Author: Dr. Philip Cao

When the general public thinks about today’s exciting technological breakthroughs, the imagery that springs to mind is unlikely to be a crowded pigpen in China or yam fields in the farmland of Nigeria. Yet, rural areas are the frontlines for some of the most important gains technology is enabling in modern society. The growing imprint of technology-driven advancements on the agriculture industry and in rural areas, generally, is one of the tech field’s most promising success stories.

Digital transformation is making its mark on the agriculture industry, with the Internet of Things, blockchain, robotics and drones among the technological forces that are helping to offset modern obstacles with which previous generations of farmers did not have to overcome. In the not-so-distant-past, farmers fretted about the weather, pests and their equipment – and that was about it. Today’s farmers must contend with a range of more sophisticated challenges, such as market volatility, international trade friction, serious labor shortages, borrowing costs and capital availability, and an increasingly complex regulatory environment.

Amid these challenges, in an industry known for razor-thin margins between success and failure, enabling even a 5% increase in yield can make a dramatic difference. Technological innovation increasingly is the path to swinging that equation in farmers’ favor by equipping them with an expanded set of solutions to their challenges. At the same time, for these innovations to serve their important purpose, it is imperative for security professionals to support suppliers’ and distributors’ assurance that these technologies are being deployed safely and securely throughout the supply chain.

Technology enabling a global bounty
The recent Forbes AgTech Summit underscored how key industry advancements – such as more reliable pathogen detection, autonomous wheelbarrows and analytics software that allows farmers to more accurately predict crop conditions – are capable of improving profitability for farmers and providing a more robust global bounty that will be increasingly critical as population growth, climate change and soil degradation put strain on the world’s food supply.

Much of the technological progress that is recalibrating the way food is being grown and distributed is attributable to automation. The implications of automation can cut in both directions, often driving improved business outcomes while, in some cases, imperiling job security for current workers. The net impact of automation, though, tilts heavily in a favorable direction when it comes to the agriculture industry. In many countries, including the United States, agriculture workers are in short supply, not because automation has put them out of work, but because of a range of factors that include urbanization and more stringent enforcement of immigration laws. Automation is a potent force in counteracting that labor shortage, producing driver-less tractors and more efficiently planting and harvesting to maintain productivity and prevent wasting crops while people around the world go hungry.

It is not just automation that is serving as a new catalyst for farmers and food producers; a variety of emerging technologies are modernizing business models in rural areas around the world. From a Chinese tech giant deploying AI-powered pig-tracking systems, to a growing number of blockchain implementations that will allow food to be tracked globally throughout the supply chain, more efficiently addressing customer risk, it is encouraging to see technology deployed so creatively in an industry that affects all of us on a daily basis.

The ability to more effectively address food security is especially notable, with blockchain and IoT technology allowing inspectors and consumers to become aware of potential hazards in more timely fashion and avert potential health crises. Dubai has shown leadership in this regard, moving to put in place a food monitoring system that will make its reported $200 billion of annual food imports safer and more secure for its residents.

Life-saving health measures
Agriculture is not the only cornerstone of rural life that is being enhanced by technological innovation. Medical drones in Africa deliver life-saving supplies that are not readily available in local clinics, such as blood, medicine and emergency vaccines. In China this year, a logistics firm initiated delivery of goods to sparsely populated areas that will rely on larger drones transporting products to warehouses and smaller drones connecting rural residents with final deliveries. As with all technological innovations, organizations must deploy the needed safeguards and controls to keep pace with the deployment of these new technologies, with drones in particular posing several legal and security considerations. Organizations must determine their appetite for added risks and liabilities introduced by a drone program, as well as how to meet the related compliance requirements on an ongoing basis.

Undeniably, however, these are significant opportunities for residents of rural areas that would not have been possible as recently as five years ago. Even as global population trends reflect increasing urbanization, the capabilities that are being developed will ensure farmers and rural residents stand to benefit from technological innovations that are taking root every bit as much as city-dwellers. As digital transformation spreads beyond our urban hubs to rural fields throughout the globe, it us up to the security community to perform the due diligence necessary to enable these advancements to truly blossom.

Editor’s note: This article originally published in CSO.

Matt Loeb, CGEIT, CAE, FASAE, Chief Executive Officer, ISACA

[ISACA Now Blog]

The fluid technology and regulatory landscape calls on IT compliance professionals to be more flexible and proactive than in the past to remain effective, according to Ralph Villanueva’s session on “How to Design and Implement an Adaptive IT Compliance Function,” Monday at the 2018 GRC Conference in Nashville, Tennessee, USA.

The IT compliance function serves as an important bridge between the audit and IT departments, in addition to articulating business-related IT and security initiatives to management, and recommending and implementing appropriate compliance frameworks.

Business model changes, legal considerations, government requirements and evolving industry regulations are among the common reasons that organizations may need to more frequently explore switching their frameworks than in the past. Villanueva, IT security and compliance analyst with Diamond Resorts, referenced the General Data Protection Regulation (GDPR), which became enforceable in May, as an example of a recent regulatory shift that could have significant compliance ramifications. Additionally, he cited industries such as banking, healthcare and gaming as having special requirements calling for the use of compliance frameworks.

While acknowledging that the need to explore new or additional frameworks can cause “compliance anxiety” and organizational resistance, considering the corresponding investments in time and resources, Villanueva said effective use of people, processes and technology can make the process worthwhile in the long-run. Given the increasing need to implement different frameworks to deal with a growing set of compliance complexities, Villanueva laid out five steps to be actively compliant across several frameworks while remaining in line with budget realities:

1. Understanding beats memorizing. Compliance professionals who truly understand the intent of the framework are best positioned to adapt them to their organizations.
2. Know your organization. Having a clear handle on the organization’s business model, mission and array of information and technology resources allows for more strategic compliance.
3. Anticipate how today’s trends will influence what you do tomorrow. Variables such as the need to incorporate more mobile device security and use of emerging technologies such as artificial intelligence (AI) and machine learning may call for recalibrating compliance processes.
4. Know that some fundamentals never change. Despite the volatile landscape, Villanueva said there still needs to be focus on established compliance priorities such as application controls and segregation of duties.
5. Keep learning. Investing in personal development and prioritizing networking are some of the best ways to keep current and “future-proof” career paths.

Villanueva cited COBIT 5, NIST 800-53, ISO 27001:2013 and PCI-DSS 3.2 as examples of useful frameworks for compliance professionals, and said identifying commonalities among different frameworks can make for a more efficient approach. Villanueva recommended IT compliance frameworks because they:

• Simplify compliance;
• Reduce the likelihood of missing compliance requirements;
• Maximize everyone’s time;
• Allow for clearly understood expectations;
• Are commonly accepted by control stakeholders.

The importance of compliance professionals should not be overlooked. Aside from potential legal ramifications resulting from inadequate compliance, Villanueva said having strong compliance programs in place is critical to deter corruption and costly illegalities.

“We’re here to make sure that crime doesn’t pay,” Villanueva said.

[ISACA Now Blog]

Recent surveys and studies have emerged that show interest in cybersecurity as a potential career field at uncomfortable lows. In fact, a recent ProtectWise report showed that only 9 percent of millennials indicate cybersecurity is a career they are interested in pursuing at some point in their lives. This disturbing finding has far-reaching potential consequences in a field that desperately needs a stronger workforce.

To understand these findings, the study posits several factors that could be to blame for the low level of interest, from lack of exposure to cybersecurity in school curricula, to lack of personal connections, such as relatives, in the relatively new field of cybersecurity. However, another element, often hushed, and rarely acknowledged, lurks throughout the field’s perception – lack of fun. Sadly, many people don’t consider cybersecurity as a “fun” field – and that’s a false assumption, as there are multiple elements that make cybersecurity an enjoyable career path. Considering the level of engagement cybersecurity professionals enjoy, the evolving nature of the profession, its constant relevance, growth rate, and pay, cybersecurity can be a fun field, as long as individuals give it a chance.

One of the most enjoyable aspects of cybersecurity is the level of engagement it requires of an individual. Many jobs are comprised of the day-to-day grind of waking up, performing the same task several times, eating lunch, performing the same task, and going home. Little-to-no engagement occurs in these job roles, resulting in a bored and ineffective workforce. However, cybersecurity is quite the opposite. As seen in several reports, including ISACA’s 2018 State of Cybersecurity research, cyber-attacks are constant and growing in frequency. As a result, many incident responders and cyber teams find themselves immersed in their job, engaged in the dissection, analysis, and evaluation of attacks to better protect their organization. Oftentimes, this takes the full attention of these individuals, who lose track of time and realize they’ve been actively engaged in their work all day, resulting in very little boredom.

These growing attacks also are constantly evolving. Many of the day-to-day attacks against an organization vary in shape, size, and composition, and require an engaged workforce to actively combat them. These individuals act as live guardians in a digital world, identifying each potential attacker and assailant by cross-referencing them against previous attacks and exploitation. Oftentimes, this can be the hardest part of the job, as attack mechanisms such as worms and viruses are like hydras, with two different variants appearing once one variant is killed. In fact, one such type of attack, a polymorphic virus, makes slightly different copies of itself each time it infects a system in an effort to throw scanners off of its trail. Hunting these changing malicious codes and actors often brings a smile to the face of cyber professionals, as each time an attack changes and the responder stops it, the responder becomes that much stronger and more experienced.

These constant attacks also contribute to another element that makes cybersecurity fun: its relevance.  Since new attacks and attack vectors are always emerging, cybersecurity professionals must stay up to date on all the potential exploitations that are discovered to meet their responsibilities of protecting the business operations of an organization. This, in turn, makes cybersecurity professionals incredibly relevant to the business and the field overall. Relevance in an organization oftentimes translates to respect and recognition. This is reinforced by the rise of the CISO and CIO roles in Fortune 500 companies. No longer are these individuals relegated to the back row by other executives; instead, they are more commonly brought to board of directors meetings to discuss the organization’s security stance.

While the relevance of the cybersecurity field is important, it does not amount to much if there is nobody to staff the workforce. As seen in the 2018 State of Cybersecurity research, there are not nearly enough cybersecurity professionals in the field to keep up with the explosive growth and need. As a result, cybersecurity professionals are valuable diamonds to be cherished and cultivated within the organization. Thanks to this growth, cybersecurity professionals enjoy the fruits of a seller’s market – and that can be pretty fun.

Finally, something which all millennials should consider as they chart their future careers: pay.  Everybody wants a career that will pay well, and cybersecurity offers that opportunity. The Robert Walters Salary Survey of 2018 indicated that cybersecurity pay will rise by an additional 7 percent around the world in 2018, outpacing all information technology roles, which on average will see about a 2 percent increase. Although having an engaging, evolving, relevant job in a growing field is fun, knowing that it pays well is another cause to smile.

Everyone is different and defines job fulfillment through their own personal lens. However, if finding a job enjoyable, engaging, and fun is a top priority, it’s worth considering cybersecurity as a potential career. On the outside, it may seem bland, but taking a closer look reveals that working in cybersecurity can be much more fun than most people think.

Editor’s note: For more of Frank Downs’ thoughts on the fun side of cybersecurity and relevant industry trends, listen to the recent ISACA Podcast, The State of Cybersecurity.

Frank Downs, Director and SME, ISACA Cyber Security Practice

[ISACA Now Blog]