Pourquoi Security-by-Design est crucial quand la crise force une transformation digitale rapide

« Si vous fail to plan, you are planning to fail. » — Proverbe moderne

Avec la pandémie COVID-19 dominant les manchettes, moins de voix ont examiné son impact durable sur l'adoption technologie. La crisis est likely to cement a sustained shift vers automation et remote asset management — spanning industrial machinery, HVAC systems, et supply chains — et à accelerate the rise of virtual care et telehealth in healthcare.

Début mars, comme l'Organisation Mondiale de la Santé déclarait COVID-19 une pandémie, les companies began to rethink core processes. Le changement le plus visible a été a dramatic surge in the use of collaboration tools tels que Slack et Microsoft Teams, selon Chris Kocher, managing director at Grey Heron. Les plateformes teleconferencing et telehealth — Teladoc, par exemple — ont aussi vu rapid adoption.

IoT World is North America's largest IoT event where strategists, technologists and implementers connect, putting IoT, AI, 5G and edge into action across industry verticals. Book your ticket now.

Pour de nombreuses organisations, l'accès distant aux systèmes de contrôle industriels (ICS) a jumpé après un déclin précédent. Shodan data shows nearly 50,000 U.S.-based IoT devices now expose an online footprint, et the use of Remote Desktop Protocol a increased despite past security concerns.

« Basic-level remote monitoring was sufficient when staff could inspect machines on-site », dit Yasser Khan, CEO of One Tech. « Today, with skeleton crews, plant managers demand deeper, real-time insight into equipment health — so automation is no longer optional. »

Les stratégies disaster-recovery évoluent aussi. Nitin Kumar, CEO of Appnomic, explique que traditional « manual mode » responses fall short quand une pandemic cuts off system capacity. « You need more automation, not more people », il note, suggesting that organizations willing to invest in automation will strengthen continuity plans.

Bruce Schneier famously warned in 2016 that « human intervention is increasingly unnecessary » et que « the Internet now senses, thinks, and acts. » As automation spreads, les implications sécurité d'un globally connected, semi-automated IoT ecosystem grow more complex.

Kate Stewart, senior director of strategic programs at the Linux Foundation, met en garde que « the more complex a system, the more things can go wrong. » « We must understand potential failures, mitigate harm, et boost software dependability », elle dit.

Secure by Design

Quand la crise force rapid change, secure-by-design principles can be sidelined. Verizon's John Loveland avertit que « adhering to secure-by-design is challenging when everyone is moving quickly. » Il urge que security teams be embedded in every decision around new technology or processes.

Bob Martin, co-chair of the Software Trustworthiness Task Group at the Industrial Internet Consortium, advises : « Bring stakeholders — business leaders et operators — into security discussions from the outset. »

Andrew Jamieson, director of security and technology at UL, insiste que security should be the foundation : « If you build a correct base, you won't have to rebuild. Otherwise, you spend a lot of time fixing what could have been prevented. »

Frank Hißen, an independent security consultant, note que « security-by-design rarely tops the priority list during a rapid shift to remote work and automation. » Il insiste que secure technologies must be applied quickly to avoid gaps.

Parce que secure-by-design involves multiple hardware et software components, integration can be complex. Chris Catterton, solutions engineering director at One Tech, avertit que « vendors selling the 'puzzle pieces' often lack robust security measures. » Expanding remote access in IoT deployments demands end-to-end security, from cloud or on-premise systems accessed via VPN.

Finding and Refinding Security Balance

Embedding security into products et processes is essential, mais no design can foresee every future threat. « You can't make a decision today that will remain valid forever », dit Jamieson.

Il y a tension entre adding features et maintaining security. Stewart observe que while many consumer apps tolerate crashes, open-source software used in critical applications must be dependable, as failures can harm people.

Security ultimately depends on resilience et agility. Jamieson argue que building only for resilience is insufficient quand new vulnerabilities arise. « You need the agility to patch, update, or refactor systems swiftly. »

Incorporating security from the start must also embrace resilience et agility. « If you design without security, you design for failure », il conclut.