Como garantir novas tecnologias e inovações?

Before you implement something new, think like an attacker. What's exposed? How is it protected, if at all? How is it accessed, managed, and updated? How would you attack it? Discovering the attack surface is the first step. Removing or protecting the opportunities is the second. This is a group effort--ten heads are better than one.

Risk assessment is one of the most important actions that an organization have to do to define what are challenges the company is encountering in terms of cybersecurity and lead the company to make decision about what measures have to be taken to mitigate or reduce discovered risks. This is the first step to build a security architecture that fits company's needs.

Running into new technologies and innovations is quite rare. Most products are stacks of existing tech for which we have decent security best practices. If the technology is really 'new', there is no point in trying to write this article where we claim we know how to assess it. For any new technology you'd at least want a security professional to analyze it, if not the security community.

Exploring new technologies, especially AI, is thrilling. For our company, AI promised efficiency and enriched user experiences. Initial trials even hinted at revolutionary changes. However, a deeper dive revealed challenges. We noted issues in AI decision-making. Ethical concerns, from data privacy to biases, surfaced. Legal issues, particularly regarding user data protection and transparency, became apparent. Despite challenges, our CEO and management team remain optimistic about AI. But it's vital to meld innovation with ethics and legal considerations. As we integrate technology, respecting all stakeholders is key as well as ethics and legality. Adopting new tech requires keen awareness of its broader implications.

The key point to start is to catalog considered assets - objects, processes, functions, data flows, regulations, or even reputation. If the asset portfolio is known, then we can start thinking about the threat scenarios according to the utilized methodology. The risk is always connected to the asset and shall be prioritized according to the asset's importance.

* Implementing best practice for each technology is the basic step, we must create a chick list based on the security guide or manual form technology vendor. * define a strong policy for access physically and logically. as password policy, lockout policy. * apply multifactor authentication. * conduct awareness sessions.

Thanks to the clear comprehension of how a new technology works, and how it impacts a well established process, all the emerging risks can be identified. Risks may appear already covered by existing controls or it may be required for new controls to be applied, one more reason to observe the new technology, "in perspective", in other words, applied to the process it supports. Building bridges between business needs and innovation is a great enabler that helps the company create an innovation friendly climate, and by reducing failures in the adoption phase, promote its sustainability over time. This end to end analysis helps implementing appropriate controls, or alternative controls where new challenges emerge.

Throughout my journey in tech, after thorough risk assessments, I've recognized the importance of implementing precise controls to shield both technology and its users. Our defense strategy ranges from technical measures like encryption and authentication to administrative protocols such as policies and training. Not to forget the oft-underestimated physical safeguards. But one constant lesson stands out: security must evolve. With rapidly advancing technologies, threats morph in tandem. Thus, our protective approaches require consistent reviews and updates. In today's digital age, proactive monitoring and adaptation are not just beneficial, they are imperative.

Implemented controls shall be related to the security goals as well as the system's capabilities and power. Also, controls shall be designed carefully, taking into consideration what is available on the market.

Following the risk assessment, implementing tailored controls is vital to safeguard the technology and its users. These controls encompass a spectrum of technical, administrative, and physical measures such as encryption, authentication protocols, authorization frameworks, robust auditing mechanisms, comprehensive backup strategies, and well-defined policies and procedures. Equally important is continual monitoring and regular updates to these controls, ensuring they remain aligned with evolving technological landscapes and emerging threats. Routine updates and maintenance ensure that the implemented controls remain effective in mitigating risks posed by new technologies and innovations.

Throughout my tech endeavors, I've understood the invaluable role of rigorous testing at every technology deployment stage. Before, during, and post-deployment, comprehensive tests like penetration checks, vulnerability scans, code reviews, and stress evaluations become paramount. Even user acceptance testing offers insights often missed by developers. But it doesn’t end there. Establishing a robust feedback loop is equally crucial. By actively gathering and analyzing testing outcomes, as well as direct user feedback, we're better positioned to preempt issues and refine the technology. Continuous testing and iterative feedback ensure we're always a step ahead, enhancing security and performance.

A key point is "before, during, and after deployment." With regard to security, this can mean having information security gate reviews as part of your standard process for technology projects. After deployment is when we can expect the most lively period to be, from an information security standpoint. If there hasn't been much effort toward thinking like an attacker and looking for the ways the system can be exploited, then it will happen with real consequences when real attackers are the ones to find the issues.

Testing is a key passage of any release and becomes a vital toll gate for new technology, being it software or hardware based. We can appreciate how national cyber security frameworks require nowadays to acquire tested products, or to enable or request additional security testing, this is valid for software, encryption algorithms, and appliances. Expecting, executing or having executed thorough testing is of capital importance when adopting new solutions. In my personal experience, it may happen that custom identity, session or secrets handling, are non-functional or non-secure, simply for the complexity or risk of overlooking, that a non therein specialized software provider, could unknowingly add to its product. Plural testing helps.

Security considerations of the product have to also be in multiple layers. Any external software or third-party library that the new technology is dependent on should be incorporated into the testing, documentation and visibility of the product. Often times, these can go missed by SAST tools and can give an easy point-of-entry to malicious actors if not patched or remediated appropriately.

Testing the security of new technologies is pivotal across all deployment stages. It involves a spectrum of evaluations—penetration testing, vulnerability scanning, code reviews, stress tests, and user acceptance testing—to unearth potential security flaws or weaknesses. This comprehensive approach aims to identify and rectify any vulnerabilities before, during, and after deployment. Establishing a robust feedback mechanism to analyze testing results and user feedback is equally critical. This iterative process ensures that any identified issues are addressed promptly, bolstering the technology's security and fortifying it against potential threats or vulnerabilities.

Be mindful of any third parties you may integrate with. There are a lot of fantastic SaaS tools out there that make development easier, however, do those third parties have external audits and have attestations of compliance? How's their pen test report look? What kind of RBAC controls do they offer? Are they storing your data? Make sure you are not enlarging your attack surface and document everything so that you have an idea of how it integrates and show auditors that you have reviewed, vetted and documented the business relationship.

Navigating the tech landscape, I've found that beyond just functionality, ensuring alignment with key standards, frameworks, and best practices is crucial. It's about making sure our technology not only stands up to industry and organizational expectations but also satisfies our customers and regulatory bodies. But just meeting these standards isn't enough. Documentation and transparent reporting of our compliance status becomes imperative. It offers proof of our diligence and commitment. Whenever discrepancies emerge, addressing them swiftly and effectively is not just about adhering to protocols, but building trust and ensuring our technology's longevity.

New technology compliance should also consider new security controls coming - like PQC or other modern security controls with ongoing regulations and standards.

Reviewing compliance ensures that new technologies align with industry, organizational, customer, and regulatory standards. This involves verifying that the technology meets specified requirements and expectations. Documentation and reporting of the technology's compliance status, including evidence and addressing any gaps, are crucial. It ensures adherence to best practices and frameworks, fostering trust among stakeholders while mitigating potential risks associated with non-compliance. Regular reviews and updates maintain alignment with evolving standards, ensuring ongoing adherence and reliability.

Every organization has (or should have) a risk appetite. This is the expression in qualitative and quantitative terms, of the amount of risk it is willing to accommodate in pursuit of its objectives. Therefore, upon completion of any risk assessment exercise, whilst all risks should be reported and monitored, only risks above the Organization's defined risk appetite should be treated. This ensures that scarce resources are deployed effectively and efficiently.

In the realm of tech, past incidents provide invaluable lessons. Every security breach or incident isn't just a challenge but an opportunity to refine and bolster our systems. Swiftly addressing these concerns is only the first step. Diving deep to understand root causes and gauging the repercussions becomes essential. What truly differentiates a resilient system, however, is how we pivot from these incidents. Applying corrective actions and lessons learned is vital. Moreover, sharing these insights with relevant stakeholders not only builds trust but fosters a culture of collective growth and enhanced security.

Setting up a research and development team to identify the attack vectors that could be used against these technologies, you can’t protect what you don’t know. It will be day to day operations between the research team and threat detection team to enhance their capabilities in protecting the new technologies.

Adopting new technology demands a phased approach, reason for which, is the heightened attention to be paid, when modeling its behaviour and associated emerging threats. It may be that the technology is from a security aware provider, one that has a high ranking in a cyber supply chain, and it will support threat models along with the solution, or it may be otherwise, then requiring appropriate interviews from our security team, to become aware of the most important function points and their specific threats. Phased approach also stands for having a pre-production phase, or "observation" phase, from the point of view of your security teams, enabling potential incidents to happen before the production phase.

Learning from incidents is crucial in securing new technologies. Responding to security incidents or breaches involves prompt resolution and comprehensive analysis of root causes and impacts. Implementing corrective actions and lessons learned from incidents fortifies the technology against similar future threats. Sharing these insights with relevant stakeholders fosters a proactive security culture, enhancing preparedness and response strategies. This iterative learning process empowers continual improvement, strengthening the technology's resilience and mitigating potential risks.

Cybersecurity practitioners must be innovators, early adopters, and early majority. Standard normal distribution indicates this is statistically improbable. Push the boundaries of probability and commit to being better than average so that you can continue to learn, grow, and adapt.

Cybersecurity is important for new technologies and innovation. Companies or organizations can implement some best practices: Cybersecurity best practices Access control Security risk assessment Security testing-penetration test, red team exercise Vulnerability scanning and management Secure software development life cycle Network Segmentation User training and Awareness Software Supply chain security Compliance and regulations

Educate/Train the employees about the security vulnerabilities and create the awareness about the latest cyber attacks & breaches

All new (or known) technologies/innovations have zero-day or exploited threats, and this creates the need of regular updates maintained by the vendor/organization. It's really important to follow up the vendor's/organization patching plan of the product to make sure that you will always be up-to-date. If this is the creation of a new product, it's really important to use a community like HackerOne (or having an internal Red Team/Blue Team) to understand the flaws of your technology, so you can create a regular updating cycle for your product/technology/innovation.

End of life technology. this is a very challenging process that is very important in every IT initiatives and needs every support from the IT leaderships.

A collaborative approach is key to early adoption of new technologies, and it may represent the difference between a company thriving and one that survives. To thrive, innovation is key, not exclusive, but it enables you to assess and be "in the known" with respect to the latest advancements, allowing you to make informed choices about your own future, in relation with the environment within which you operate. Securing new technologies is also a trigger to make the company itself an innovating business, that learning to adopt new technologies, may embrace co-generation, "becoming" the Innovation it pursues. Making embracing new tech, a possible paradigm, a non-scary scenario, for your business, is a good habit, ensuring relevance over time.