Challenges In Securing Digital Assets, Future Of Cybersecurity And Much More

About Rich Owen

1. What do you think is the most significant challenge facing organizations in terms of securing their digital assets? What do you believe is the most effective way for organizations to stay ahead of potential security threats?

As stated in my book, “The Alchemy of Information Protection: A Cybersecurity Druid’s Spell Book,” I believe that People continue to pose the most significant challenge facing organizations! People created the hardware. People created the software. People use the systems appropriately and inappropriately. People are human, they make mistakes. People get hacked. Therefore poor systems are created that can be hacked by people. I know that this is not a popular or “Easy” answer, but everyone in the process must care. Developers can no longer produce “Time-to-Market” solutions with the intent of fixing problems in later revisions. Executives can no longer avoid thinking about information as a critical asset that must be protected. I was fortunate early in my career to create the computer (we called it Automated Information Systems at the time) security program for Mission Operations at Johnson Space Center. My boss was Gene Kranz (yes, the real “Mr. Failure is Not an Option!). He cared about Every aspect of the programs upon which the astronauts depended. I have many examples of how that made a difference in the systems we created and used. I have had other bosses that either thought of security as an expense and sought the “Easy Button” to compliance, or in some cases, I was just told if we had a breach, they would pay the fine and fire me. Of course, security must be a concern of the InfoSec personnel, but it is not (in most cases) their data. The data belongs to the department heads, like their budget or department personnel. Department heads need to understand how much data they are collecting, how it is validated, and how it is being processed, used, and stored. In many cases, InfoSec is the advocate or cheerleader who must hold the business accountable and provide guidance for continued improvement. The end user must also care and be held accountable for doing their part. This is not your Father’s Oldsmobile. The user must understand their risk for not taking steps they can protect their data.

2. What role do you believe emerging technologies will play in the future of cybersecurity?

Like all technology advancements, once discovered, it will continue to be used and abused. Examples include Fire, Electricity, Nuclear, and now AI. AI has the potential to be abused. Even if the coding is perfect, which is very suspect in these geo-political and social-political times, the results will be based on the data used by the AI. Without proper controls, which assumes that is even possible, systems may be created to compete or, worst yet, control our world without our knowledge or ability to change it. E.G., The loss of freedoms and life as we know it.

3. How do you think the rise of remote work will impact information security in the coming years?

It is here. The key to this success is for the end user to be aware of how to use that remote technology in a secure manner. This is an added element of risk that cannot be addressed with technology alone. In other words, zero trust and risk-based access by trusted and informed users.

4. How do you see the relationship between software development and cybersecurity evolving in the future?

I have seen a significant improvement in the previous “Love/Hate” relationship between Software and Security. I have heard “Don’t tell me how to do my job.” and had an HR Director that a senior software developer quit saying that “security controls” were the main reason for them quitting. Software is now being used to evaluate software to help the developer produce better code. Still, the most important action is the concern of the developer to produce reliable code in the first place. This is an important step as the increased use and abuse of data continues by other people in the process of acquiring, processing, and storing data.

Wrapping Up

From shedding light on the future of cybersecurity to remote work’s impact on information security, this Expert Q&A with Rich was a breath of fresh air. We hope you found these insights just as useful as we did.