Posted on

Das Zusammenwirken von Technologien, Prozessen und Menschen verbessert die IT-Sicherheit

cyberark_IT_sicherheit

Autor: Michael Kleist*

Viele Unternehmen halten ihre Daten in Silos, und genauso fragmentiert betreiben sie auch ihre IT-Sicherheit: räumlich oder nach Applikationen getrennt. Vor allem die IT-Sicherheit braucht aber ein integriertes Konzept, das Technologien, Prozesse, Mitarbeiter und sogar die Schatten-IT berücksichtigt. signing out team. dont stay on too late chr

Zuverlässige IT-Sicherheit beginnt bei der Architektur. Erste Sicherheitsmaßnahmen umfassen etwa den Perimeter-Schutz mit Antiviren-Lösungen und Firewalls, aber auch Privileged Access Management sollte State-of-the-Art sein, um Angriffsvektoren abzuwehren. Entscheidend ist, dass solche Lösungen nicht isoliert betrieben, sondern miteinander verzahnt werden: Beim Privileged Access Management etwa sollte auch eine Integration mit SIEM (Security Information and Event Management)-Systemen und SOC (Security Operations Center)-Services vorhanden sein.

Diese Integration ist wichtig, denn eine einzelne, als Silo implementierte Lösung kann durchaus zusätzliche Sicherheitsgefahren mit sich bringen, wie das Schwachstellen-Scanning zeigt, das unter anderem auch Marktforscher Gartner empfiehlt. Das Problem dabei ist, dass Cyberkriminelle auf Systeme mit hochprivilegierten Accounts zugreifen, um etwa den aktuellen Patch-Stand oder die Konfiguration zu überprüfen. Eliminiert werden kann ein solches Risiko nur mit einer ergänzenden Lösung, die ein Passwort für den Schwachstellen-Scanner nur für kurze Zeit bereitstellt – mit einer anschließenden Passwort-Rotation; damit wird ein Angriffsvektor geschlossen.

Ein weiteres Risiko, das in Unternehmen lauert, ist die Schatten-IT. Will ein Unternehmen bei der Sicherheit integriert vorgehen, ist es wichtig, alle Aspekte, Applikationen und Systeme der Schatten-IT zu ermitteln, schließlich gilt: Was ich nicht kenne, kann ich auch nicht sichern. Dabei müssen sowohl vergessene Systeme als auch Anwendungen, die bewusst unter dem Radar der IT betrieben werden, Berücksichtigung finden.

cyberark_IT_sicherheit

Gleiches gilt für die OT (Operational Technology)-Sicherheit. Oft behaupten Unternehmen, eine strikte Trennung zwischen IT und OT sei vorhanden, in etlichen Projekten hat sich aber gezeigt: Es gibt oft Schnittstellen und Hintertürchen, die keiner kennt. Eine hohe OT-Sicherheit kann aber nur gewährleistet werden, wenn solche Nahtstellen ermittelt und für alle relevanten Geräte, Ports oder Verbindungen adäquate Sicherheitsmaßnahmen ergriffen werden – etwa mit der Überwachung vor allem privilegierter Zugriffe von IT-Clients auf kritische OT-Ressourcen und einer Unterbindung des Zugangs bei verdächtigen Aktivitäten.

Technologie ist aber nur ein Aspekt der IT-Sicherheit: sie umfasst auch organisatorischer Belange, also unternehmerische Prozesse, die ebenfalls geschützt werden müssen – selbstredend. Und in diesem Fall gilt ebenso die Maßgabe für Unternehmen, einen integrierten Ansatz zu wählen. Wiederum bezogen auf das Privileged Access Management sollte auch eine Vernetzung mit Lösungen von Identity-Management-Anbietern gegeben sein. Für Unternehmen ergeben sich dadurch mehrere Vorteile: von einer harmonisierten Definition von Workflows oder Prozesslogiken, etwa für Rollenfreigaben, bis hin zur optimierten Umsetzung von Governance- und Compliance-Vorgaben in Prozessen. Außerdem ist die Integration aus zwei weiteren Aspekten von Nutzen: Die Eliminierung von Doppeltätigkeiten reduziert sowohl Fehleranfälligkeit als auch Betriebskosten.

Gefördert wird das Silodenken in der IT-Sicherheit oft durch Compliance-Themen: Das ist aber nicht der richtige Weg. Eine Compliance-Vorgabe kann etwa lauten, dass PCs mit Antiviren-Software ausgestattet sind. Ebenso wichtige Maßnahmen wie die Auswertung der Daten oder ihre Weiterleitung an ein SOC sind aber in den seltensten Fällen Anforderungsbestandteile. Man könnte sagen: Gute Compliance führt nicht zwingend zu mehr Sicherheit, gute Sicherheit hingegen führt zwangsläufig zur Compliance.

Nicht zuletzt muss auch der Faktor Mensch ins Kalkül gezogen werden. Regelmäßige Sicherheitsschulungen sind Pflicht: Es muss deutlich gemacht, dass Sicherheitsmaßnahmen keine Gängelung darstellen, sondern der Risikominimierung dienen, auch wenn sie vereinzelt den Benutzerkomfort einschränken mögen. Voraussetzung für eine breite Akzeptanz ist, dass klar gemacht wird, warum welche Maßnahmen konkret ergriffen werden.

Insgesamt kann eine hohe Sicherheit nur durch einen ganzheitlichen, durchgängigen Security-Ansatz erreicht werden. Das heißt, ein Unternehmen muss unter Nutzung verschiedenster Technologien eine sicherheitstechnische und organisatorisch-prozessuale Integration vornehmen – und darf dabei den Faktor Mensch nicht vergessen.

* Michael Kleist ist Regional Director DACH bei CyberArk in Düsseldorf

Posted on

No Business without IT

Wanting to implement innovations quickly, companies often develop digital process inside the different departments without the adequate involvement of IT. This leads to isolated solutions within the organization. But solutions can only deliver true added value for the entire company if they can be scaled and integrated with each other.

The digital transformation has reached the company. However, departments often introduce SaaS-based applications on their own, or they develop their own solutions. This leads to the uncontrolled growth of incompatible systems.

 

Examples of isolated solutions in a production operation

  1. The purchasing department has a platform for supplier management that enables digital purchase orders. The specifications and volumes, on the other hand, are e-mailed to the production department and must then be entered manually.
  2. The sales department uses an independently developed web portal that provides customers with 3D models of products, which can then be customized. However, the product information is manually entered into the tool since the interface to the product information management system does not work properly.
  3. Production uses a manufacturing execution system that digitally displays the various production steps. But forecasts about production capacity, the finishing of individual products and defective products must be determined manually by analysis and provided to other departments as Excel reports.
  4. The development department uses a CAD system that sends drawings directly to the various machines. But the department is missing the experience data for cost-effective and reliable materials from production and purchasing.

This means that manual interfaces are required to exchange data, but they also represent a potential source of error. Therefore the systems should be integrated across the departments to warrant complete data integrity and availability.

In the case of a production company, this would allow customers to modify their product during the production process, actually see the progress and track the shipment in the web portal. The supplier management tool automatically receives data on current purchase orders and inventories. Supplier orders are automatically adjusted based on forecasts for product demand. And the development department always has access to current prices and production experience. The result: the cost-effective and efficient series production of individual products.

The role of IT in the digitization process: from service provider and enabler to driver

As a result, digitization requires a holistic approach for companies, their value chains and in particular their IT organizations. But IT must also accept and be allowed to practice this new role. In practice, it often finds itself trying to balance the requirements for rapid, efficient, agile, scalable and innovative digitization in the company with the growing IT independence of the various departments. These often view the IT organization as a hindrance, inflexible or old-fashioned. And so they go ahead and do their own thing – using Cloud services or external developers.

But it is exactly these types of isolated solutions that frequently lead to rising administrative expenses, more complexity and not least increased security risks since the existing governance requirements and guidelines do not cover these cases. The result:

Therefore the IT department (whether the other departments like or not) must strictly control the use of customized solutions and approaches during the digitization process. But by doing so, it cannot act primarily as a hindrance, but rather as the keeper and enabler of new business models. The IT department has several trump cards over its colleagues in the other departments: It focuses on what is good for the entire company and it has the flexibility to pro-actively find the required service providers. In addition, it can organize or manage tenders to negotiate the best terms with external providers.

The new IT organization: DevOps, agility and business partnering

To complete this transformation, IT departments must develop and pave the way for the future particularly with regard to the IT organization, business centricity and technology. They must assume responsibility for the scalability of the new digital solutions. In addition, they must ensure that processes are fully thought through, developed and automated, and that they can be integrated into the overall organization in a flexible and (if needed) agile manner.

This means: The processes in the IT department are increasingly changing in the direction of an agile collaboration with departments. Moreover, the IT team increasingly assumes advisory and managing functions. To this end, it must push for the following:

  1. recruit employees with the right skills, who understand agile methods and carry them into the company
  2. make data-based decisions on the basis of Data Analytics and prevent incorrect decisions due to a lack of skill or information
  3. despite higher levels of security, reduce the complexity in the operation while remaining flexible to reduce the required amount of time and resources
  4. lower IT costs with transparent IT controlling and service management to remain competitive
  5. develop and implement an IT sourcing strategy to speed up the process of finding the right service providers and concentrate on processes that differentiate the company from the competition

In addition, interdisciplinary DevOps Teams in the IT department also help to increase software quality and availability and therefore customer satisfaction. Business Centricity must also be improved (or introduced), and a detailed understanding must be created for the company’s business processes and value creation. To this end, the IT department must develop joint solutions with the other departments.

This can be done with:

1. Professional Partner/Business Centricity: IT developments are often based on the viewpoint of management. Therefore IT must see itself as a partner in the development of joint ideas and solutions to ensure rapid and flexible compliance with business requirements and to guarantee competitiveness.

2. Co-Innovation: Co-Innovation: Innovations are led and promoted jointly by IT and the departments. Particularly in agile environments, this means that IT experts work in teams with staff from other departments so that the steadily changing requirements can be met as much as possible and the investment expenditures are fairly distributed over the participating departments.

3. IT Service Management: The coordination between the service provider and the service recipient is intensified. Here too, it is all about promoting and practicing small and flexible partnerships between IT and its internal clients, so that technological changes and opportunities can be tailored to the requirements of the business. This provides a high degree of automation for standard business processes.  amirite?!

On the whole, it means that the existing employees in the IT department must increase their knowledge and skills for supporting business processes because company-wide innovations require IT departments to take a close look at the new requirements and the associated fundamental technological developments, which promise a lot of added value for all departments today.

They primarily include:

1. Cloud Computing such as IaaS, PaaS or SaaS to address the need for flexibility, efficiency, productivity and scalability, and to facilitate the collaboration of the teams.

2. Platforms for improving and accelerating processes to reduce manual error sources.

3. Analyses of Big Data (Analytics), so that relevant information from customer data, deliveries, orders, transactions, product details or manufacturer information can be extracted in a very short time (e.g. to improve the pricing process).

4. The IT-Security, which must always be scrutinized so that the required security concepts can be developed for the current company-specific structures and requirements, which also provide the requisite protection for critical business data in the digitization age.

It is only by including these issues that IT has the flexibility to meet the requirements of the departments, while also guaranteeing the company’s security and efficiency.

Conclusion

The idea of aligning the IT department to the digital transformation of the entire company sounds pretty simple in theory: It “only” has to make its own organization agile, maintain a strong connection to the business, focus on the main technological trends and actively promote these to management and the various departments.

However, this fundamentally changes the conduct of IT as a service provider and requires significant restructuring of the IT organization and its resources. In practice, the IT department must also become an enabler for employees.

At the same time, it must manage on-going operations and provide sufficient resources for modernization and the introduction of new approaches and technologies.

Therefore, in order to achieve an optimum and successful digitization process, IT departments should be considerably strengthened with regard to their skills and impact – or they should take the initiative in this regard. An IT transformation is not possible without a mature and enabled IT department that is viewed as a partner by the business. And without an IT transformation, there can be no long-term and sustainable company-wide digital transformation.

Posted on

Blocks Instead of Lines: A Tale of Fast ROI in IT Projects

craftwares_block_and_lines

Craftware, Salesforce Platinum Partner and UIPath Gold Partner are implementing projects for clients in Europe and the USA. It works directly with business and IT, in both areas ensuring the ultimate value of implementation for organizations and end-users.

Jacek Zawłocki, co-founder and CEO of Craftware, the architect of IT solutions. He took part in numerous projects, including the fintech, retail and telecom industries. Based on project experience, he explains how to smoothly implement IT systems in a company and quickly achieve a Return of Investment thanks to the agile approach and flexibility of Salesforce technology.

Do you know the YouTube blockbuster — a funny video about seven red lines? Yes, it’s the one about a project for seven red lines some of which are to be drawn with green, and some with transparent ink. And all of them must be perpendicular — according to the absurd vision of tenacious customers and the supporting project manager. Everyone insists on completing this awkward order despite the objections of an expert who from the very beginning tries to prove that the task is unfeasible.
Do you want to achieve ROI from an IT project fast? Don’t go down that road!

Business and IT — instead of going to war, we can sit down and talk

Although the video is a clever parody, the business reality is full of such missed ideas, and some of them are made real — this is well known to, for example, employees of advertising agencies. However, the issue is not specific to this industry only. Similar situations are not uncommon in other large organizations, especially in those were business meets (or rather collides with) IT.

“We would like to have a new system to automate and optimize some of our processes” — what happens when sales or marketing departments turn to “their” IT department with such an idea? How is the project carried out? It’s a topic for another article — you can read it here. There, you will learn why projects usually fail, and if they are completed somehow, the budget is exceeded or they are much delayed.

Fortunately, you can do it another way. There are more and more companies that decide to use modern technology platforms… Interest is growing not only in CRM systems but also in RPA platforms, such as UiPath – Craftware is its Gold Partner.

The era of cumbersome IT implementation is slowly coming to an end, giving up its place to the Agile approach and positive scenarios which prove that business and IT do not have to fight each other, but team up in a smart manner. Then, it is possible to successfully complete a project, and… win a bet for a crate of beer by the way — just as Craftware did on one occasion. We were given this gift by our satisfied client — a known and large online business that faced a challenge due to its rapid growth.

Start with MVP

The company decided to sell advertising space on its website. The idea hit the bull’s eye, but the massively increasing number of advertisement reservations and equally rising number of errors, for example, related to advertising space quotations, turned out to be a challenge. The employees were simply falling behind with orders. After a series of consultations with the client, we suggested them to implement a reservation system to eliminate this bottleneck.

“We will provide you with the first version of the system in six weeks,” we declared to the client. “Six weeks? We bet a crate of beer that you won’t be able to do that. This is a project for one and a half years.” As we learned later, this had been the deadline proposed to our client by another vendor.

According to our deal, we implemented MVP at the client after six weeks of starting the work on the project. This first step already brought some visible benefits: the sales of advertising campaigns accelerated by half, and the reservation of a single advertising space by 10%. The risk of errors that happened to the department employees was reduced by one fourth. Of course, the won bet gave us satisfaction, but above all, we were proud of our client’s success. The high level of adoption of the tool was rated “four” by the users, on a five-point scale.

Small steps towards your business goal

The key to success was the Agile approach and our client’s willingness to carry out the project according to this methodology. We agreed that we would work in small steps focusing on business goals.

But let’s imagine that a client — this very specific one (or another one interested in cooperation) — comes to us with an idea of seven red lines and stubbornly sticks to it. They vaguely explain what they want to use the lines for, or do not explain that at all — just like in the video described before. They do not accept our suggestions. How would such a project proceed? Would there be a chance to complete it?

Working on business goals requires the client to take responsibility for the project. It means a willingness to talk to the implementation partner: to give up forcing your own project visions and trust the suggested solutions. However, this responsibility must be also at the other side which means that the partner is reliable, proved, and experienced knows project patterns and how to translate them into business needs, because they put this into practice many, many times. What’s more, they can schedule work properly in time.

Small steps methodology, which means dividing implementation into intervals, enables the business to achieve ROI much faster. Costs are necessary at each stage but — starting from MVP implementation — each and every part of a project brings about visible benefits. As the implemented system grows, the pace at which it starts to turn a profit increases — it is best illustrated by the chart below: the cost and income curves cross very quickly.

Craftware_graph

Figure — drafted by Craftware

Build on modules

There is also one more element without which the Agile approach would be difficult: access to technology. To implement tools that quickly bring business value and generate the income needed to pay for other functionalities, not only do you have to know them very well, but you also need to have such tools, you need to have the proper technology, such as Salesforce, at hand. Flexibility is one of the greatest advantages of this solution: it allows you to react immediately and extend the range of solutions as the project is carried out.

Executing a project based on Salesforce, which we are the Platinum Partner, is like building a structure using Lego blocks. In both cases, we have a catalog of available solutions, but we also have generic blocks with which we can change, enhance, and enrich the basic products.

Getting back to the seven red lines for the last time: get rid of them and choose… blocks! Think outside the box — software can be built in modules!

I invite you to watch the recording of my speech during the first edition of the MIT Sloan congress, organized by the prestigious MIT Sloan Management Review Polska magazine.

Posted on

Så kan företag gå från traditionell IT till morgondagens arbetsplats

Citrix_Digital_Workspace

Många företag, särskilt större organisationer, har stora utmaningar när det kommer till den digitala arbetsplatsen. En enorm mängd olika applikationer, dokument och inlogg i kombination med ett arbetssätt som låser anställda till en specifik dator är alla faktorer som hindrar agilitet och flexibilitet. Citrix gör det möjligt för företag att använda dagens applikationer med morgondagens arbetssätt genom ett digitalt workspace som skapar förutsättningar för framtidens arbetsplats.

Traditionell IT på arbetsplatsen har länge bestått av en arbetsdator med en mängd olika typer av applikationer och programvaror. Enheten fungerar då ofta på ett sätt när man befinner sig på arbetsplatsen och kräver sedan VPN-inlogg om man som anställd behöver vara mobil och röra sig utanför kontoret, samtidigt som man inte har åtkomst till all funktionalitet. Många vill komma ifrån detta och gå mot ett mer flexibelt och agilt arbetssätt där de anställda kan välja när, hur och var de vill arbeta och ändå få åtkomst till alla typer av applikationer och funktionalitet på ett smidigt sätt.

Man vill ha samma flexibla arbetssätt på jobbet som man har vant sig vid med de applikationer man har privat, så som Facebook, Google eller LinkedIn. Alltså att det ser ut och fungerar på samma enkla sätt oavsett vilken enhet man använder, vare sig man är på jobbet, hemma eller reser. Fortfarande måste många bära på en otymplig arbets-PC bara för att kunna jobba hemifrån när man istället skulle kunna använda de enheter man redan har hemma, eller kunna ta med en tablet när man reser. Ofta är det kanske enklare saker man behöver göra men som ändå kräver både laptop, krånglig VPN och flera inloggningar endast för att nå applikationen.

Läs mer om Citrix här

– Det är precis det här vi möjliggör med Citrix Workspace, att man enkelt och säkert kommer åt den information man behöver – när, var och från vilken enhet som helst. Dessutom kan vi numera även förändra utseendet på själva applikationen för just de enklare uppgifterna som till exempel godkännanden i en applikation, delning av dokument eller notifieringar av viktiga förändringar. Vi ser ett ökat intresse för användarupplevelsen och ett flexibelt arbetssätt som viktiga komponenter för ökad produktivitet och engagemang bland medarbetarna, säger Peter Söderholm, Director Sales Engineering, på Citrix

Med Citrix Workspace ges användarna möjlighet till ett smartare och mer flexibelt sätt att arbeta, där användarna inte längre är beroende av att vara på själva arbetsplatsen eller använda en specifik enhet för full funktionallitet, samtidigt som IT får möjlighet att flytta delar eller hela IT-miljön till den mest optimala plattformen vare sig det är on-prem eller hos en cloudleverantör. Användaren gör en stark inloggning in till Citrix Workspace och har sedan enkel och säker access till samtliga applikationer och data utan ytterligare inloggningar eller krångliga VPN-lösningar. Man kan enkelt ta vid och fortsätta arbeta hemma på samma sätt som man gör från kontoret. Den digitala arbetsplatsen följer helt enkelt med användaren sitter inte längre fast på en specifik enhet.

Snabb leverans av arbetsplatser

På verksamhetsnivå ger lösningen andra värdefulla fördelar. Använder man externa konsulter kan man enkelt ge rätt access och behörigheter utan att personen behöver bli tilldelad en annan dator än sin egen. På samma sätt kan företag vara agila vid uppköp och förvärv och snabbt leverera Digitala arbetsplatser utan att skicka ut hundratals, eller tusentals nya laptops. Allt med en hög nivå av säkerhet

– Förr i tiden när appar bara var tillgängliga på insidan av nätverket var man inte lika exponerad. Nu måste man se till ett säkrare sätt att leverera IT eftersom det ställs stora krav på snabbhet och flexibilitet från verksamheten. Ett bra exempel är försvarskoncernen Saab, som med hjälp från DXE och baserat på Citrix Workspace skapat en digital arbetsplats som klarar deras högt ställda säkerhetskrav och samtidigt gör det möjligt för Saab att på två dagar efter ett förvärv av ett annat bolag kunna leverera en fullt fungerande IT arbetsplats.

Workspace får smarta funktioner

Själva syftet med agila arbetsplatser är att öka effektiviteten och produktiviteten. Under en arbetsdag spenderar många en stor del av tiden på att söka efter information, byta mellan olika applikationer och system, ofta med upprepade inloggingar, vilket skapar avbrott som sänker produktiviteten rejält. För att komma ifrån detta har Citrix lanserat ett antal intelligenta funktioner i Citrix Workspace.

– Dessa smarta funktioner kommer att minska tiden vi lägger på återkommande och därför tidskrävande uppgifter som egentligen inte tar mycket tid i sig men sammantaget utgör de en stor del av arbetsdagen. I gränssnittet kommer du att ha en virtuell assistent som kan hjäpa användaren nå rätt information. Den kommer dessutom ha en vy som gör det enkelt att arbeta i flera olika system utan att behöva lämna själva workspace-gränssnittetet för enklare uppgifter genom ett koncept med Micro-Appar.

– Dessutom kommer Workspacen med tiden bli smartare genom maskininlärning som ständigt lär sig ditt personliga arbetssätt där du får förslag på aktuella uppgifter som kan utföras med några enkla klick. Det kan vara allt från att godkänna ett utlägg till att rapportera dina semesterdagar utan att behöva först starta och logga in till den fulla applikationen. Dessa funktioner tillsammans med möjligheten till ett flexibelt arbetssätt ger en bättre användarupplevelse där Citrix Workspace förenklar och eliminerar tidstjuvarna och på så sätt ökar produktiviteten, avslutar Peter Söderholm.

Låt oss visa dig hur en intelligent digital arbetsplats ser ut! Klicka här för demo