How do you secure new technologies and innovations?

Before you implement something new, think like an attacker. What's exposed? How is it protected, if at all? How is it accessed, managed, and updated? How would you attack it? Discovering the attack surface is the first step. Removing or protecting the opportunities is the second. This is a group effort--ten heads are better than one.

Risk assessment is one of the most important actions that an organization have to do to define what are challenges the company is encountering in terms of cybersecurity and lead the company to make decision about what measures have to be taken to mitigate or reduce discovered risks. This is the first step to build a security architecture that fits company's needs.

Running into new technologies and innovations is quite rare. Most products are stacks of existing tech for which we have decent security best practices. If the technology is really 'new', there is no point in trying to write this article where we claim we know how to assess it. For any new technology you'd at least want a security professional to analyze it, if not the security community.

Exploring new technologies, especially AI, is thrilling. For our company, AI promised efficiency and enriched user experiences. Initial trials even hinted at revolutionary changes. However, a deeper dive revealed challenges. We noted issues in AI decision-making. Ethical concerns, from data privacy to biases, surfaced. Legal issues, particularly regarding user data protection and transparency, became apparent. Despite challenges, our CEO and management team remain optimistic about AI. But it's vital to meld innovation with ethics and legal considerations. As we integrate technology, respecting all stakeholders is key as well as ethics and legality. Adopting new tech requires keen awareness of its broader implications.

The key point to start is to catalog considered assets - objects, processes, functions, data flows, regulations, or even reputation. If the asset portfolio is known, then we can start thinking about the threat scenarios according to the utilized methodology. The risk is always connected to the asset and shall be prioritized according to the asset's importance.

Assessing the risk needs to be integrated on all IT projects. however, one of the factor that is challenging security by design is accountability, so identifying all valued assets and classify (quantifiable) together with a proper owner, in this way it will be easier to prioritize business impact.

Doing a proper threat Modelling of the system. And implementation of a SSDLC. Shift lefting the security can drastically reduce security issues.

From my point of view, the following things are important in relation to your question. Securing new technologies and innovations involves risk assessment, education, access control, regular updates, incident planning, compliance, testing, user awareness, vendor assessment, and robust data backup and recovery.

The most important thing with any new technology/innovation is, you have to be on top of your data security and identity & access mgmt. Determine what data is allowed to leave company managed systems and who should be able to use/see the data.

* Implementing best practice for each technology is the basic step, we must create a chick list based on the security guide or manual form technology vendor. * define a strong policy for access physically and logically. as password policy, lockout policy. * apply multifactor authentication. * conduct awareness sessions.

Throughout my journey in tech, after thorough risk assessments, I've recognized the importance of implementing precise controls to shield both technology and its users. Our defense strategy ranges from technical measures like encryption and authentication to administrative protocols such as policies and training. Not to forget the oft-underestimated physical safeguards. But one constant lesson stands out: security must evolve. With rapidly advancing technologies, threats morph in tandem. Thus, our protective approaches require consistent reviews and updates. In today's digital age, proactive monitoring and adaptation are not just beneficial, they are imperative.

Implemented controls shall be related to the security goals as well as the system's capabilities and power. Also, controls shall be designed carefully, taking into consideration what is available on the market.

Throughout my tech endeavors, I've understood the invaluable role of rigorous testing at every technology deployment stage. Before, during, and post-deployment, comprehensive tests like penetration checks, vulnerability scans, code reviews, and stress evaluations become paramount. Even user acceptance testing offers insights often missed by developers. But it doesn’t end there. Establishing a robust feedback loop is equally crucial. By actively gathering and analyzing testing outcomes, as well as direct user feedback, we're better positioned to preempt issues and refine the technology. Continuous testing and iterative feedback ensure we're always a step ahead, enhancing security and performance.

A key point is "before, during, and after deployment." With regard to security, this can mean having information security gate reviews as part of your standard process for technology projects. After deployment is when we can expect the most lively period to be, from an information security standpoint. If there hasn't been much effort toward thinking like an attacker and looking for the ways the system can be exploited, then it will happen with real consequences when real attackers are the ones to find the issues.

Security considerations of the product have to also be in multiple layers. Any external software or third-party library that the new technology is dependent on should be incorporated into the testing, documentation and visibility of the product. Often times, these can go missed by SAST tools and can give an easy point-of-entry to malicious actors if not patched or remediated appropriately.

Be mindful of any third parties you may integrate with. There are a lot of fantastic SaaS tools out there that make development easier, however, do those third parties have external audits and have attestations of compliance? How's their pen test report look? What kind of RBAC controls do they offer? Are they storing your data? Make sure you are not enlarging your attack surface and document everything so that you have an idea of how it integrates and show auditors that you have reviewed, vetted and documented the business relationship.

Navigating the tech landscape, I've found that beyond just functionality, ensuring alignment with key standards, frameworks, and best practices is crucial. It's about making sure our technology not only stands up to industry and organizational expectations but also satisfies our customers and regulatory bodies. But just meeting these standards isn't enough. Documentation and transparent reporting of our compliance status becomes imperative. It offers proof of our diligence and commitment. Whenever discrepancies emerge, addressing them swiftly and effectively is not just about adhering to protocols, but building trust and ensuring our technology's longevity.

New technology compliance should also consider new security controls coming - like PQC or other modern security controls with ongoing regulations and standards.

Every organization has (or should have) a risk appetite. This is the expression in qualitative and quantitative terms, of the amount of risk it is willing to accommodate in pursuit of its objectives. Therefore, upon completion of any risk assessment exercise, whilst all risks should be reported and monitored, only risks above the Organization's defined risk appetite should be treated. This ensures that scarce resources are deployed effectively and efficiently.

In the realm of tech, past incidents provide invaluable lessons. Every security breach or incident isn't just a challenge but an opportunity to refine and bolster our systems. Swiftly addressing these concerns is only the first step. Diving deep to understand root causes and gauging the repercussions becomes essential. What truly differentiates a resilient system, however, is how we pivot from these incidents. Applying corrective actions and lessons learned is vital. Moreover, sharing these insights with relevant stakeholders not only builds trust but fosters a culture of collective growth and enhanced security.

Setting up a research and development team to identify the attack vectors that could be used against these technologies, you can’t protect what you don’t know. It will be day to day operations between the research team and threat detection team to enhance their capabilities in protecting the new technologies.

Cybersecurity practitioners must be innovators, early adopters, and early majority. Standard normal distribution indicates this is statistically improbable. Push the boundaries of probability and commit to being better than average so that you can continue to learn, grow, and adapt.

Cybersecurity is important for new technologies and innovation. Companies or organizations can implement some best practices: Cybersecurity best practices Access control Security risk assessment Security testing-penetration test, red team exercise Vulnerability scanning and management Secure software development life cycle Network Segmentation User training and Awareness Software Supply chain security Compliance and regulations

All new (or known) technologies/innovations have zero-day or exploited threats, and this creates the need of regular updates maintained by the vendor/organization. It's really important to follow up the vendor's/organization patching plan of the product to make sure that you will always be up-to-date. If this is the creation of a new product, it's really important to use a community like HackerOne (or having an internal Red Team/Blue Team) to understand the flaws of your technology, so you can create a regular updating cycle for your product/technology/innovation.

End of life technology. this is a very challenging process that is very important in every IT initiatives and needs every support from the IT leaderships.

I may be bias here but don't underestimate the power of threat modeling. Understand the components that make up the technology from networking, where it's hosted, APIs, business logic, associated web pages or installed application front end, and more. Working closely with development teams you can work through endless scenarios, improving the design and configuration of the technology. Pairing this with a pentest prior to deployment and you would be hard pressed to find vulnerabilities outside of zero days.