The Need of the Hour of Today’s Enterprise – Innovation Within to Enable a Sustainable Ecosystem

The uncertainty and chaos caused by the prevailing deadly pandemic clearly shows that although we live in a world complete with cutting-edge technological solutions for many of our problems, we are not really focusing on the ‘right’ problems. Are we addressing the world’s most challenging issues in the right way? The pandemic itself is proof that we have probably missed some of the most important aspects in this world and shown us that we lack innovation, investment and technological advancements in healthcare, education, environmental and many other areas. The current world order and the financial ecosystem as we know it, is fragile and it clearly is not focusing on the important issues that we need to solve as a human race.

With this realization, the world is starting to understand a little better and is making an effort to shift gears to creating and maintaining a more sustainable ecosystem with innovation at its core. Doomsday Hollywood movies have often depicted how our world may end in the most dramatic way – but the truth is we may be heading that way in reality unless we act fast. Are we too late to change course for the better? The good news is we can, but we need to act fast.

What is Sustainability?

Before we get into the solutions, we need to understand some of the underlying concepts and models that we can use to solve these problems. Sustainability has become a buzzword today, but what does it really mean? Let’s consider this definition “Meeting our present needs without compromising the ability of future generations to meet their own needs (Brundtland Commission, 1987). It has three components — environmental conservation, social responsibility and economic development. While most people primarily associate sustainability with environmental conservation, it is about people and the health of our communities!

In 2015, the United Nations drew up a guideline called The Sustainable Development Goals, a blueprint to achieve a better and more sustainable future for all. They addressed the global challenges we face, including poverty, inequality, climate change, environmental degradation, peace, and justice, encompassing all elements that need to be considered given that sustainability has a broader aspect. Businesses too can add great value to solve these problems if they have a clear focus on them.

How Can a Business Realign and Change?

1. Develop a greater purpose – Businesses have typically had one financial objective – to increase revenue, create shareholder value, improve customer portfolio. However, today, this focus must shift slightly to have a bigger purpose. Companies today must invest in more sustainable ways of doing business, which include culture, impact to society and the community, as well as the environment.
2. Shake off the legacy mindset – To be able to incorporate sustainable practices into your business, organizations need to focus on what’s called the triple bottom line. To build a purpose driven business or operate as one you need to have a long-term vision. Most businesses operate on short-term goals or quarterly based achievements. But, there needs to be a balance, meaning a business should have both short-term and long-term goals. These goals must be impactful with a larger and lasting impact on society and on the planet. It’s only then that any high-tech modern-day innovation can contribute meaningfully to sustain our existence.
3. Carve out a different way to operate – A sustainability focus driven business needs to operate two steps ahead, which means they need to have a long-term focus. It also needs to be partnership oriented, which means it needs to be open to partners who have expertise in other areas and have common goals and vision. Above all, it needs to be human centric and must include an element of empathy.
4. Nurture purpose-driven employees – No goal or innovation can be accomplished if you do not have the right talent and the required motivated and passionate mindsets. That is why your employees will be the biggest assets to transform or build a purpose driven organization or innovation. To do this, you must focus on creating a work environment where employees feel their job is more than just a paycheck by incorporating other intangible benefits. When organizations prioritize purpose over paychecks, they appeal to candidates who are committed, intrinsically motivated and show greater passion for a bigger cause in their work, especially among younger generations entering the workforce today.

Conclusion

The problem is very real and requires immediate attention. While much has been talked about and debated on many forums, some organizations lack the enthusiasm or sense of urgency to address these issues by redefining how they operate. In a nutshell, the future of businesses and companies are not going to be spreadsheet driven. It has been proven by Elon Musk and other modern-day entrepreneurs that their successes were achieved by trying to solve real-world problems. The mantra of organizations today should be to create wealth and value by adopting a larger purpose – one that recognizes and embraces the bigger picture of sustainability to positively impact people and the planet via innovation and disruptions.

“Disruption is the watchword in business today. With technology changing at hyper speed, corporations may struggle to build a foundation for long-term success. Traditionally, organizations have emphasized how much revenue they create and how many expenses they cut. With the challenges facing society today, that simple focus is no longer sustainable.” — Forbes

The Evolution of Cyber-Attacks in Sri Lanka

As you are already aware, cyber-attacks reported within the country has become more common in the recent past. Reflecting on these attacks, we noticed three trends that have been explained below:

1. Drastic increase in threats – Over the past two-to-three years, we have noticed that the number of cyber-attacks targeting Sri Lankan-based enterprises has been drastically increasing. We hear more stories about successful attacks compared to attacks that were detected and mitigated at their early stages.
2. Increase in the complexity of attacks – We aren’t talking about isolated, annoying viruses anymore that make our life a little difficult, for example folder.exe., rather attacks that go through multiple stages spanning over a period of time. Attackers improvise and adapt to the environment and leverage stealth mechanisms to remain undetected until the very last stage is executed.
3. Exponential increase in the impact of attacks – The impact of modern attacks is increasing rapidly. We have come across many instances where large organizations have been brought to their knees and took days to recover. In addition to the financial loss due to the abrupt stop of business, money and resources been spent on the recovery process, many organizations suffer significant reputational damage. News travels fast and bad news travels faster. Some attackers even go as far as releasing samples of stolen data to persuade companies to pay ransom.

In order to understand the current cyber attack trends within the country, let’s analyze what has changed over time from an attacker’s point of view and from a defender’s point of view.

The Evolution of Cyber Attacks in Sri Lanka – From an Attacker’s Point of View

Looking at how the attacks have evolved from an attacker’s point of view, there are a few key points that we have observed.

Sri Lanka is no longer a hidden target – For some time, we had the luxury of reading about attacks only in news or tech blogs. It was very rare for us to be at the receiving end of a cyber-attack. But that isn’t true anymore. Attackers have their eyes set on enterprises in Sri Lanka. With acceleration in digital transformation happening and changing work dynamics due to the prevailing pandemic, Sri Lanka is more visible to attackers who now view it as a viable target.

Attackers collaborate – Just like we collaborate to defend our organizations, attackers too have started to collaborate in order to be more efficient when running attacks. It is no longer required for a single attacker to run all the stages of an attack by themselves, instead they collaborate and function as a tag-team. For example, one attacker group may have expertise in stealing credentials, while another has expertise in stealing data or running ransomware attack campaigns. In such an instance, the former would tend to sell the credentials they stole to the latter, so they can run a ransomware attack. This enables the attackers to focus on what they are good at.

Everything is available at the right price – I believe most of us are familiar with the term XaaS (X-as-a-Service). Customers prefer to consume functions in the form of “as-a-Service” since you can get what you want without having to worry about the underlying technologies and maintenance overheads. This is true with attackers as well. Attackers rent out their infrastructure or services to interested parties to run attacks expecting a percentage of earnings in return. For example, Ransomware-as-a-Service (RaaS) is a very common thing these days.

Easy way to earn money – If you have been following the news and have been monitoring professional social networking sites such as LinkedIn, you will notice that there are a lot of professionals who are seeking work due to the effects of the pandemic. Attackers seek to lure such individuals by showcasing the potential of earning a quick buck.

The Evolution of Cyber Attacks in Sri Lanka – From a Defender’s Point of View

Cyber-attacks are no longer a smash and grab operation – In the past, it was very rare to experience an attack that had multiple stages and most attacks rarely spanned over a couple of hours. But now we experience attacks that have many stages, such as initial compromise, credential theft, privilege escalation, lateral movement, detonation, and these span over a period of time which could range from a couple of days, weeks, to even months. This makes it incredibly difficult to detect if you do not know where to look.

Attackers actively participate – Attackers have become more involved during the period the execution takes place. They no longer release viruses or worms and expect them to do the job on their own. Instead attackers are focused on creating and maintaining communication channels to the victim networks and dictating how the attack is executed. This enables them to be more devastating since they could quickly adopt and circumvent any changes the defenders place in order to thwart such attacks.

No more bringing your own tools – In the past, most attacks were done using tools created by attackers for that particular purpose. This made it easy for security solutions to detect such tools and prevent them from executing. But this is no longer the case. Attackers prefer to improvise, hence whenever possible, they would leverage legitimate tools used by administrators to carry out the attack. This is also known as “living off the land.” This makes it very difficult to detect since we would always have to consider the context of an event before deducing if it is malicious or not. One example would be an attacker compromising your software distribution tool to deliver a malicious payload within your network. Without knowing if the payload is malicious or not, you cannot accurately say if this activity is malicious or not.

Multiple entry points to exploit – In the past, an enterprise had an easier job protecting their networks since the perimeter was clearly defined. Anything within the organization’s premises was considered to be trustworthy and anything coming from outside was scrutinized before allowing access. But with the “New Normal” everything has changed. It is no longer about who is inside your premises and not since many or even all employees are working from home, connecting via secure links and have direct access to the heart of the organization, which are essentially the critical business applications. These devices that are allowed to connect are rarely scrutinized, hence act as easy entry points for attackers. This has made the defender’s lives much harder since now they must focus on multiple entry points (in some instance even unknown) rather than the few well-defined entry points they used to have.

In summary, the attack landscape has drastically changed and keeps changing, and attackers are becoming increasingly effective with time. We have a fare doubt in our minds whether we are putting enough effort to protect ourselves against these attacks. The time has come for us to up our game as defenders and work towards advancing our techniques in order to defend against the attackers who will never rest.