Posted by anna.vlasenko on 20 December 2022 04:49 PM
Back in September Indeed Identity team participated in IDC Summit in Turkey as a silver sponsor together with our partners vMind. After that we met with Volkan Duman, vMind General Manager, to review the main topics that were discussed during the event and the state of the information security market in Turkey, the main trends of the outgoing year and the expected course of things in 2023.
What is your overall impression of the IDC Summit this year? What do you think was the main focus of this event this year?
Speakers and valuable panelists who shape the industry with their knowledge and experience took part in the event, in which many information technology managers from Turkey’s leading public and private sector institutions participated. In the event, which was held with the main theme of “360 Degree Security for a Strong Security Posture”, new technologies that make life easier and solutions to security problems brought by these technologies were revealed from different perspectives.
Due to the development of technology, the increase in sensitive data and the vital importance of data security, the opinion that large and medium-sized companies are actually technology companies, even though they are in different sectors, was an important finding. For this reason, it was an emphasis that should be taken into account that companies of this scale should accept this and plan their investments with this perspective. Another prominent information technology security topic at the event was that if companies host sensitive data and provide services with critical systems, attackers will always be at their target. We can say that it was an informative event that shaped the present and the future, informing the participants about the need to increase the security of access to sensitive data and critical resources, and to raise end-user and endpoint security to the next level in order to avoid financial losses, and most importantly, reputation losses.
It was very valuable for us, vMind, to be involved in this together with our solution partner Indeed Identity, as such events contribute to our understanding of the concerns, expectations and needs of the sector and help us see more clearly the focal points for the solutions and services we provide.
What should be a focus for the IT security market from your point of view? What is the situation with cybersecurity technologies in Turkey right now?
Turkey appears to be exposed to an increasing wave of cybercrime: – Turkey ranks 9th among the 20 most attacked countries in the world in terms of the number of cybercrimes committed – Turkey experiences about 3 percent of the global total in the context of malicious computer activity – In terms of malicious code, it is ranked 15th – It ranks 12th in the country where the attacks originated – Zombie is 5th in spam – Phishing websites are also ranked 24th in their servers – Ranked 8th in terms of distributed denial of service attacks
This data shows that Turkey is under threat at a level that should be taken seriously in the context of cyber-attacks.
Cyber-attacks can be carried out for economic reasons, but they can also directly or indirectly target people’s lives and social lives. Therefore, no matter what structure is the target of the attack, large masses can be affected by the result. The service mechanisms of the states may be shaken, and perhaps most importantly, the existence of individuals or legal entities may end and there can be both material or moral impact of the attack. For all these reasons, it would not be wrong to say that cyberspace has become a battleground today and it is imperative that all structures, especially states, that make up the society – real or legal – fortify the cyber security lines.
In order to ensure security in the cyber field, first of all, areas of vulnerability should be evaluated differently. It is clear that private enterprises operating in this field should work with stakeholders such as universities and non-governmental organizations, and it is necessary to carry out policy studies in coordination with these organizations to ensure cyber security by operating a culture of consultation. In addition, these studies should be continuous.
Institutions responsible for the implementation of policies in the cyber field have been established. The establishment of dedicated institutions has accelerated policymaking efforts, enriched its legislation on the Internet, and improved our capabilities. In general, these institutions focused on the security and legal aspects of cyber security and left the cyber war dimension to the Turkish army. On the other hand, our research and development institutions such as Tubitak, Havelsan and Aselsan work on the development of reliable domestic software and hardware in all aspects of the Turkish cyber security architecture and continue to operate in close relations with the army. In fact, the performance of state-supported private companies in the modernization efforts it has recently carried out to improve its military capabilities has, in a sense, moved Turkey into a new era.
Private companies in Turkey are also supported by the state with incentives. It focuses on the localization of existing cyber security measures. Thus, an attempt is made to develop an information and technology transfer pyramid model with private initiatives at the base, state-sponsored defense companies at the middle level, and public institutions at the top.
Due to the multifaceted nature of cyber-attacks, it has become important to learn and apply the attack techniques practically by the organizations in charge of cyber security. Turkey generally bases its strategy studies on defense. However, with the experience we have gained from conventional wars, we are aware of the fact that it is very difficult to be successful in wars only with defense strategies, and we are aware of the importance of cyber-attack and cyber intelligence, and investments in this direction are continuing.
What is the biggest challenge for companies that want to have resilient IT security?
It is possible to say that information security is one of the most valuable power elements today. With the rapid development of information and communication technologies, it has become possible to store, transport and process more information. Information and technology are considered as an important power factor and as a more important resource than human, material and finance. With the help of technological products, more and more information and documents are transferred to databases, stored there, analyzed and used every day. In fact, this information is easily transferred from one place to another when necessary. These systems contribute to both the quality of the services provided and the more efficient operation of the relevant institution/organization. Information and data, which are under the responsibility of institutions and organizations, need to be protected with full security, and ensuring the security of these systems is also of great importance in terms of national security.
Today there are threats such as malware, phishing, targeted attacks, botnet and etc. Therefore, if the security of the systems mentioned above is not ensured, there may be situations such as national security risks, loss of life, disruption of public order, systems out of service and loss of reputation in terms of countries and institutions.
In addition to the significant increase in the need for qualified personnel in the IT sector, when IT security is at such a critical point the rapid change in the demand for special skills, leading to a shortening of the shelf life of the skills, creates serious problems. Successfully adapting to the disruptions caused by technological developments requires relearning old technologies and practices, and learning new ones. The biggest challenge for companies that need flexible IT security will be access to this competent and constantly learning, adaptable resource.
Is there a growing interest towards PAM solutions on the market?
We can definitely say that interest in PAM solutions has increased in recent years in order to ensure access security and increase visibility. A recent research shows that 33% of participants plan to invest in a PAM solution in the next 1-2 years. With the development of technology, much data has been digitized and systems containing sensitive data have increased considerably. Now almost every system can work online. This creates an easily accessible environment for attackers and malicious people to disclose sensitive data and damage critical systems for their own benefit. Research shows that critical data leaks are mostly caused by the seizure of authorized user accounts. This situation actually causes companies to realize this and turn to PAM solutions to secure authorized access.
What is the most common approach to PAM implementation in Turkey?
In the past, companies thought that PAM solutions could only be accessed by large companies. There was also the prevailing opinion that the installation and management of the PAM solution was difficult. This situation has changed with the introduction of new products and the availability of these products to companies of all sizes. Now companies of all sizes have easy access to PAM products, and the installation and management of these products has become more user-friendly, attracting more attention from companies. Of course, the price factor still plays a role at some point, but companies have started to see that now, an expensive product does not mean the best product. Companies prefer the product that they know can solve their problems in the easiest way and be integrated seamlessly into their systems.
What approach do you recommend?
In vMind we know that as long as a company hosts sensitive data and manages critical systems, it will be the target. We recommend the “Zero Trust” approach. Companies need to protect sensitive data and systems in order to be protected from attacks and to minimize financial risks and reputational losses. Through PAM implementation, that is authorized access security products, companies take our security level to the next level.
Companies should consider these products not as an expense but as an investment because we are talking about a service and solution that will both increase a security level and reduce the burden on Information Technologies and Security teams. Every user who accesses critical systems and sensitive data is an authorized user for us and it must be verified whether such users are truly authorized people. Implementation of Zero Trust approach can provide visibility in accesses, another gain is the ability to be aware of some security problems that would not be noticed before.
What do you think will be the most important focus for the companies in Turkey in terms of IT security next year?
Companies doing business in Turkey will focus on vulnerabilities that may lead to disruption of public order which can cause loss of life, prestige, large-scale economic damage, national security when the confidentiality, integrity or accessibility of the information/data they process is disrupted.
Government will focus on Critical Utilities, Transport, Energy, Banking and Finance, Water Management and Electronic Communications.
In the National Strategy document prepared in line with the 2020-2023 National Cyber Security Strategy and Action Plan, the following 8 objectives were shared with the public:
– Protecting Critical Infrastructures and Increasing Strength – Developing National Capacity – Organic Cyber Security Network – Security of New Generation Technologies – Fighting Cybercrime – Developing International Cooperation – Increasing the subject expert resource
