It’s been a tough 12 months. With global GDP down by 4.5%, it’s no surprise that most businesses are suffering. But amidst the gloom there are some reasons to be positive: cybersecurity teams around the world helped their organisations keep the lights on—all while balancing these new inherent risks against the challenges of remote working. IT teams deserve a round of applause.

Yes, it was a bad year for business, but perhaps it was also a year that showed us exactly how vital cybersecurity can be, especially when it came to partnering with IT to enable the business to operate securely under intensely challenging circumstances.

The changing perceptions of cybersecurity
One fundamental change I’ve witnessed during the pandemic is the shift in attitude towards the corporate cybersecurity function. Cybersecurity isn’t traditionally seen as a business enabler, but during the pandemic it transformed to become a leading enabler; letting business continue remotely and securely.

One global products company had to scale from 20,000 VPN connections to 100,000 in a matter of weeks. Their cloud platform – Microsoft Azure – gave them the power to do what they needed, fast.

Organisations who’d already adopted Microsoft’s security controls – such as Defender for Endpoint, Azure AD Conditional Access and Microsoft Endpoint Manager – were instantly protected. These organisations weren’t just more secure against the risks of remote working, they were better protected against many of the new advanced threats that appeared as a result of the pandemic.

But the pandemic has changed the security landscape

• Email scams increased 667% in March 2020
• RDP Brute Force attacks grew 400% between March and April 2020
• Users are three times more likely to click on pandemic-related phishing scams
• 90% of COVID-19 webpages are linked to scams
• 25% of all incidents are COVID-related

So where do we go from here? Most businesses, having gone through the initial COVID ‘response’ phase, are now in the ‘reset’ phase, in other words they’re reassessing and re-thinking their security posture and risk profile.

Welcome to the ‘renew’ phase
But now the time for COVID firefighting is over. We need to get ahead of the curve and start looking long term to build for a more secure future. There are 6 principles you need to stick to in order get this right. We’ve built these 6 principles on what security chiefs are talking about in the industry today:

1. Manage skills and people
   You need to find ways to deal with the global security skills shortage. Automation is your key ally here, helping you redirect your skilled human security experts to more important matters.

With artificial intelligence (AI) and machine learning (ML) now a common tool, you can automate repetitive security tasks and let your people focus on more important jobs. Strong tooling can aid in training and enabling non-security teams to integrate security into their workflows.
There are tools now available that you can plug in to a software development pipeline that can coach and guide the developer to address security vulnerabilities at the source.
Tools like Azure Sentinel makes security smarter and faster. In a recent study by Forrester, using AI it was shown to reduce the number of false positives by up to 79% and the effort and labour associated with advanced investigations by up to 80%, leading to $2.2million in efficiency gains. This significantly eases the burden that is placed on SOC teams, enabling them to focus on other priority work.

2. Foster positive partnerships
   With security skills in short supply and threats increasing, strategic partnerships will become more important. CISO’s will need to be well-versed in orchestrating strategic partnerships with third parties to bring in the required skills and help with any baselining or re-baselining.

Be sure to partner with other functions, such as risk, audit and legal and compliance before a breach occurs, and consider partners that can cover the full breadth of services you require, having a single proven vendor, like Avanade, can save money and time while improving efficiency and delivering your vision.

3. Make the case for your budget
   As we start to see an end to lockdowns and a return to some kind of normality, we’ll move from the ‘reset’ phase to the ‘renew’ phase. Downward pressure on budgets is already being applied as businesses get to grips with the longer-term impacts of the pandemic.

But there’s likely to be financial pressures across the globe for some time – so get be prepared to identify cost savings without increasing the risk exposure. Fortunately, Microsoft’s security solutions can really help you out: it’s a single integrated platform that makes the most of your existing Microsoft 365 investment and can replace numerous costly desperate vendors and the costs that go with managing individual vendor relations. When making the case for more security expenditure, make sure you highlight powerful stats like The Ponemon Institute’s average cost of a data breach, which currently stands at $3.86m. That’s a lot of money for any company to lose.

4. Stay ahead of innovation
   COVID has accelerated digital transformation more than anything else since the internet went mainstream in the 1990s, but it also spotlighted the obstacles caused by ongoing legacy systems and legacy culture.

These issues can be addressed, but you simply must keep your finger on the pulse of innovation to help overcome them. It’s also worth considering the effect of shadow IT – a growing issue during the pandemic as businesses did what was needed to get things done. Now might be a good time to perform a shadow IT assessment. Alternatively, a Microsoft 365 assessment identifies gaps in your Microsoft 365 environment, helping you improve your security posture in the era of hybrid working.

5. Begin the journey to Zero Trust
   Although they’re important, VPNs aren’t the be-all-and-end-all of remote working cybersecurity. Increased automaton and the move to Zero-Trust will enable organisations to control all access much more effectively, consequently decreasing the likelihood of VPN-based attacks and insider threats. Are you ready for Zero Trust? Our Zero Trust Assessment is a great way to find out.


6. Get buy in
   Be sure to carefully manage how you relate to key internal stakeholders and the rest of the business, from internal users to where the money comes from, and if things go wrong.

COVID has given security leaders unprecedented leverage in pushing transformation initiatives with the C-suite, so seize the moment and get leaders on board.

Find out how you can renew your security posture for 2021.