Saudi Arabian CIOs have had to adapt quickly to the security challenges posed by staff working from home, on a huge scale.
Since the early months of the year, the coronavirus pandemic has transformed the Saudi Arabian IT landscape in unprecedented ways. Across the Middle East and globally, nationwide lockdowns led to an overnight surge in remote working, Zoom meetings, online shopping and virtual schooling.
In a country which has traditionally seen high levels of strictly in-office working, swathes of Saudi Arabian workers are now working from home, which means the kingdom’s CIOs are rewriting company security policies.
Like much of the rest of the world, offices in Saudi Arabia are no longer centralised, they are spread across multiple homes and under siege from varied threats such as exposed unsuitable hardware, non-firewalled environments, and even unassuming family members who are sharing sensitive equipment and data.
According to Maen Ftouni, country manager for Saudi Arabia and Bahrain at email security firm Mimecast, companies across the kingdom were forced to quickly implement strategies amid lockdown that enabled staff to remain productive.
“With a remote workforce came increased cyber risk. Security vendors had to ensure they were adequately protecting their customers with solutions that catered for a variety of evolving cyber threats,” said Ftouni.
“It was also vital that IT and security systems were enabling remote working and not an inhibitor. We have seen security policies move from a perimeter-centric approach to a data-centric approach, where a drive to protect data anywhere at any time is the key,” he added.
Historic uptick in cyber attacks
As the virus ramped up and countries went into lockdown in the first quarter of the year, Mimecast’s Threat Centre witnessed a historic uptick in cyber attacks. The centre saw increases in malware (22%) and spam (36%) in thye Middle East during February and March, when the virus started spreading in the region. “Cybercriminals are refocusing their phishing, impersonation and ransomware attacks from office networks to the cloud services remote employees use from home,” said Ftouni.
He added that the need for resilient and scalable cloud solutions has “surged exponentially” in the last few months as many organisations were simply unprepared for managing remote work environments.
“Companies must invest in technologies that mitigate threats wherever they are regardless of geography,” he said. “Classic perimeter defence solutions are no longer enough in the post-Covid world, going after the attackers and being on offence at all times has never been more important.”
Cyber security spending boom
As Saudi Arabian firms scramble to tackle cyber risks and secure work-from-home conditions during the nationwide lockdown, cyber security spending is soaring.
According to Uzair Mujtaba, research programme manager at IDC Saudi Arabia, uncertain market realities associated with the Covid-19 outbreak have driven national organisations to reevaluate their cyber security exposure while moving from a ‘cloud last’ to a ‘cloud also’ mindset.
The kingdom’s CIOs and CISOs have been “struggling” to determine how to stay responsive to customer needs, how to scale in a safe and secure manner, and how to facilitate the transition of work from an office desk to employees’ homes, he said.
“End-points are growing in number, enterprise IT assets are being accessed remotely, and cloud computing has become the new norm, and all the while threats are becoming more sophisticated,” said Mujtaba. “This trend is not only driving increased security spending, but also signalling a massive shift in how security policies will evolve and adapt to the future.”
In the Saudi Arabian software space, while traditional network and endpoint security application will continue to be biggest revenue contributors, software categories such as identity and access management (IAM) and web content inspection are set to show significantly higher demand, Mujtaba predicted.
The data security software segment, although still nascent in the kingdom, is expected to be one of the fastest growing security categories over the next five years, according to IDC.
Unified threat management (UTM) and intrusion detection and prevention (IDP) in the security hardware segment are also expected to clock positive growth over the next five years, the firm said.
“It has become extremely important for the Saudi Arabian organisations to reevaluate their cyber security postures and invest in technology controls that ensure accurate levels of privilege to access IT assets and enterprise digital services,” Mujtaba said. “Organisations are looking at different ways in which they can make their IAM more efficient and predictive.”
Maher Jadallah, Middle East director at network security firm Tenable, said regional IT managers and security teams need to “hold their nerve” and focus on what they would normally do by ensuring basic cyber hygiene is observed.
“For example, limit privileged accounts and protect those that are used, educate employees on phishing attacks, enforce strong unique passwords and make sure they’re not shared, and even consider controlling USB devices,” he said. “To reduce complexity, organisations could identify and remove software that isn’t being used or is obsolete.”
“Given the expanded perimeter, organisations should look for technologies that afford complete and live visibility into the entirety of the attack surface – be they traditional on-premise or in the cloud – as the first step toward reducing overall cyber risk,” he said.
