Leadership development looks different depending on where you sit at DataBank. In construction, a mistake shows up in steel and concrete or on a deadline that will not move. In security, a mistake shows up in trust, in the confidential information customers hand over the moment they sign a contract. Different stakes, different daily pressures, and we feel both every day.
A few convictions show up again and again, whichever side of the business you’re on. In this article, we bring together perspectives from both sides to share the strategies and best practices that hold up across DataBank.
Prove It Before You Get the Title
The instinct in most organizations is to hand someone authority first and see what they do with it. We tend to run it the other way.
When a new team function grows from one person to four, and two candidates have equal standing, the answer is not a coin flip and it is not a title. It is six months of informal, shared leadership, with both people told plainly that one of them will end up running the group and the process itself will make it obvious who. Leading without authority is harder than leading with it, and asking someone to prove they can do the harder version first tends to produce a leader people actually want to follow, rather than one they are told to.
The same instinct shows up as patience elsewhere in the business. High potential is not something we spot in a single strong quarter. It takes time, and it takes more than one person’s opinion. A leader who is only impressing the person one level up, while treating peers poorly, is not showing high potential.
That’s something else entirely, and multiple perspectives are what surface the difference. Once a handful of people independently point to the same specific instances of strong judgment or capability, we consider that worth investing in. A gut feeling from one manager is not.
There is No One-Size-Fits-All Development Path
Most career ladders are built in fixed steps: analyst to manager to senior manager, in that order, whether or not the person climbing it actually wants what is waiting at the top. We start from a different question: what does this specific person want, and why?
That means pushing back gently when someone asks for the “logical next step.” Wanting authority is not, by itself, a reason to grant it. The better question is why someone wants the promotion in the first place. A strong individual contributor and a strong manager are frequently not the same skill set, and pushing someone into people-leadership because he or she excelled technically can be a set-up for failure.
It also means learning how each person actually receives feedback before delivering it. The same words, the same tone, land completely differently depending on who is hearing them. Two children raised in the same house, given the exact same sentence, can walk away with two different reactions.
A lot of that comes from raising many children (a total of seven from both executives), and a fair amount from Ted Lasso. Both taught us that you can’t lead everyone the same way and expect the same result. Knowing someone well enough to choose the right words is not a soft skill. It is what makes the rest of coaching possible.
Feedback Is a Question, not a Verdict
We don’t describe our harder conversations as confrontations. We describe them as questions and opportunities to learn and grow together.
Instead of opening with, “You did this wrong,” the more useful opening is, “Do you think we got the result we wanted?” That single question does two things at once: It tells us whether the gap was a skills problem or a communication problem, and it gives the other person room to arrive at the answer rather than defend against it.
One discovery we’ve made through exactly this kind of question is that a missed expectation isn’t always a performance issue. Sometimes it’s a failure to define what success looked like in the first place, which means the fix is a clearer conversation, not a disciplinary one.
Bad news doesn’t improve with time. If a piece of feedback is landing for the first time in a formal performance review, that review has already failed, which is a sign of poor leadership. The fix is small, frequent course correction, delivered as soon as the gap appears, framed around what support is needed rather than what went wrong.
Conflict itself isn’t the problem. Different perspectives are how we learn from each other. It only becomes a problem when it turns personal or chaotic, and that’s when a good leader steps in — not before.
Why the Stakes Shape the Approach
The two sides of our business feel this differently, and that difference is worth naming rather than smoothing over.
On the construction side, the pressure is external and immediate: a labor market stretched thin across general contractors and subcontractors, where people are routinely poached on compensation alone. Our counter to that isn’t matching every offer. It’s building loyalty that survives a competing offer, the kind where people choose to follow a leader they trust rather than stay for a transaction. Autonomy, real investment in someone’s goals, and a workplace people want to recommend to a friend all compound in a way a signing bonus doesn’t.
On the security side, the pressure is about trust. We hold information most people never see, and data centers themselves are increasingly viewed with suspicion by the communities around them. That makes integrity part of the leadership pipeline itself. Identifying high potential isn’t just about capability. It’s about whether someone will handle what they’re trusted with the way they say they will, in public and in private.
While the risks are different, the stakes are still the same: Will this person do right by what he has been given, whether that’s a team, a timeline, or a customer’s trust?
Different Hats, Same Habits
Strip away the hard hats and the security clearances, and the same three habits carry both sides of our business: earn the role before you’re handed it, build a development path around the individual instead of the ladder, and give feedback the moment it’s needed instead of saving it for a form. None of that is unique to data centers. What’s unique is how much is riding on getting it right, and it’s something we take seriously across the board.
Want to learn more about how DataBank’s leaders build and grow strong teams across the business? Visit our Leadership page or explore DataBank Digest for more insights on talent development and management strategies.
By Mark Houpt, Chief Information Security Officer, DataBank
Constant Changes Require Regular Policy Reviews
Change is constant in the world of IT. The same should hold true for your security policies. Any time your IT environment changes, it’s imperative to review your security policies practices before the IT changes. This will ensure that your IT systems are aligned with corporate and general best security practices that will curtail or prevent unwanted intrusions.
Perhaps, you plan to migrate from an on-premises architecture to a colocation scenario. You might also want to set up remote users or turn to a hybrid situation that includes public and private cloud platforms. No matter which changes you contemplate, it’s time to look at your security policies. The new architecture could impact your security posture and audits for regulatory requirements. You also need to know if your enterprise can still operate within the current policies or make the necessary changes that allow the business processes to function while protecting your data and digital assets. Assure that a gap analysis is part of a security assessment in which all the policies still work effectively inside the new environment. This environment may include another data center operator (colocation or managed services provider) handling some of the workload, while other functions may remain on premises or move to a cloud platform.
Determine the Impact of Moving Data
When infrastructure changes occur, companies may not understand the impact of the new environment and what they need to change with respect to security policies and data protection.
First, determine which regulations you are required to follow, such as PCI-DSS, HIPAA, and other privacy regulations. Then run an analysis, called a Business Impact Analysis (BIA), to determine the impact of moving data into the new environment. This includes considering what measures to implement to protect data to which the new colocation or cloud provider potentially has access.
You may determine, for example, that you want to use a different encryption level. If you are subject to HIPAA, you may need to have a Business Associate agreement that addresses the activities and responsibilities of your service provider partner. Be sure to look at the regulatory and business drivers as well as the requirements within your organization — legally and within business processes — that allow or disallow the use of the new environment. For example, data sovereignty, or the location of data, is an important factor in many regulations, especially those that are assigned by a State or the Federal Government.
Collaborate with Internal and External Resources
It’s a good idea to regularly connect and interface with partners with whom you share security responsibilities. This includes your auditors, vendors (and their subcontractors), and customers to find out how the new environment will affect their audits:
● Will it impact whether you pass audits?
● Will the cost or the length of time to complete audits increase?
● Does the changing environment impact the number of documents auditors will request?
● Is there a responsibilities matrix that defines which party is responsible for each aspect of the environment?
Also, collaborate with your internal business units as well. How will their processes and data be impacted when accessing systems inside the new environment? What’s the impact on the security postures of the environments in which they operate?
Perhaps, your most important allies are your colocation and cloud providers. This involves discussing their responsibility matrix, which influences how your security policies might need to change. The matrix outlines who is responsible for implementing, managing, and maintaining specific cybersecurity controls under the Cybersecurity Maturity Model Certification (CMMC) 2.0 program and the National Institute of Standards and Technology (NIST) SP 800-171 publication.
The provider may assume some of the security responsibilities for you, or it could put new responsibilities on your plate. For example, a colocation provider or a cloud provider will take on a portion of the physical security of the data center where the data resides. However, that doesn’t remove the security requirement from you totally; you still have people accessing that data on the back end.
It’s important to identify exactly what each provider delivers for security measures and what it claims are your responsibilities. Then check what the provider’s audits say and how they perform against those audits. Are there exceptions? Are there weaknesses that might create a vulnerability within your organization?
The Team Approach to Building Strong Security Policies
DataBank consults with many customers on our colocation environments and other environments to which our data centers connect. We clearly identify our security responsibilities and make our services easy to consume, taking the worry out of IT, as much as possible, within the security requirements. We also point out where the customer is responsible and where their cloud and SaaS providers are responsible.
In some cases, we participate in group calls with our customers and their other providers to understand where each party’s responsibilities begin and end. We offer our expertise and interact in a collaborative way to help all the parties in each customer’s ecosystem ensure the implementation of strong security policies.
This is helpful when discussing the transmission of data between colocation sites and a cloud platform. A colocation provider is not responsible for securing data transmissions. However, we recommend that our customers use AES-256 encryption or better for data at rest and in transit. If the cloud provider won’t handle the encryption, we can advise the customer how to configure the encryption.
Security Policy Recommendations for Government Data
In one case, we worked with an enterprise customer that handled federal government data. One of their on-premises data centers kept crashing, so they wanted to create a hybrid environment to share the workload.
To solve this challenge, we moved part of the infrastructure inside one of our colocation data centers, and the uptime increased. We also offered our expertise on the boundary line requirements. In addition, the customer valued our interpretation of the FedRAMP and FISMA requirements for handling data and maintaining the security of that data from physical and logical perspectives.
For customers not going through a change to their infrastructure, we still recommend reviewing and updating their security policies at least annually, even if just to confirm which systems are still active. In some cases, reviews should occur more frequently. For instance, enterprises should review artificial intelligence policies for security every quarter. The technology and the overall concepts change so rapidly.
When reviewing physical security policies, the concepts haven’t changed dramatically in years. You can validate the policy on an annual basis.
Developing a Security Policy Manual
Our information security policy standards manual update involves looking at all the regulations we need to comply with to determine which one is the most reasonable and the most stringent. We set our policies across the board at the most relevant and the most business applicable model and raise the bar when a regulation or situation dictates a higher control.
That’s because we don’t want to have a negative impact on the business. The regulation we conform to might not be the most stringent, but it is the most relevant to our environment. And then we have everything else comply under that unless there’s an item that’s a unicorn.
We set our policies for the NIST 800-53 Rev. 5 moderate level. However, if there’s a situation where we need to meet high criteria, we write a policy that takes us to that level for that specific matter. This occurs with penetration testing as an example. The NIST 800-53 moderate level says we need to conduct a penetration test only once per year. But PCI-DSS compels us to run these tests twice each year. The other standards are met by the moderate baseline, and then that one is bumped up to meet the PCI-DSS requirement.
Always remember: If you just migrated to a hybrid IT environment, or anytime you make changes to your infrastructure, the time to review and change your security policies is before and after the move. One ensures that your policies are up to date and ready, the other ensures that the policies are adhered to. Otherwise, you run the risk of a breach that could lead to the loss of data or regulatory violations.
By: Calli Schlientz, Director of Compliance
ITAR Compliance Checklist
If your organization engages in exporting or importing defense articles, or furnishing defense services to foreign entities, you must achieve ITAR compliance.
The U.S. International Traffic in Arms Regulation protects national security and foreign policy interests by preventing the unauthorized transfer of sensitive technology. ITAR specifically controls the exporting and importing of defense items (called munitions). These can include technology like encryption algorithms and computer software. They also include bombs, guns, ships, tanks, and airplanes.
The actions of ITAR abusers can harm national security. Therefore, violations may result in severe civil and criminal penalties. Violators may also damage their brand reputations and lose licenses to export and import.
A Guide for Your ITAR Compliance Journey
To manage your IT environment to achieve and maintain ITRA compliance, the program you develop should focus on monitoring and controlling regulated import and export activities. To guide you on this mission, here’s a checklist covering the necessary high-level activities:
- Establish an ITAR-specific compliance program—Understand how your business works to determine your risk areas. Many companies that don’t engage in manufacturing, exporting, or brokering must still maintain a compliance program to reduce the risk of violations.
- Know your obligations—See the U.S. Munitions List to determine if your organization is subject to ITAR and what ITAR requires. This includes registration and obtaining approvals before engaging in export, import, and brokering activities.
- Know your customers—This includes their intended use of the defense articles and services. Screen all parties involved in transactions. Also know which countries the U.S. government has denied approvals for receiving defense articles and services.
- Document the licensing procedures—Keep detailed records of all defense-related exports and imports. This includes the registration of your corporate controller and the licensing of items and services
- Categorize your munitions items—The munitions list spans 21 categories classified into 16 sections. The classification determines restrictions, exemptions, and licensing requirements.
- Control access—Identify the access privileges of your internal users based on their job roles. Implement robust authentication methods.
- Manage risks—Conduct a thorough assessment to determine the risks of unauthorized transfer of sensitive technologies. Then implement a plan to close any security gaps.
- Coordinate incident response—Establish a plan for mitigating, reporting, and investigating data breaches.
- Audit regularly—Verify your exports and imports of ITAR-controlled items. Create a system for investigating discrepancies.
- Train your employees—Invest in staff training for ITAR and your related infrastructure to foster a culture of compliance across your enterprise.
- Encrypt sensitive data—Use encryption to ensure only authorized recipients can decrypt data.
- Control data sharing—Use technology to prevent the sharing of ITAR data with unauthorized individuals.
After working through this checklist, review the ITAR provisions and complete your registration with the Directorate of Defense Trade Control (DDTC). As part of this process, determine the legal authority over your product. A handy tool to work your way through the compliance process is the ITAR Risk Matrix. It outlines several elements to consider when building your program and how to assess your risk.
How DataBank Supports ITAR Customers
DataBank equips its colocation data center facilities to fully support ITAR compliance for our customers. We implement the required security protocols and demonstrate our capabilities through annual third-party audits.
Customers trust our compliance experts—including a dedicated CISO—to support their needs. Our customers also rely on our managed services security program that ensures compliance with ITAR. Our relevant certifications include a FedRAMP Authority to Operate (ATO) as well as SSAE 18 SOC 1 Type 2 and SOC 2 Type 2.
To learn more about how DataBank data centers can help your organization comply with ITAR and other regulations, contact DataBank today. In addition to achieving compliance, you can safeguard personal information and build confidence among your customers.
How do data centers guard against natural disasters?
Imagine the shaking of an earthquake, a furious storm, or a quickly growing fire. Hopefully, you built your facilities to withstand such natural disasters.
Have you also considered the resiliency of your data center? At a minimum, your provider backs up your IT infrastructure and your critical data. Your provider also deploys failover capabilities to other regional data centers to remain operational when disasters strike.
However, sophisticated data centers go far beyond backup and failover capabilities. For example, when planning sites and building facilities, the leading providers both consider how climate may impact their operations as well as how their operations may impact the climate.
This is a vital perspective: There’s a close link between climate change and natural disasters that data centers consider in their siting and operations.
In this blog, we examine the measures data center providers take to protect the IT infrastructure and the data of their customers. We also present specific programs DataBank has implemented to safeguard its data centers against natural disasters.
The Keys to Holding Up Against Severe Weather
Data center providers implement a range of methods to assure their facilities can withstand severe weather conditions and climate change-related events:
- Built-to-Last Structures—Strong building materials like reinforced steel and concrete to survive earthquakes and strong winds.
- Strategic Locations—This includes siting data centers in areas less prone to natural disasters and using elevated platforms and advanced drainage systems to protect against floods.
- Smart Monitoring—Sensors provide real-time warnings about environmental conditions. These include seismic sensors to detect earthquakes and climate monitoring to track temperature, humidity, and other factors that impact conditions inside the data center.
- Backup Systems for Power and Cooling—To protect against the power outages that commonly occur during natural disasters. Providers proactively deploy backup generators, uninterruptible power supplies, and redundant cooling systems.
- Disaster Recovery Plans—Providers document all the steps for various disaster recovery scenarios. These include emergency protocols that guide staff on what to do in different types of emergencies. Providers also conduct regular drills to ensure they can act quickly during an actual disaster.
Continuity plans and recovery technology also require the knowledge of disaster experts. The leading data centers employ highly-trained professionals who specialize in emergency response. They act fast and coordinate responses with local disaster response teams.
DataBank Commits to Resilience
Resiliency against natural disasters has long been a cornerstone of data center operations at DataBank. We include resilience in our Environmental program and integrate resiliency throughout our design standards and operations. This oversight helps us maintain 100% uptime at our facilities during instances of electrical grid interruptions.
Our resilience strategy prepares our data centers for unexpected natural disasters. Here are some of the key tactics we employ:
- Siting facilities outside 500-year flood plains, significant earthquake zones, and recurrent natural disaster areas
- Following site frameworks that include climate risk considerations
- Assessing the physical stresses on facilities during data center siting and construction processes
- Designing buildings to accommodate temperatures of at least 115 degrees Fahrenheit
- Reinforcing facility structures to protect against earthquakes, hurricanes, tornados, and high winds
- Incorporating a minimum N+1 redundancy in power and cooling systems
- Conforming to building standards to withstand heat, floods, and fires
- Implementing physical adaptation measures to increase site resilience
We also engage third-party suppliers of building materials and technology services to increase value chain resilience. Along with climate risk assessments, we address the risks posed by climate change at each of our facilities. Each facility also has specific emergency action plans tailored to the attributes of the building and the local climate.
A Framework to Disclose Climate Risks and Opportunities
As part of the DataBank commitment to resilience to protect customer infrastructures from natural disasters, we produced reporting in line with the Task Force on Climate-Related Financial Disclosures (TCFD), which is now a part of International Financial Reporting Standards. In this report, we tied risks and opportunities to financial impacts to integrate risks into our enterprise risk management program.
TCFD’s framework helps data centers and other entities identify climate-related risks and opportunities and align with strategic planning. Examples of initiatives that emerged from our focus on TCFD were climate-related siting considerations for new construction and preparedness planning.
Maintaining Operations During Historic Texas Storm
When severe weather affected Texas in the winter of 2021, all eight DataBank Texas facilities—Dallas, Austin, and Waco—operated successfully throughout and after the storm. Using utility power with generator backups in reserve, we experienced no outages and no customers experienced negative effects. During this fluid situation, we also maintained ongoing communications with customers whenever power systems and fuel levels changed.
Although news stations reported delayed fuel deliveries, we saw no interruptions in fuel delivery because we pre-emptively arranged for deliveries before there were bottlenecks. Weather forecasts told us this storm was coming, so we topped off our fuel beforehand and arranged for deliveries in advance. We kept monitoring fuel use in real time and diverted deliveries among our Texas data centers based on usage. We also sourced backup fuel from out-of-state providers.
Our emergency response plan also included equipping all facilities with sufficient food and water supply and providing nearby hotel accommodations for on-site staff—if next-shift personnel were unable to travel safely to the data centers.
Safeguarding Data That Powers the World
The proliferation of disaster-resistant data centers throughout the world demonstrates the basic need for stability in unpredictable environments. From strengthened architectures to advanced business continuity technologies, sustainable energy, and climate impact, data centers represent a holistic approach to resilience. Safeguarding our digital lives makes sure all that important data that powers our world is safe and secure—even in the face of the most powerful natural disasters.
By: Calli Schlientz, Director of Compliance
HIPAA Compliance: A 9-Point Checklist
How to achieve HIPAA compliance
When Congress passed the Healthcare Insurance Portability and Accountability Act in 1996, they certainly opened a big can of worms!
Achieving HIPAA compliance presents many challenges. These include the complexity of the regulation and the ever-evolving cybersecurity threat landscape. Organizations also need to keep up with regular HIPAA changes, ensure employees interact with data properly, and manage the risks of their vast third-party ecosystems.
More specifically, the HIPAA Privacy Rule requires protecting the privacy of patient health information. Providers, health plans, and third-party service providers who handle patient information must prove they secure electronic records containing confidential health information as they transfer, receive, process, and share patient records, billing, and claims.
The Risks of Non-Compliance with HIPAA
For organizations subject to the HIPAA Privacy Rule, failure to comply can result in significant financial penalties and mitigation costs. In September 2023, the U.S. Department of Health and Human Services reached a settlement with LA Care, the nation’s largest publicly-operated health plan. Following a large breach of patient records, LA Care agreed to pay $1.3 million and to invest in implementing a comprehensive corrective action plan.
Weak security postures can also lead to attacks that seriously hamper operations. For example, Change Healthcare, a United Health Group subsidiary, had to disable 100 systems following a ransomware attack. This left the company unable to process claims and prompted some of its provider organizations to struggle with keeping their clinics open due to the lack of cash flow.
Perhaps the biggest risk healthcare entities face by not complying with HIPAA is the loss of patient trust. Patients suffer the most from HIPAA non-compliance and turn away from providers and health plans that don’t protect their sensitive information. That’s because cybercriminals use stolen records to commit identity theft, fraud, and other scams. These consequences can affect an individual’s access to healthcare.
The Path to Achieving HIPAA Compliance
Despite the challenges, with proper planning, your organization can create a path to achieving and maintaining HIPAA compliance. To help you with your journey, here’s a 9-step checklist to guide you.
Step #1 – Appoint a compliance officer
First designate an individual to oversee your HIPAA compliance program. Without a single person at the helm, your efforts will bog down or spring holes that leave you open to violations. For this person to succeed, give them executive support with the authority and the resources to enforce the compliance policies.
Step #2 – Conduct risk assessments
This includes identifying the potential risks to personal health information within your organization. Evaluate the effectiveness of your security controls periodically and document the findings. As you identify security gaps, develop corrective action plans.
Step #3 – Develop policies and procedures
These include establishing policies for handling health information along with procedures for access control and data encryption. After initially going through this exercise, review the policies and procedures every few months to account for changes to HIPAA and within your technology environment.
Step #4 – Implement access controls
As you conduct risk assessments (Step 2) that identify compliance gaps, implement the necessary controls to restrict patient information access to authorized personnel only. By applying role-based access controls, you can ensure employees access only the information necessary for their roles. As part of this step, regularly review and update your access permissions.
Step #5 – Deploy data encryption
This step includes encrypting patient information in transit among your internal systems and in data exchanges with your data-processing partners. Also encrypt data at rest to protect it from unauthorized access. In addition, utilize strong encryption methods and update them regularly to address emerging threats.
Step #6 – Establish a breach notification protocol
Should a breach of systems with patient information occur, you must have a clear plan for how you will respond. This includes notifying affected individuals and the Department of Health and Human Services. In some cases, HIPAA requires you to issue a press release. As with the other steps on this checklist, test and update your breach response plan on a scheduled basis.
Step #7 – Maintain physical security
Also consider the physical security of your facilities and any devices that store or access patient information. Implement measures such as badge access to your data centers as well as surveillance cameras. For any patient information in physical form, establish secure disposal methods.
Step #8 – Train your employees
Compliance requires awareness of proper conduct when interacting with data by everyone across your organization. Provide training sessions at least once a year and when you first hire employees on HIPAA requirements and data protection best-practices. Also educate your staff on recognizing phishing attempts and other security threats. In addition to the training, HIPAA requires you to maintain records of your training activities and participant acknowledgments.
Step #9 – Conduct Regular Audits and Monitoring
Regularly audit compliance with HIPAA policies and procedures. Use monitoring tools to detect unauthorized access or anomalies in the handling of PHI. Document your audit findings and take corrective actions as needed.
Partner with HIPAA-Compliant Service Providers
In addition to your internal HIPAA compliance measures, consider your ecosystem of third-party service providers that handle patient information. Given that many cyberattacks start by finding a weak link in third-party supply chains, make sure your partners comply with HIPAA regulations as well. You can do this through a Business Associate Agreement as defined by HIPAA where your providers outline their responsibilities for protecting patient information.
A particularly important partner to focus on is your data center provider. For DataBank colocation customers, we serve as a trusted Business Associate to healthcare Covered Entities who manage protected health information or provide services to other companies that manage e-patient information.
Because we perform an annual audit every year in each of our data centers, customers subject to the HIPAA Privacy Rule can trust their IT equipment is housed within a top-tier facility that adheres to the most stringent audit requirements in the industry. Our shared risk model and Business Associate Agreement also allow you to transfer as much as 80% of the HIPAA controls to DataBank to unburden your IT team and make compliance easier.
The Advantages of Partnering with a HIPAA-Compliant Data Center Provider
Partnering with a HIPAA-compliant multi-tenant data center provider like DataBank offers numerous advantages: enhanced data security, a reliable power and cooling infrastructure, and expert support in maintaining compliance. We provide state-of-the-art security measures, giving you peace of mind knowing your data is housed in an environment that meets the stringent HIPAA requirements.
###
By Mark Houpt, DataBank Chief Information Security Officer
Earlier this year, I offered three predictions for cybersecurity in 2023, and Forbes asked for my thoughts on cyber attacks in 2022. For 2024, I have these five predictions:
#1 – Artificial Intelligence (AI) will drive the evolution of cybersecurity attacks and defensive mechanisms
Despite what many people believe, AI itself will not be the source attacks. Rather, it will be an amplifier of attacks. Because the technology can repeatedly run attacks and learn to alter itself based on the responses it receives, the addition of AI will make attackers much more effective, damaging, and robust. As the industry evolves next year, security professionals will focus on staying ahead of the game. They will defend their networks with AI tools that can auto-sense attacks and respond accordingly.
#2 – Tried-and-true methods will be the backbone of cybersecurity practices
Bad actors keep getting more sophisticated with their attacks. However, security teams must not surf the trend wave or look for shortcuts in their strategies in response. Everyone wants to adopt the shiny new solution, but as cybersecurity professionals navigate the landscape next year, we will see a greater push toward tried-and-true methods. Rather than adding the next big thing to their arsenal, teams will focus on assuring sound practices, doing what’s required by regulations in 2024.
#3 – More organizations will adopt identity verification
Expect more organizations to adopt identity verification to ensure the authenticity of individuals during account onboarding. The increasing adoption of identity verification across various organizations is a response to the evolving digital landscape, marked by advancements in AI and a growing need for robust authentication methods.
This trend is particularly relevant in the United States, where both government regulations and standards set by the National Institute of Standards and Technology (NIST) play a pivotal role. The trend toward broader adoption of identity verification is a necessary response to the challenges posed by an increasingly digital and interconnected world. The U.S. government and NIST requirements act as catalysts in this process, ensuring organizations adopt practices that are secure, reliable, and respectful of individual privacy.
First, the U.S. government has emphasized the importance of reliable identity verification in safeguarding national security and protecting individual privacy. Various regulations and standards—such as the Real ID Act and the guidelines provided by the Department of Homeland Security—underline the need for stringent verification processes. This focus is not only to combat identity theft and fraud, but also to ensure that government services are accessed securely and efficiently.
Second, NIST, a non-regulatory agency of the U.S. Department of Commerce, sets standards for identity verification. NIST guidelines, especially the NIST Special Publication 800-63, provide a framework for digital identity services. These guidelines emphasize the use of multiple factors for authentication, the importance of user consent, and the management of privacy risks. They advocate for a layered approach to security, incorporating both physical and digital methods of verification.
The wider adoption of identity verification is also driven by advancements in AI. AI algorithms can now analyze biometric data, detect anomalies in user behavior, and verify documents with higher precision. This not only improves the security of the verification process but also enhances the user experience by making it more seamless and efficient.
#4 – Third-party service providers will continue to place cyber security programs at risk
In 2024, third-party vulnerabilities are poised to significantly impact the cybersecurity landscape, a trend accelerated by the directives of Executive Order (EO) 14028. This order, aimed at improving the nation’s cybersecurity, underscores the critical nature of third-party risks. As organizations increasingly rely on external vendors and cloud-based services, the security of these third-party entities becomes a pivotal concern.
The interconnectedness of digital ecosystems means a single vulnerability can have cascading effects, leading to widespread security breaches. Compliance with EO 14028 will drive organizations to rigorously assess and monitor their third-party partners.
This shift will lead to a more resilient digital infrastructure but also requires significant investment in risk assessment tools and strategies to manage the expanding threat landscape. The overall impact will be a heightened focus on collective cybersecurity responsibility, moving beyond individual organizational boundaries to a more holistic, network-centric approach.
#5 – Hacktivists and nation-states will attempt to impact the U.S. presidential election
The 2024 U.S. Presidential election is likely to be a major target for hacktivists and nation-state actors aiming to influence or disrupt the democratic process. Hacktivists, motivated by political agendas, could deploy tactics like doxxing, website defacement, or spreading disinformation through social media.
Meanwhile, nation-state actors, seeking to destabilize the U.S. and undermine its global standing, might engage in more sophisticated cyber operations. These could include hacking into election infrastructure, stealing sensitive data, or launching influence campaigns to sow discord and mistrust among the electorate. Both groups view the high-stakes nature of the presidential election as an opportunity to amplify their impact, making cyber security a critical concern for maintaining the integrity of the election process.
###