AT&T’s Theresa Lanowitz on Cybersecurity in Edge Computing

foreign speaks we're talking about cyber security Trends and Edge computing The Edge sector is growing rapidly of course but security has been a major concern to discuss that I'm joined by Teresa lanowicz head of cyber security evangelism at at T business Teresa very good to have you with us today great James it's so wonderful to be here thank you so let's talk about Edge Computing and security but first let's look at the edge Market broadly I mean first I just want to check my introduction I said this that security has been a factory with Edge am I am I fare is that about it absolutely absolutely Fair because if you think about what Edge is doing Edge is really primarily a lot of iot devices and we also have these faster networks lower latency higher bandwidth um faster networks the apps are changing and everything is being collected in that iot device so security is certainly a big part of that it's the security of how do you secure that endpoint because you know you've heard about people doing iot types of programs in their organizations and they put a camera out there the password on the camera is one two three four and the adversary knows that right the cameras out there they get into that iot device and then they can just move laterally through that Network I I would even so in terms of engine security I would even say that it's been one of the most challenged Fields out there when it comes to security Edge is really like it's we you know a lot of companies are enthusiastic about Edge but then they think Hmm we have to deal with the security aspect of this yeah well that's one of the things that we find in our report too is you have to deal with a security aspect of it and one of the big pieces of data that we found was that organizations said The more Edge use cases they have so the more Edge Computing use cases they have the more they realize that it's really important to bring in these cyber security controls so if they're just thinking about Edge if they're in that ideation phase they're not as concerned about those cyber security controls they may say oh what we've been doing with our Legacy stuff may work just perfectly fine but now once they realize oh we're going to put this out here we're going to have these iot devices all over the place they then have to start to think about securing and the security controls that they're going to put in how they're going to secure those endpoints and one of the other really interesting things we found is that endpoints are changing endpoints are evolving 48 of our survey participants told us that endpoints today are the traditional types of endpoints so your phone your tablet laptop desktop but in the future in the next three to five years the endpoints are going to be intentional and purpose-built so think things such as robots autonomous drones autonomous vehicles wearables for Health Care remote patient monitoring so those endpoints are changing very very rapidly and maturing very rapidly and as a cyber professional you have to really make sure that you are able to secure those endpoints you have to make sure that you're making sure that that data that is being collected on those endpoints is protected it's trusted but it's also usable by by whoever should be using it and whenever they should be using it so Edge Computing in reality it really changes everything it's that next generation of computing lower latency higher bandwidth networks apps that are ephemeral headless come together on an as needed basis and it's also this idea of serving up things digital first I'm not opening an app to find out what I need to do things are just happening in that near real time capacity and and let's be clear about way there's no app needed how is it embedded in another app like how are people accessing it if they're not actually seeing it through an app yeah so it's those it's those applications that are machine to machine communication and control and if you think about where we've been over the past three years or so we went to through this phase of digital transformation and digital transformation was absolutely essential as we entered into 2020 and everything that we saw unfold with the pandemic then we go to 2021 2022 and organizations started to say we need to operationalize what we're doing now we're in this era of edge Computing because we do have Innovations happening inside of the infrastructure that we're using so Innovations in the networks for example Innovations and how we can actually code Innovations and how things can be delivered and so now we're on this path of edge Computing and where this really comes down to business is businesses take a look at Edge Computing and say what type of business this outcome can I actually create from Edge Computing and so one of the things we do in our at T cyber security insights report is we say what are the top use cases for each vertical we surveyed seven different verticals so for example in manufacturing warehousing using Robotics and robots are their top endpoint most vertical markets are saying their top endpoint are still you know those common things laptops desktops phones and so on right but where digital warehousing was one of the top use cases the absolute top use case that we saw was from the U.S sled State local and higher education market and it's smart building management so making sure that you are able to manage the controls of the building preemptive maintenance that sort of thing and that's one of the really smart things that we're seeing with Edge computing well all right so I think the maybe the real question is what do you what advice do you give companies to address these security challenges I mean it may decide on may depend on the use case of course and the device being you know protected but are there some overall best practices in terms of iot and Edge Edge security yeah and this is really interesting and these may sound as though it's a lot of common sense but this has proven empirically in our report this year in 2023 as well as in 2022. so one of the things we know that has happened in it over the past four or five plus decades is we've had these silos created we have the application development Silo the networking Silo the operation Silo so with Edge there's this need for cross-functional communication and collaboration between the development teams the networking teams the operations teams the line of business the line of business is really crucial in this because the line of business is saying I need to drive business outcomes for efficiency for Effectiveness by doing X and they outline some type of use case and they need to collaborate across functionally with all those technical teams that make it happen and what we are also found out we found that 71 of our survey participants so that they're bringing in a trusted third-party advisor to really help with this Edge Computing and this is really interesting because 64 said we're bringing in a trusted third party advisor prior to going to production and 71 said we're bringing in a trusted third party advisor once we get to production and that numbers that number varies between the different verticals that we surveyed but it's a high number across the board so that's one piece of advice is communication collaboration internally as well as externally bringing in that trusted advisor whether it is cyber security Consulting a managed security services provider once you go to production bringing in a Global Systems integrator a Telco and so on and the other best practice is really think about what you're doing begin with the end in mind and build for cyber resilience meaning that in the event of some type of breach in the event of something changing in the infrastructure and so so on you can continue to operate you're building that resilience in so if you set up an edge an edge Computing use case and you're in a highly regulated environment and all of a sudden new regulations and controls come down you can go back and you can adapt and build those regulations and controls in without starting from scratch so really thinking with with the end in mind so those are two kind of really I think Common Sense things but what we've found in our research is those really really help organizations as they're building out those Edge Computing use cases so really it's it's your first point they're hire expert help from from outside don't rely on in-house you know professionalism so to speak it hire an outside expert yeah this is all new uh you know as I mentioned it and if you think about Edge you have like I said it's software defined on-premer in the cloud your workloads your applications your hosting it's closer to where that data is being generated and consumed and then it's that distributed model of management intelligence and networks and when you think about securing what you have in that edge Computing use case it is certainly non-linear it's not what we have had in the past and we've been talking about this in the industry for the past several years is that it's no longer just the four walls of my organization where where I am actually executing Computing Gathering data that sort of thing so it's about saying okay I have someone out there an expert who has done this before they have seen this with other organizations that have seen this with with the inside my industry with other companies bringing that third party and that third-party trusted advisor is really critical to success how is ATT addressing the edge Computing needs of its clients what what is att's role here yeah and so from an at T cyber security perspective we offer clients two ways to engage with us and this is the way we can help them with their Edge Computing use cases the first is through our at T cyber security Consulting and so our Consultants can come in and help organizations assess their posture help them assess their risk do red team exercises blue team exercises and so on so that Consulting organization can give you that view of where you are today and they can also engage with you and on all on an ongoing basis to say here's here's what you should do next here's kind of a road map to follow and the nice thing about what we do with our at T cyber security Consulting Services is their vendor neutral they're not coming in and saying hey we want to sell you you know what we are offering the second way to engage with at T cyber security is to to help protect your Edge Computing use cases is through our managed security services so one of the things we know is that complexity continues to grow if you think about it we now have Edge Computing and in the past we have web apps we have mobile apps we have Internet that apps we have client server apps we have Mainframe things that we still have to take care of so nothing ever goes away and the more democratized Computing becomes the more risk there is and the more chance of there is or some type of cyber event to occur so through our management Security Services we can help you with network security we can help you with endpoint security we can help you with managed xdr we can help you with manage sassy so all those managed services are available out there as well you know it's interesting you talk about the complexity and uh but nothing ever goes away which is true we keep creating these new technologies so the old Technologies may or may not fade away they're often there sort of held together with duct tape and also your piece about that things get democratized and they get to Mega theme throughout technology today things are getting democratized maybe it's access to data access to you know artificial intelligence I never have thought of it necessarily that that the democratization would lead to less security but I see how it would because more and more people are able to access it so it it would confuse the environment yeah that democratization is something really interesting if you look historically let's think back you know in the 1960s when you had data centers evolving the biggest security risk that you had was that somebody would come into that data center or spill coffee on the keyboard accidentally kick a plug out from under the wall the moment we came out of that data center and democratized Computing with personal computers and PC Lan types of networks we then just rolled out the red carpet for the adversary and you think about sort of the PC land type of adversary it was largely hobbyists somebody who was bored usually students in that era in like the 1980s or so who would want to go in and say all right just leave a digital signature right say I'm smarter than you I broke into your network but then we kind of fast forward and we have adversaries of all types we have the Lone Wolf adversary who is somebody that you really have to watch for things such as Insider threats then you have sort of those affiliate networks you have um so you know the um the Cyber gangs that are out there you have um the the groups that are doing this just for financial gain so you have a whole host of different types of cyber adversaries that are out there and the types of attacks that they execute are also very different as well and what we found in our at T cyber security insights report this is really an interesting piece of data because when people when people hear me say this when they read the report they sit back and they say are you really sure about this and the answer is yes I'm really sure about this so we asked 1418 professionals from around the world director level and higher end title and they were cyber Security Professionals I.T professionals Network light of business and operations professionals we said from your perspective what is the biggest attack that you're concerned about with this new era of computing Edge computing and it came back and we said you know on a scale of one to five where do you rank these these sort of attack concerns DDOS attacks were their number one concern and last year we asked the same question and on a we have eight different attack types that people identified and last year DDOS was number eight out of eight and ransomware was number one out of eight in 2023 ransomware is number eight out of eight and DDOS is number one out of eight and if you look at how Edge Computing is being rolled out largely through a series of iot types of devices if a DDOS attack can be executed against an iot device and you take those iot devices offline for 25 30 minutes 40 minutes an hour that's a tremendous impact to the business whatever they are using those devices for and if the adversary has been able to gain access to the network and move laterally then they can sort of install some type of malware and then you have ransomware attacks business email compromise was also something that organizations identified as a top concern they also identified Insider threat personal information exfiltration um nation state attacks certainly but DDOS good old-fashioned DDOS is making a comeback and we're seeing that in the news on a daily basis that DDOS is is definitely making a comeback so the dedicated denial of service it's it is promoted you said or enabled by all these weak endpoint devices that's exactly the point of that yeah it and I I wouldn't say that they're weak endpoint devices but the endpoint devices may not necessarily be secure and the adversary can figure that out pretty quickly all right well I think the big question ultimately is the future of edge Computing security over the next oh say one to three years maybe a little further out I mean obviously Edge is going to continue to grow it it doesn't get quite as many headlines these days in the world of artificial intelligence seems like it kind of sucks up all the air these days but Edge is growing really rapidly and security is a major concern what do you see looking ahead for that yeah so looking ahead one of the things that I was really I think very very happy to see in the data that we collected this year was that there's this almost distributed or balanced investment across security applications planning and the network because we ask people of your total Edge budget how much are you spending on security how much are you spending on applications how much are you spending on planning and how much on a network and across the board the average was for security they're spending 22 percent of their budget on security 22 on networks 23 on planning 30 I'm sorry 30 on network 23 on planning and if you look at security applications and planning those are traditionally the types of things that organizations do on very ad hoc basis but with this idea of silos beginning to erode the idea that we need to work cross-functioning and communicate cross-functionally the reality that security is not just a technical problem but it is really a business requirement organizations are now starting to plan because they see these Edge Computing use cases and in many cases they're safety critical they're Mission critical so they're saying we have to get this right we can't just roll this out there and say oh if we get it wrong you know we'll just release another version of the next day there are way too many parts and it's way too complex so they're you know they're saying 22 of our budget on security security now has a seat at a table 22 percent of our budget on applications really awesome because we're just not going to create software you know throw it over the wall and say if it's broken we'll fix it secure applications are going to change we're going to see a lot more non-gooy or headless types of applications that will come together on an as needed basis and communicate information data back and forth and then 23 on planning I was very very impressed by that and then 30 of that work so it's a pretty even investment across the board so given that even investment I think we're going to see a lot of really interesting use cases out there the endpoints that people identify that they're using robots uh in a healthcare situation for example think about how robots could be used to for efficiency inside of a hospital for example robots can deliver supplies to a nurse's station without any sort of interruption they're not going to drop things they're not going to lose things along the way a robot can disinfect a patient room after an exam or after a patient leaves the hospital far more efficiently and far more effectively than a human can so robots in healthcare wearables in healthcare remote patient monitoring understanding vitals being sent right back to the doctor so the doctor can monitor immediately if you think about U.S sled State local higher education this idea of smart building using Edge Computing for public transit use cases if you think about Warehouse from retail smart warehousing intelligent warehousing understanding what's going on in the warehouse and that spills over to manufacturing as well manufacturing using using sensors and cameras for video based Quality Inspection to say that if I have a defect that's inserted on the assembly line then I can immediately as a manufacturer remediate that defect causing me less concern less recall thereby spending less dollars further on down the line so these use cases that are out there are just absolutely phenomenal incredible and they're only going to get better and the nice thing is we see them in our everyday lives we use them in our everyday lives and we don't even realize it because the technology is frictionless and that's really where you want to be is with that frictionless technology that things just work and I've been in this industry for a long time and one of the things that I have talked about formally in my career is that technology just needs to operate just as a utility does when we turn on the light switch we don't think too much about it when we turn on water we don't think too much about it and we're getting closer to that with all of these Edge Computing use cases that we now see in our daily lives interesting I mean I I like the idea of Technology as a utility I think that we sometimes struggle with it but hopefully it will get easier uh at any rate Teresa wow that was fascinating I learned a ton it was great um totally appreciate you sharing your expertise today and I hope you come back and talk with us again sometime well thank you James so much I would be thrilled to come back and talk with you this was really really great discussion today thank you

This transcript was generated automatically from the video's captions and may contain errors.