UAE tech growth prompts firms to review internal IT security

Build security awareness and control access

Complexity is one of IT’s biggest security challenges. “The more complex the system, the greater the attack surface. It is much easier now to hide multi-pronged attacks in different layers and parts of the IT infrastructure,” said Manson.

“Virtual machines, BYOD, cloud environments, hyper-connectivity, automation and professional cyber criminals have created an onslaught of [internal] vulnerabilities that yesterday’s cyber security [methods] cannot address.”

“You can lock every window and bolt every door to keep out intruders, but it won’t be of much use if the attacker is already inside”

Company employees usually have the greatest access to company data, and this is “often overlooked” said Manson.

“Sensitive information is only as secure as the least secure human who has access to it. This is why it is important to build a culture in the workplace around security awareness and to think twice before distributing information,” he added.

“Attackers are targeting the human element of digital IT through Phishing and other forms of social engineering. Simple steps and tasks can contribute to building a human firewall. Things such as training employees to identify phishing attacks could very likely save an employee from being a phishing victim. Another important step is to evaluate who has access to what data.”

Kamel Heus, regional manager, Middle East and Africa, at identity security firm Centrify, agreed that cyber threats “come in all shapes and sizes, and from all vectors”.

Heus recommended limiting staff IT access to only the core functions needed. “The fundamental issue is that too many people have too much access to too many things from too many places,” he said.

“It is very important that people have access only to what they need for their job, following least privilege principles. This includes access to applications – either on-premise or in the cloud – and appropriate access to systems and network devices for administrative users.”

Manage the mobile menace

As the number of mobile devices proliferates in the UAE, Frost and Sullivan’s Ramachandran recommends that firms run employee change management and awareness initiatives to communicate the risks and how important it is to be mindful.

According to the latest Cisco visual networking index global mobile data traffic forecast, the Middle East and Africa region will see an increase in mobile devices and connections, from 1.3 billion in 2016 to 1.8 billion in 2021 at a compound annual growth rate of 6.4%.

“The proliferation of mobile devices creates more endpoints to protect. The cloud is expanding the security perimeter. And users are, and always will be, a weak link in the security chain,” said Cisco’s Manson.

“The fundamental issue is that too many people have too much access to too many things from too many places”

Aaron Han, chief of pathology at American Hospital, who advises on the hospital’s IT policy, agrees that mobile devices pose a high risk.

“The proliferation of remote monitoring devices [in healthcare] is an area of great promise, but also increases risk as the health IT ecosystem grows exponentially,” he warned.

“With the growth of telemedicine, there will be ongoing challenges for patient privacy and ensuring appropriate control of access of patient information to healthcare workers who need to know. IT is highly integrated into many of our devices in hospitals, but mitigating risks is an ongoing challenge.”

ZK Research estimates that 80% of breaches originate inside the network, not through the perimeter. According to Manson, another way to protect the network from intruders is through network segmentation. “In fact, several of the most high-profile data breaches in recent years could have been prevented this way,” he said.

It’s critical that UAE organisations create a culture of cyber security awareness, according to Manson. 

“Protecting proprietary and sensitive internal and customer data isn’t the sole responsibility of the IT department – nor should it be. While deploying the latest network defence tools is important, a successful cyber strategy should include developing a culture of cyber security within the workplace,” he said.