Few, if any, could have predicted 2020! This year has delivered COVID-19, the correlating rise in cybercrimes, nation-states engaging in a new trade war and organized crime groups flexing their muscles. However, with every crisis there is an opportunity. Now is the perfect time for companies providing cybersecurity to U.S. industry, such as Managed Security Service Providers (MSSPs), to recalibrate their services. Specifically, MSSPs have opportunities to capture new markets trending to the remote cyber workforce; reach this nation’s small and medium supply chain stakeholders; and leverage new, advanced technologies to remove the ‘human-in-the-loop’ and bring agility to scale.
The Market Dynamics The past seven months have changed almost every aspect of society as we know it with the COVID-19 outbreak leading to 88 percent of employers globally encouraging their workforce to work from home. The United States has seen a jump from 17 percent to 44 percent of the workforce working remotely five days or more per week. This shift represents a large opportunity for MSSPs to reposition their offerings. For example, medical providers moving hastily to telemedicine or education moving to distance learning have left the households and businesses of our nation vulnerable to data breaches. These shifts are requiring new partner entrants of all sizes. Meanwhile businesses are experiencing a flood of new ransomware, malware and other maladies. There is an open window for service providers to do market analysis and exploit niches where their particular strengths can hold a comparative advantage.
Both consumers and service providers need to rethink their strategies and how they can relate to one another better. Consumers and companies alike have been conditioned over the last seven months with vastly different models of engagement. Therefore, providers can approach new markets of consumers for their services, meeting consumers and businesses where they are today.
In recent years, managed service providers have seen their profit margins dwindle based on the increase of commoditization for similar offerings from competitors. Early services included virus protection and identity management in its first generation. These offerings had become stale and needed refreshing. As the remote workforce grows the blur between personal and professional applications increases leading to highly interrelated and broadened attack surfaces. The market trends now allow MSSPs to offer additional integrated and enhanced support capabilities. One of the greatest areas for MSSPs to capitalize on this is in the area of supply chain risk for medium and small companies.
Small and Medium Sized Businesses U.S. supply chains today have insufficient protection against advanced cyber threats. A survey conducted in late 2018 found that 56 percent of companies had a breach where one of their vendors (suppliers) was the source. The nation’s economic well-being is keenly dependent upon small and medium businesses feeding the supply chain. As key suppliers of goods and services, small companies also account as fountains for invention, innovation and projection of U.S. industry. National and foreign trade is greatly dependent upon vibrant small business input. In 2015, nearly 300,000 firms represented one-third of the nation’s total exports of $1.3 trillion.
It is clear that small and medium businesses are key to engaging a very large segment of our economy and are a business opportunity for MSSPs. Early in 2020, U.S. Census data stated that small businesses reached 31.7 million, or over 99 percent of all businesses. Firms with fewer than 20 employees make up 89 percent of that number. In 2020, small businesses represent over 60.6 million employees and 47.1 percent of the US workforce. These numbers demonstrate a base of activity with far reaching implications for the health of our economy.
Cybersecurity is an enterprise-wide problem that requires a holistic consideration of the business ecosystem. As reinforced daily in our press, the threat of nation-states combined with organized crime has created an even greater chance of intellectual property threats and sophisticated cyber shenanigans.
According to the US Trade Representative, in 2018 anywhere from $250 billion to $600 billion was lost to intellectual property theft in the United States. In 2019, according to a survey of North American chief financial officers, one in five corporations say that they experienced stolen IP with China within the past twelve months. Other estimates report well over $500 billion USD worth of trade secrets are stolen from the US alone, every year.
With the new ‘Cold War’ emerging with China, Russia, Iran and others, there is greater friction surrounding the economic and trade espionage reality. Cybersecurity providers will need to make their offerings more affordable to small and medium sized businesses in order to keep a secure supply chain.
Smaller businesses need new approaches allowing for affordable economic models for cybersecurity. These will include integrated relationships with supply chain partners. Often small supply partners are a point of exploitation that compromise larger enterprises.
Individually, small and medium sized companies are perfect entries—trojans into more lucrative, larger companies. A recent report states that among all cyberattacks small companies are targeted 43 percent of the time. In 2018, a Ponemon Institute survey of over one-thousand small and medium sized businesses in the U.S. and UK reported that 67 percent had a cyberattack that year, up from 61 percent the year prior.
Left on their own, small companies run the risk of a cyber breach leading to the closure of their business operations. It has been reported, on average, that 60 percent of small businesses close six months after being hacked. When embedded within the supply chain of larger companies, these small businesses can introduce systemic risk. The challenge may require coordinated industry and government leadership to engage in policy, standards and even funding to address this problem. Long-term, it is imperative to provide services to small and medium sized companies at an affordable rate to secure the health of industry and our nation’s critical infrastructure.
Technology and the Innovative Solutions Ahead The opportunity is for MSSPs to provide the next generation of high technology solutions. This generation will include fully vertical client security offerings bringing a proactive, predictive approach to protect organizational assets. It will be wrapped in economically viable, non-human dependent technology allowing increased security at more affordable cost. To accomplish this, MSSPs will need to rely on using machine learning and artificial intelligence (AI) to process a large volume of data assessing threats at rapid speed and affordable cost.
Reaching a desired level of support in the new age requires intense machine intelligence and robotic technologies to not only gather and analyze but to react with actions mitigating risk. The next generation of cybersecurity services will work exponentially and continuously delivering automated defense. This defense can be delivered through public, private or hybrid cloud solutions for client preferences.
The future includes AI patching, downloading active, learning agents that constantly watch your laptops, servers and networks. Systems will be able to “learn” as they watch transactions, recognize patterns, and discover anomalies in tireless ways. These principles will be based on advanced design such as biomimicry. Many malicious computer BoTs, or robots, are watching our every move, collecting data and information such as a firm’s employees, suppliers and numerous transactions.
MSSPs will now travel deeper into a company’s business transactions and enterprise data. They can be working just as hard while we sleep as when we are awake. The new age will leverage technologies such as block chain applications to safeguard and securely restore data—encrypt and protect assets. The recent uptick in ransomware extorted by adversaries has created a great amount of worry even among the large firms who typically pay ransom covertly. For the smaller enterprises, these threats have always been a major source of risk.
Integrated AI analysis will be able to identify threats from across a business’ horizon looking deeper into each firms’ relationships and transactions among their supply chain. Sensors and AI will gather data for judgements to improve the decisions of company executives whether to engage or not with potentially risky suppliers, transactions or ventures.
Conclusion MSSPs can lead U.S. industry to safety by reinventing the markets for cybersecurity. MSSPs have the opportunity to create affordable solutions of all sizes business organizations in the nation’s critical infrastructure supply chain. Together, customers and service providers need to embrace the implementation of advanced technologies by removing the human-in-the-loop to identify, analyze and respond quickly to threats. Companies will then improve their security and business economics by contracting with a new generation of innovative MSSPs. During this national crisis, MSSPs have the unique opportunity to provide a new layer of affordable safety to our nation. The market is ready for such solutions.
About the author: Gabriel Galván is an advisor to Phylax Analytics, Inc., an international security firm focusing on industrial and economic threats. He currently chairs the cybersecurity and privacy committee at NVTC. He spent over a decade at the MITRE Corporation and resides in the Washington, DC area.
Kommentare