IT Brief Asia logo
Technology news for Asia's largest enterprises
Partner content
Story image

Without trust, your security team is dead in the water

By Jessie Chiang
Tue 5 Jul 2022

The rise of cyberattacks and data breaches has increased the need for sound security that works across any type of business. But with any change in an organisation, buy-in is essential.

Airwallex's head of IT and information security Elliot Colquhoun says from a security perspective, organisations tend to over index on reviewing security controls, such as those implemented by a vendor or implemented within their own environments.

"This is a useful lens for business as usual, however, security professionals should expand their evaluation to also include the human and often undervalued aspects of trust," he says.

"Do your employees trust your security team? Do your customers have a positive perception of your security that has earned their trust?"

Colquhoun says having the trust of employees and customers is a force multiplier for security. At Airwallex, the staff are generally passionate about privacy and understand the impact of security changes, and so positive engagement is critical.

"We have seen first-hand that the high level of trust from our employees results in easier and more effective implementation of security changes and controls. The impact of this extends to our customers – their increased trust in our controls drives loyalty and wider adoption of our products," he says.

Later on, this positive branding also becomes a differentiator and a revenue multiplier. Companies get greater customer access because they have the perception and brand to convince their internal security teams.

How can security leaders build trust with employees and customers?

Trust is built on communication and transparency. Colquhoun advises that companies should share what is on their roadmap and openly discuss recent incidents or investigations. Focus on the impact of changes they're making and explain why they are required.

"Recently, we implemented a VPN which performed TLS interception. Naturally, some employees had concerns about the privacy implications, particularly for personal internet browsing," says Colquhoun.

To navigate these concerns, Airwallex took several steps to ensure its staff backed the objective, including:

1. Distributing a fact sheet that helped explain the privacy considerations in as simple language as possible
2. Writing an internal blog post explaining why it was implementing these changes
3. Hosting town hall meetings in each region, allowing employees to voice any concerns and the security team to answer any questions.

"Being transparent made our employees feel heard, and this increased the overall uptake and integration of the VPN. Some of our most cynical users turned into supporters who helped build our VPN into firewall rules for tools within their departments," says Colquhoun.

"Transparency is equally important for your customers as it allows you to demonstrate the maturity and strength of your security program. It's important to define the perception before customers define it for you."

"For example, we list our security certifications and details about our security program on the Airwallex Trust Centre, an NDA-protected portal on our website. We also publish blogs –such as our engineering team’s Medium page– and open source parts of our security infrastructure, in an effort to be transparent about our security program and share learnings with others in the industry."

Building security into a business identity transforms how its customers view its implementation – from simply alleviating a user experience pain point to adding real value to the customer's experience.

Traditional security engagement programs have turned into a box-ticking exercise

Increasingly rigorous regulator and partner requirements for security awareness and vendor reviews have driven a need for a very specific engagement model. For employees, this is typically annual security awareness training. For customers, this is likely SOC2/ISO27001 or similar audited reports. Unfortunately, while these strict requirements are the minimum acceptable controls for a regulator or partner, they often fail to drive meaningful engagement.

Colquhoun says if we're honest with ourselves, these box-ticking exercises alone do not represent the ever-evolving security program required to safeguard against modern threats. They also lack the opportunity to showcase the meaningful and differentiated controls implemented by security programs.

This is where a dual approach can be most effective.

"At Airwallex, we strengthen compliance-driven security awareness to meet regulations, with 'behind the curtain' awareness events to build trust and transparency," he says.

"Each quarter, we run an in-person session open to all staff; diving into some recent security investigations, giving our staff a better understanding of what the security team works on, and the kind of threats we are protecting our company from. This transparency leads to increased trust."

Colquhoun says frequent communication and transparency are critical when implementing a security program that prioritises building trust. Therefore, when designing a program, businesses should consider the following:

  • Do employees know what's on the security team's roadmap for the year?
  • Do employees know why different security controls are being deployed and the risks and threats they aim to reduce?
  • What is your customer's perception of your security?
  • How closely does that customer perception match the state of your security program?
  • Are you proactive or reactive with your communications?

Additionally, a senior management team with a deep understanding of how security impacts the business and its operations, is critical in determining the success of a security program. Engagement metrics – such as employee surveys measuring trust in your security team or increases in reported security events – are useful for obtaining trust from senior management.

"All of these methods require time. While a relatively easy and impactful addition to budgets and roadmaps, trust isn't built overnight, but once earned, the return on investment is priceless," concludes Colquhoun.

Related stories
Top stories
Story image
Tech job moves
Tech job moves - Cohesity, Equinix, IDC, Proofpoint & Xero
We round up all job appointments from July 29 - August 5, 2022, in one place to keep you updated with the latest from across the tech industries.
Story image
Firewall
Fortinet unveils compact firewall for hyperscale data centres, 5G networks
"Fortinet’s dedication to pushing the boundaries of what is possible in security performance has yielded the most powerful compact firewall yet."
Story image
Enterprise
Fortinet reports second quarter 2022 financial results
“We delivered strong revenue and billings growth in the second quarter driven by an increase in the number of transactions larger than one million dollars."
Story image
Mergers and Acquisitions
Netskope acquires Infiot, delivers integrated SASE platform
Converged SASE platform provides AI-driven zero trust security and simplified, optimised connectivity to any network location or device, including IoT.
Story image
SaaS
Why is MACH architecture a new big thing in the tech world?
More and more global enterprises are considering replacing the monolithic tech stack with the best-of-breed composable stack that enables greater business agility.
Story image
Cloud
TBC Bank decreases time to market for new offerings by 40%
TBC Bank has reduced time to market for new and enhanced products and services by 40% since implementing Kong Enterprise, the cloud native API platform. 
Story image
Data
NOVATION releases cloud-based solution to maximise value of data
NOVATION has announced the release of DataVio, its cloud-based solution for helping businesses automate the processing and extraction of data.
Story image
SAP
OutSystems joins SAP PartnerEdge program, integrates solutions
OutSystems has become an official member of the SAP PartnerEdge program. This will make it easier for other businesses within the SAP ecosystem to discover and connect with OutSystems.
Story image
Internet of Things
AI-Link chooses Keysight offering to validate 5G performance
AI-Link has chosen Keysight Technologies' 5G test tools for end-to-end performance validation of cloud-native 5G radio access network (RAN) equipment.
Story image
Digital Transformation
Government needs content services aligned for better customer experience
Organisations across all industries in the private sector have made significant progress in digital transformation. The public sector, however, has not always kept up with the pace.
Story image
10 Minute IT Jams
Video: 10 Minute IT Jams - An update from Incode Technologies
Jonathan Andresen joins us today to discuss the identification and authentication solutions offered by Incode.
Story image
Apps
Freshworks integrates with Google's Business Messages
"The integration with Freshworks makes it fast and easy for businesses to have conversations with their customers within the Google apps."
Story image
CRM
Forrester names Pega a Leader in CRM Solutions 2022 report
Forrester Research has named Pega a Leader among 11 competitors in The Forrester Wave: Core CRM Solutions, Q3 2022 report.
AWS Marketplace
Watch this webinar to gain building blocks for data mesh, and how AWS customers today are successfully enabling domain driven data.
Link image
AWS Marketplace
See how managed security services (MSS) have evolved to Managed Detection and Response (MDR) and Extended Detection and Response (XDR). Learn how these new holistic solutions can simplify security management and improve your threat detection and response.
Link image
Story image
Appointments
Tech job moves - Checkmarx, Kinly, Syniti, Trellix & WalkMe
We round up all job appointments from July 22-28, 2022, in one place to keep you updated with the latest from across the tech industries.
Story image
API
Security gaps in APIs plague organisations - study
Together, the findings highlight that existing solutions and API security tactics focused on shift-left strategies are failing to adequately protect APIs.
Story image
Infrastructure
New developments for cable set to connect South America to APAC and Oceania
Further proposals have been issued to begin construction of the almost 15,000 km subsea Humboldt Cable cable, which connects South America to APAC and Oceania.
Story image
Radware
Good or bad - answer these questions to check application visibility
With the adoption of the hybrid cloud, applications now run in multiple private and public cloud environments managed by different teams and tools.
Story image
Healthcare
Why the Metaverse could be the key to enhancing the healthcare sector
The experts at Accenture understand that the programmable world is about building the next version of the physical world in healthcare, understanding complex layers in order to fully utilise technology to its maximum effect.
Story image
Indusface
Why enhancing bot protection for web and API endpoints matters
The trouble with bots is that they aren’t all bad. Unfortunately, this can make it challenging to detect malicious bots that find their way into your system and threaten your business.
Story image
SaaS
Viavi updates Observer platform to simplify cloud monitoring
Version 18.8 simplifies cloud monitoring with data centre-like visibility, bringing two key capabilities to cloud-based applications and deployments.
Story image
Product Management
TeamViewer and Siemens to innovate product lifecycle space with AR
TeamViewer's new partnership with Siemens Digital Industries Software to bring the power of TeamViewer's AR platform, Frontline, to Siemen Teamcenter software.
Story image
Compliance
Why security needs to shape your journey to the cloud
It's estimated that 80% of workloads could be in the cloud in the next few years. How can you make all that data secure?
Story image
Ransomware
Majority of execs in SEA anticipate ransomware attacks
Kaspersky's study uncovers that more than half believe a ransomware attack against their business is too small to worry about.
Story image
Cybersecurity
FirstWave responds to SMB demand for better cybersecurity
FirstWave developed the CyberCision Open Security Management Platform to respond to SMBs 'urgent' need for comprehensive cyber protection.
Story image
Hybrid Cloud
The essential guide to digital transformation by SolarWinds
Digital transformation is a buzzword thrown around all the time by companies, but what does it actually mean and why is it important? SolarWinds breaks it down.
Story image
Remote Working
Four-day week: Perceptions across Asia Pacific and Japan
Workers across APJ want to be empowered to do their best work, wherever and whenever they want.
AWS Marketplace
Learn how security orchestration, automation, and response (SOAR) enhances your security strategy.
Link image
Story image
Data
Hazelcast launches beta release of new serverless offering
Hazelcast Viridian Serverless speeds up app development, simplifies provisioning, and enables integration of real-time data into applications.
Story image
SaaS
ManageEngine unveils SaaS availability of Analytics Plus
ManageEngine's Analytics Plus is now available as a software as a service (SaaS) offering, enabling users to set up a completely functional and integrated analytics platform anywhere in under a minute.
Story image
Data Protection
CyberRes partners with Google Cloud in lead up to BigQuery release
CyberRes, a Micro Focus line of business, has announced a partnership with Google Cloud to support the upcoming release of BigQuery remote functions.
Story image
Ransomware
Ivanti and SentinelOne partner on patch management solution
Ivanti and SentinelOne will integrate their technologies Ivanti Neurons for Patch Management and SentinelOne's Singularity XDR platform.
Story image
SAP
Microsoft unveils two new security products to help reduce attack surfaces
The products are set to give companies deeper insights into threat actor activity and help them successfully navigate the changing threat landscape.
Story image
Healthcare
SOTI research explores professional's thoughts on digitisation in the healthcare sector
Interconnectivity, automation and data management were the three key trends highlighted in the report as integral parts of successful medical technology implementation.
Story image
Partnership
NCS, FPT Software launch Strategic Delivery Centre in Vietnam
The new partnership is designed to support increasing demand for high quality digital services across the region.
Story image
Data Centre Maintenance / Management
Vertiv releases update to Smart InfraSight platform
Vertiv has unveiled an update to its Smart InfraSight data centre management platform, featuring improved intelligence and the ability to manage multiple IT devices.
Story image
SaaS
OpenText launches new solutions on Salesforce AppExchange
Included in this latest launch is OpenText Core Content, a Content Services platform that customers can leverage to effectively manage their content.
Story image
Robotic Process Automation / RPA
Gartner anticipates RPA software revenue of US$2.9 billion
Gartner predicts global robotic process automation (RPA) software revenue to reach US$2.9 billion in 2022, an increase of 19.5% from 2021.
Story image
Cybersecurity
Qualys develops EASM capabilities for Cloud Platform
"Qualys unique approach to EASM is integrating the internal and external asset data from CyberSecurity Attack Management with its VMDR solution into a single view."
Story image
Cybersecurity
More than a fifth of cybersecurity teams ban the use of public WiFi
Verizon’s fifth annual Mobile Security Index report has revealed a continued rise in significant cyberattacks in the last year involving a mobile/IoT device.