve, so must our approach to managing them. Security is a responsibility that must be elevated to the general business level. Managers at all levels hold the key to embedding security into the fabric of our operations. By proactively addressing security in process design, we can minimize risks and build resilient, future-proof organizations.

Let's drive this change together. Security by Design must be a shared responsibility across all management levels, with clear accountability.

#SecurityByDesign #CyberSecurity #DeepFakes #SocialEngineering #ProcessSecurity #Leadership #DigitalTransformation