When technology advances can security keep up?

 The technological advances across all areas of business and our private lives continue at pace and show no sign of stopping.

 There is no doubt that many of the technologies have provided greater opportunities for businesses, both within the organisation, and with partners and stakeholders, through better data access, shared platforms for collaboration, more powerful computations and, of course, use of AI within decision making and experimental activities.

The challenge for security professionals remains the same – keeping pace with both organisational use of technology and understanding the art of possible with new security technologies. Security, much like safety, often acts in catch-up mode. It’s challenging for the chief security officer to make a case for increased security budgets for what “might be coming over the horizon” in terms of new threat vectors and what this might mean for organisational risks; after all, “it” might never happen.

There are two ways we can tackle this. Firstly, by security professionals being part of the technology discussions from the beginning. Not so that we can be there with a “security says no” approach, but so that we understand what new risks the technology might pose, and consider ways to build it securely without stifling innovation and the art of possible.

The second is to not abandon basic essential security principles:

• knowing your threat landscape and whether the use of new technology and collaboration changes your business risks
• air-gapping systems and making use of the “need to know” principles (whether that is people, processes, or data)

• layering defences, so that your technological crown jewels can remain resilient and operational, and finally
• instilling in your people good security behaviours so they do not become the weakest link.

The final point above is key, and something that can often be lost in the technological race. All technology, particularly security related tech, is there to aid human decision making. A good example of this is search and screening systems, which have advanced significantly over the last 20 years, increasing throughput and detecting a range of different potential threat objects. However, if the power was to go off, rendering the equipment useless, we can still rely on the human to carry out the same searches. Yes, of course it would take delays and would not be sustainable in the long term, but we could still have confidence that our staff were able to perform the same activities and reduce the risk from certain threats. Key to this is training our security staff on the basics as well as the new skills required to interpret and use technological prompts.

We also have to factor in the limit of human ability. Good technological advances in security equipment need to understand where the current challenges are and where technology can significantly improve decision making. There is an inherent danger when we stop seeing technology as an aid.

As a sector, we should be embracing this technological era, and be fully integrated in the design and use of technology within the businesses that we protect and as part of our own toolkit. This gives rise to the final challenge – that of convergence. The use of technology as a defence means that the traditional silos of technical, physical, personnel, and cyber have to work smarter together, bringing the deep expertise from each specialism to deliver good organisational risk management.

Sarah Austerberry, Au Security Consulting: sarah@ausecurityconsulting.com

Julie Nel, B4 Secure: info@b4secure.co.uk

Hayley Elvins, Sloane Risk Group: enquiries@sloaneriskgroup.com