Businesses are increasingly relying on third-party providers to run critical services, creating new cybersecurity and resilience risks that organisations can no longer afford to overlook, cybersecurity leaders said.
The definition of critical infrastructure has shifted significantly as companies move from proprietary, in-house systems to cloud services and other infrastructure provided by external vendors, experts said during a panel discussion at the third edition of FutureSec, hosted by Khaleej Times.
“Critical infrastructure, if I look back 10, 20 years ago, we owned, it was proprietary. Our infrastructure as an organisation, we would have kind of in-house run by our IT teams,” said Dee Deu, Group Director of Information Security at Chalhoub Group.
Stay up to date with the latest news. Follow KT on WhatsApp Channels.
“As I look at it now, it’s evolved. We have infrastructure as a service. We now look at the cloud and how we actually have moved to cloud in certain circumstances.”
Many organisations now have a mix of on-premise infrastructure they own and cloud or other services provided by third parties, creating greater reliance on external providers.
“If you look at the recent AWS incident and the number of organisations that were impacted by that, critical has to be applied under those lenses,” Deu said. “But now it’s moved away from proprietary owned into actual services and looking at what services are actually critical to us as organisations.”
Third- and fourth-party risks
The growing number of dependencies can make it difficult for organisations to understand the full extent of their technology estate, the panel heard.
“A lot of organisations do not have it right. In fact, I don’t think any organisation has it right,” said Patrick Pitchappa, CISO of Equiti Group, who highlighted the long-standing problem of shadow IT and the emerging challenge of shadow AI.
He pointed to the Cloudflare outage and the subsequent AWS incident as examples of how dependence on a single external provider can affect a much wider ecosystem.
“You build huge infrastructures, but then there’s this one third-party that you’re so reliant on,” he said.
“A lot of third- and fourth-party dependencies. That’s where I think we start. We miscalculate.”
Source: Khaleej Times