DFI Retail Group

What are the trends or challenges within the enterprise security space, and how are organizations overcoming these current challenges?

One of the critical challenges organizations faces is in their supply chains. COVID-19 showed that if organizations do not have sufficient control over the supply chain or if their supply chain is compromised, it will have a direct and significant impact on the business. Along with ramping up the security of the digital components of the supply chain, organizations are becoming mindful of third-party vendors and suppliers. They are ensuring that the vendors possess the relevant ISO certifications and meet the required SOC2 requirements.

At DFI, we interact closely with our supply chain, obtaining assurances from our vendors whenever possible. We are embarking on implementing the necessary ISO 27001 controls with the goal of achieving certification. Moreover, when handling credit card information and payments, we adhere to Payment Card Industry Data Security Standard (PCI DSS) requirements. These measures augment our trustworthiness while also enhancing our collaboration with third-party vendors.

Can you talk about any recent engagement or a project that you worked on where your expertise as an industry leader played a critical role in solving a problem and achieving the desired outcome?

One of any organization’s challenges is in the area of endpoint detection. We need to ensure exclusive network access for our teams while reducing external threats. We have and will continue to implement layers of defenses, ranging from endpoint detection and response (EDR) and extended detection and response (XDR) platforms, which combine event and endpoint detection to secure the perimeter of infrastructure or devices connected to the internal network. These platforms leverage machine learning and artificial intelligence to detect unusual patterns or behaviors. They can process and analyze information quickly and more efficiently than a person. We view these solutions as assisting us in absorbing all the data coming into our network, understanding what devices are on the web, and scanning for unusual behavior or unknown devices. It enables us to monitor the entire attack surface more accurately than before and helps us better secure our endpoints.

When you look at the developments that have been happening in the enterprise security space, what are some of the security concerns that you have?

From a security perspective, we are concerned across multiple domains, including malware, ransomware, social engineering, phishing and API security trends. Threat actors are continually attempting to extract valuable information, whether by masquerading as an employee or posing as the CEO when sending malicious and fraudulent instructions by e-mail. This type of account takeover especially happens at higher levels, which is a concern for organizations across industries.

“Employ developers that can code applications from the ground up with built-in protection.”

With the advent of the COVID-19 pandemic, people leveraging BYOD or working remotely are becoming targets for threat actors. In this scenario, it is challenging to put traditional controls on people’s devices as they are often outside the organization’s internal security infrastructure. This can have an adverse impact on the supply chain also, as most workflows have become digitalized and are controlled in the cloud. If the API between different systems, vendors, vendors, and customers is not secure, the supply chain becomes an easy entry point for attackers to compromise the environment.

What advice would you give to the other leaders in this industry or some new aspirants making their way into the enterprise security space to tackle data privacy challenges?

The company’s senior management must be supportive and involved in any company-wide changes you want to make. That will help in implementing systematic security strategies. I think any organization must have a strong collaboration across all functions and business units to create an overall data-safe bubble.

If anyone is planning on a career in cybersecurity information security, there is a great demand for security architects and DevSecOps—integration of security at every phase of the software development lifecycle. It is beneficial for organizations to employ developers that can code applications from the ground up with built-in protection. By building in-house solutions that fill every security gap in the organization, you will be better prepared to deal with the industry’s potential security threats.