The rise of cybercriminal networks, growing importance of data protection, and the integration of emerging technologies like Generative AI are reshaping business continuity and cyber resilience strategies.
How should organisations in APAC prepare their cybersecurity strategies to be more resilient? In a conversation with iTNews Asia, Jeremy Pizzala, EY Asia-Pacific Cybersecurity Consulting Leader, we learn about how cyberthreats are evolving and delve into the pressing challenges facing organisations today – ranging from sophisticated ransomware attacks to the convergence of cyber and physical threats in critical industries like utilities, manufacturing, and energy.
Pizzala emphasises the need for a proactive, risk-based approach in managing cybersecurity especially when it comes to third-party risk and ensuring that business continuity plans are tested in realistic, scenario-driven exercises.
iTNews Asia: What are the most pressing cybersecurity threats you’re seeing in the Asia-Pacific region today, especially in the context of business continuity and digital transformation?
Pizzala: The biggest challenge in cybersecurity today is the increasing sophistication and audacity of threat actors. These attackers are becoming more effective in their tactics, techniques, and procedures, making it harder for cyber defenders to keep up. The resources available to defend against these threats, including budgets and skilled labour, don’t always match the growing scale of the risk. In regions like Asia-Pacific, there is a shortage of cybersecurity professionals, and it takes time to build robust defenses, as organisations need to go through lengthy processes like funding, design, development, and testing.
Meanwhile, cybercriminals, particularly those in ransomware, operate like businesses, often in an industrialised, 24/7 manner. They leverage the dark web to offer ransomware as a service, allowing anyone to easily buy and execute attacks. These actors are also constantly developing zero-day exploits – new vulnerabilities with no prior defense – forcing defenders to scramble to keep up. Ransomware continues to be a significant threat, with many successful attacks going unreported due to concerns over branding and commercial damage. It is increasingly executed through social engineering, phishing, and other sophisticated attack methods.
iTNews Asia: In your experience, what are the biggest gaps organisations face in ensuring that their business continuity plans account for cybersecurity risks?
Pizzala: Organisations need to focus on identifying their most critical assets – those at the highest risk and that they care about the most rather than trying to protect everything or plan for recovery across the entire organisation.
For example, a manufacturer should prioritise protecting and recovering production and plant equipment. The process begins with risk and threat assessments to understand what assets are at risk and how potential attackers might target them. Once this is clear, more targeted and practical defense measures can be put in place and continuously tested, using threat intelligence to stay ahead of evolving threats.
Another key point is ensuring that recovery and incident response plans are regularly tested, not just sitting unused. Organisations need to test their plans frequently, ideally in realistic, scenario-based exercises, to ensure they are prepared when an attack occurs. This is an area that many organisations still overlook.
iTNews Asia: What does an effective cyber resilience strategy look like in today’s volatile business environment? How should organisations reframe their business continuity plans to ensure they are resilient against modern threats?
Pizzala: One of the main targets for threat actors, especially in ransomware attacks, is data. They often steal or encrypt data to hold it hostage for ransom. This makes backing up data a critical concern. However, simply backing up data isn’t enough – you must ensure that backup data is secure and free from malware. If backups are compromised, their value is diminished. A good strategy to safeguard backups is air-gapping, making sure they are immutable and isolated, so they can be used for recovery if production data is locked or stolen.
In addition to data, it’s also crucial for organisations to understand their key operational processes. These are the processes that are essential to the business’s core mission and must be resilient and redundant enough to withstand attacks, ensuring the organisation can continue to function even under pressure.
iTNews Asia: What should businesses prioritise when creating or updating a business continuity strategy to account for cyber threats and disruptions – people, process, or technology?
Pizzala: People are both the strongest and weakest link in combating cyber threats. As the weakest link, employees can easily fall victim to phishing attacks or use simple, insecure passwords, making it easier for attackers to gain access. On the other hand, people are also the strongest link when they are well-trained and aware of cyber risks. Educating employees on identifying threats, especially phishing emails, is key. Some organisations even use internal phishing tests as part of performance metrics, holding employees accountable for failing too many times.
Beyond phishing, a more cyber-aware workforce is essential because new attack vectors are always emerging. A healthy skepticism about online activities, both internal and external, can help prevent breaches.
While technology, such as automation in security response, plays an important role, people remain crucial in the fight against cyber threats. Even with strong technology, weak human factors can undermine security efforts.
– Jeremy Pizzala, Asia-Pacific Cybersecurity Consulting Leader, EY
iTNews Asia: How can businesses test the effectiveness of their cyber resilience and business continuity plans through realistic simulations or incident response exercises?
Pizzala: Effective incident response begins with strong leadership from the board, ensuring there’s a comprehensive plan in place that involves not just IT but the entire organisation – executives, legal, HR, investor relations, marketing, and various business units. Too often, incident response plans focus too much on technology, neglecting the broader enterprise impact. Regular simulations, like desktop exercises, can highlight gaps in understanding, showing how stakeholders need to interact during a crisis. More advanced exercises, such as cyber attack simulations (e.g., ransomware scenarios), can be used to test responses in a more realistic, evolving environment, often revealing weaknesses in coordination and reaction.
Industries like financial services already conduct sophisticated red teaming exercises, often required by regulations (e.g., Hong Kong’s ICAST or the UK’s CBEST), which involve simulated attacks through methods like social engineering or brute-force network breaches. These realistic tests help organisations evaluate their defenses and response capabilities.
Simulations should be conducted at least annually, though the frequency depends on the industry and regulations, such as the upcoming Digital Operational Resilience Act (DORA) in the EU, which will provide guidelines starting in 2025. Ultimately, the frequency of these tests should align with an organisation’s risk appetite, which can vary. It’s not a one-size-fits-all approach; organisations should tailor the timing of simulations to their specific risk tolerance.
iTNews Asia: How can businesses incorporate third-party risk management into their business continuity and cybersecurity strategies?
Pizzala: The focus on third-party risk has grown significantly over the past decade, initially driven by the financial services sector and now spreading across industries. While many organisations assess third-party security annually using questionnaires, this approach is static and limited to a single point in time. More advanced organisations are adopting continuous cyber risk assessments, with quarterly reviews, immediate reporting of incidents, and even conducting their own penetration testing on third parties.
It’s also crucial to understand the operational risk posed by third parties. For example, if a third-party cloud provider experiences an attack or IT failure, it can have catastrophic consequences on the organisation’s operations. To mitigate this, businesses need to have well-tested failover plans and alternative providers in place.
As third-party integration deepens, especially in the digital ecosystem, cybersecurity must include monitoring threats to third parties, as attackers often exploit these relationships. A growing tactic involves targeting IT staff at third-party providers, bribing them to gain access to sensitive data from downstream customers, like intellectual property. This trend highlights the importance of securing third-party relationships, as they can act as a gateway for cyberattacks.
iTNews Asia: How should businesses in the Asia-Pacific region adapt their cybersecurity and business continuity frameworks to ensure they meet both local and international compliance requirements?
Pizzala: In the APAC region, where multiple jurisdictions and regulatory requirements exist, the key is adopting an 80/20 approach. If you implement a solid, risk-based cybersecurity strategy from the ground up, addressing all areas like identity management, threat management, and data privacy, you’re likely already 80 percent compliant with most regulations. However, if you take a minimal, top-down approach, you’ll need to spend more time and money to meet stringent regulations quickly.
For organisations operating across multiple jurisdictions, this 80/20 rule still applies. If you’re compliant in one country, you’re likely 80 percent compliant in another, with only minor adjustments needed to meet specific local requirements. Most regulations are based on global standards like COBIT and ISO, so jurisdictions often align with each other. Doing the groundwork upfront pays off in terms of ease and efficiency when it comes to meeting compliance across different regions.
iTNews Asia: How do you advise organisations to strike a balance between investing in immediate cybersecurity defense measures versus longer-term business continuity investments?
Pizzala: Cybersecurity and recovery should complement each other. While it’s better to prevent attacks than to recover from them, organisations should take a risk-based approach, such as Cyber Risk Quantification (CRQ). This involves assigning a dollar value to assets and identifying which ones are most critical. For instance, in a manufacturing setting, the production control systems would likely be high-risk assets, and organisations should invest the most in protecting and recovering them.
Rather than trying to protect or recover everything equally, focus on the most important assets. For critical systems like production controls, consider isolating them through network segmentation or a zero-trust approach, ensuring they are on a separate domain with secure, controlled access. This helps prioritise resources effectively and strengthens resilience.
iTNews Asia: How will the rise of “cyber-physical” threats (attacks targeting both digital and physical infrastructure) impact future business continuity planning, and what should organisations do to prepare for this convergence?
Pizzala: In sectors like utilities, mining, energy, and manufacturing, there’s a growing risk of cyberattacks targeting physical assets, like oil and gas pipelines, often exploiting vulnerabilities in IoT devices. Many of these critical systems are now connected to the Internet, which creates points of weakness where physical assets meet digital networks. To address this, organizations need to conduct a thorough risk assessment, identifying the most vulnerable areas and focusing their resources on securing them.
One key strategy is to isolate operational technology (OT) from information technology (IT), which is something many in critical industries like energy are already implementing. However, as digital and physical systems converge, this isolation becomes more challenging. Given that these industries are essential to national infrastructure, the combined threat of both physical and cyberattacks is a serious concern that needs attention.
iTNews Asia: What are some examples of innovative cybersecurity solutions or approaches that have emerged recently, and how are they helping businesses tackle their toughest security challenges?
Pizzala: Generative AI (Gen AI) has great potential in cyber defense, though it’s still in the early stages of adoption as organisations experiment with integrating it into their broader security strategies. One key area where Gen AI can help is in the Security Operations Center (SOC), particularly in first-line incident response. Gen AI can quickly provide answers to questions about threats, like identifying malware, suggesting responses, and helping triage incidents, significantly reducing response times from hours to minutes. It can also assist in documenting all actions taken during an incident, freeing up defenders to focus on other tasks.
Another valuable use is in automating threat hunting, where Gen AI can scan for malware or other threats in the network and alert defenders. Moving beyond Gen AI, traditional AI, especially machine learning (ML), is useful for anomaly detection. ML algorithms can identify abnormal behaviours – such as an employee logging in at unusual times or from different locations – by comparing current activity to established patterns. This allows for faster detection and response to potential threats. Overall, both Gen AI and AI-driven machine learning have significant potential to enhance cybersecurity operations.
link
