Already known as a place where entrepreneurship thrives, Hong Kong is rapidly becoming Asia’s fintech startup capital. Indeed, according to http://www.fintech.hk/ there are 50 fintech startups covering financing, payments, operation & risk management, customer interface, data analytics, security & monetisation, investment & wealth management and other.
At RISE (www.riseconf.com) this year in Hong Kong, over 5,000 participants from around the world attended to hear from technology leaders about the latest trends and opportunities in fintech and other areas. There is an incredible energy in the Hong Kong fintech and the startup area in general.
An item that should be high on the agenda for a fintech or any startup is cybersecurity; especially if sensitive customer data is stored.
Today, there are so many corporate breaches in the headlines that hackers have morphed into the new super villains. “Revenge of the Nerds” is alive and well, and hacking is their super power.
But what can you do to protect yourselves and your customers from these new super villains? Perhaps there’s a new shiny product that can solve all your security problems, providing new protection for every new attack? This will then let you get on with more important things.
Unfortunately, there are no shortcuts to success in the territory of cybersecurity.
As surprising as it may sound, these villains’ new tactics are not as new as you might think; in fact, many of the so-called new attacks could have been prevented by correctly using existing security technologies as part of an end-to-end cybersecurity plan.
What is the plan? Literally, think like a hacker.
1. Change the way you approach protection, what would you steal?
Start by thinking about what you need to protect, not about protecting the road to it. In other words, build protection to match your data and your processes, not just the network architecture. Learn about your business’s unique patterns of people-data interaction; what and how it needs to be protected, who needs access to it and when, and what is the expected interaction they will have with the data. Only then can you start building your data-centric security.
2. Look for the gaps – what is the easiest way to get your data?
All networks are built to provide a service that is dependent on multiple systems both internally and externally. Hackers look for gaps, the path of least resistance. Why break down the front door, if you can easily get in through an open window? Your security solution must prevent as much as possible across multiple phases of the cyberattack lifecycle.
2.1 When you think about gaps, look at the borders of your systems and processes internally and externally, as gaps have more to do with interoperability and less with physical objects (Internet of Things). Work to close those gaps and think outside of the security box. Your inventory list should include computing, storage and network equipment.
2.2 The human factor: social engineering attacks are rising, with high success rates. Training and education is the key to defending on this front. Adding tools and scripts to catch users’ mistakes can help reduce the risk.
3. Uncover deception – what and whom do you trust?
Your answer should be nothing and no one. Look to uncover and inspect as many compression and encryption protocols as possible, making sure that the data entering your network is what you expect it to be, and from whom you expect it to arrive. You must detect new unknown attack components across all traffic.
4. Look holistically, what are your blind spots?
As you plan to add new products or processes, strive to reduce complexity and keep it simple: simple to manage, simple to monitor, simple to update, and simple to control. Any blind spot or unattended system can and will be used against you, especially in multi-step attacks. Keeping it simple is probably the most challenging aspect of this process. It is a daunting task.
As you look under the hood of many customers’ networks, most have been built over long periods of time with highly heterogeneous platforms, languages and tools. Remember that you have more than one environment to manage, as mobile devices and public/hybrid cloud infrastructure are two of the biggest attack vectors. Your solution should detect new, unknown attacks across all traffic.
5. Keep getting better – how can you be even more secure tomorrow?
New security protections can become outdated quickly, if they are not attended to and updated regularly. Threats are constantly changing, requiring continuous monitoring, tracking and assessments in order to keep your security up to date. Timing is everything. You must be able to turn detection data into prevention very quickly.
Sun Tzu and his “The Art of War” guidelines are more relevant than ever. In order to beat cybercriminals, you need to understand the battlefield, know the enemy and know yourself. Build a security ecosystem designed to fit your unique data mix and data consumption patterns, predict the enemies’ next move, counter it, and strive to be one step ahead of them.
Security breaches can very quickly turn into a nightmare for any established company or startup and can have brutal consequences on founders and the customers whose data they rely on and should be protecting.
Identify (the gaps), protect (through security) and operate your way to cybersecurity success by literally thinking like a hacker. Security is the responsibility of anyone involved within the startup and as the firm grows, should continue to be top of mind for all involved.
Marcos Ong, Country Manager, HK & Macau, Palo Alto Networks.
Palo Alto Networks (www.paloaltonetworks.com) is the next-generation security company leading a new era in cybersecurity by safely enabling all applications and preventing advanced threats from achieving their objectives for thousands of organisations around the world. The fastest growing security company in the market, Palo Alto Networks is focused on bringing an end to the age of breaches by uniquely integrating Next-Generation Firewall, Advanced Endpoint Protection, and Threat Intelligence Cloud.