Securing Our
Digital World

Making Our Digital World Safe in Response to New Threats

After a recent spate of ‘phishing’ messages, purporting to be from the World Health Organization, sought to trick people into sharing their personal data or downloading malicious software known as malware, the global health body was spurred to amplify its disclaimer that the WHO does not run lotteries.

It is not the only healthcare institution to have been targeted by online scammers in recent months. With Covid-19 raging worldwide, cybercriminals and state-sponsored attackers are launching ransomware attacks on hundreds of U.S. hospitals, including taking over IT systems and demanding ransom money in return for unlocking it.

“The challenge is figuring out how to do security at speed of business”

“The bad guys have been trying everything,” says Matthew Gyde, President and CEO of NTT’s Security Division. “We’ve seen new types of attacks, but also lots of old malware and past phishing scams being resurrected.”

Cyberattacks—which have escalated during the current pandemic—can be expensive, inconvenient and even life-threatening, but companies are fighting back. Cybersecurity spending is on the rise: the global market is expected to reach $270 billion by 2026, up from $173 billion today. The key growth areas are cloud technologies, better design processes, and advanced R&D. NTT, a global tech company and cybersecurity leader, plays a crucial role in making digital systems safer for its clients.

Security in the cloud

Mr. Gyde says once Covid-19 struck, many companies instinctively looked to buy security hardware to fraud-proof their networks as employees started working from home. But the pandemic also disrupted manufacturing and supply chains, adding weeks to delivery times. Moreover, many businesses lacked security specialists to manage that hardware. An industry-wide shortage has worsened as employees have to stay in lockdown or isolation.

These constraints accelerated a shift in the industry toward adopting cloud technologies—solutions and services provided remotely by a third party, rather than installed on company premises. Craig Hinkley, CEO of WhiteHat Security, which was acquired by NTT in 2019, says, “Covid-19 has really accelerated global digital transformation. Our clients now want security outcomes versus tools.”

Not every business has the technical maturity to mount a solid defense against cyber threats, says Mr. Hinkley, and the scale of the problem can be daunting. “You have to be one hundred percent right every day,” he says. “The threat actors only have to be right once.”

Thanks to masses of data from their many clients, as well as their own research, cloud-security vendors can identify emerging threats and often stop fraud before it happens. The key, says Mr. Gyde, is to put structure and context around that data and create actionable intelligence. Big Data analytics, machine learning and other techniques can sort genuine threats from false alarms to distinguish threats requiring urgent action from those that need monitoring.

Machine-on-machine attacks

Cyber defenses may be automated, but, increasingly, so are attacks. Cybercriminals use automated tools for everything from breaking into customer accounts by trying billions of passwords in quick succession to hijacking banking software, so it redirects users to fake sites. Mr. Gyde says: “Machine attacks can be carried out in the blink of an eye, which is why we use our data to train machines to defend against them.”

Companies can cut risk by bringing security into application and service design at the outset—a process dubbed ‘secure by design.’ For example, designing an app login system so it is harder to penetrate avoids potential loopholes that emerge when security is bolted on afterward.

The IT industry typically hasn’t worked that way—partly because security experts have a reputation for saying no to projects on security grounds. “Security has to become the ‘yes’ team, but to do that, we have to be involved at the beginning,” says Mr. Gyde.

The cybersecurity sector is constantly evolving. NTT is investing $3.5 billion a year into research and development for the next five years. That work includes cybersecurity-focused projects, such as next-generation encryption technology that will be strong enough to withstand attacks by tomorrow’s quantum computers.

Everyone is innovating

The company is also looking into the security possibilities of blockchain technology and the potential of its decentralized ledger model to underpin new ways to verify identity and establish trust. This could be a way to enable new applications that can be trusted without requiring manual confirmation for every transaction, for example, sharing and verifying documents for shipping cargo.

Criminals and state-sponsored attackers will continue to innovate, too. When the current pandemic subsides, the digital economy will be even more central and need better protection.

“Organizations have to align scarce security resources against the most important business risks,” says Mr. Hinkley. “The challenge is figuring out how to do security at the speed of business. We have lots of technology available, but a strong security approach begins with that conversation.”