PwC Cybersecurity Chief Urges Proactive “Kill Switch” Approach to Supply Chain Risk
Table of Contents
Embracing standardized security measures and automated remediation is no longer optional, but essential for navigating today’s complex threat landscape, according to a leading cybersecurity expert.
The warning comes from Prakash Venkata, a Partner in PwC’s cybersecurity practice and the firm’s Global Cyber Alliances lead, who argues that organizations must proactively address vulnerabilities rather than waiting for a crisis. Venkata, with two decades of experience fortifying digital perimeters, operates in the “visceral reality of supply chain vulnerabilities and nation-state actors,” and believes the era of bespoke security is rapidly coming to an end.
The End of Security Through Obscurity
For years, the prevailing philosophy in enterprise IT security centered on building unique, highly customized defenses. This approach, likened to constructing a “unique castle” with a “custom moat,” relied on the assumption that idiosyncratic architecture offered a degree of security through obscurity. However, this strategy is proving increasingly ineffective.
PwC recently became the first professional services firm to pilot Microsoft’s Baseline Security Mode (BSM), a standardized security posture designed to eliminate the configuration drift that often plagues modern cloud environments. The pilot served as a critical “stress test” of the balance between operational agility and fundamental security, highlighting the interconnectedness of risk across the entire supply chain. “The challenge is that it’s not just one organization getting impacted when there is a vulnerability; the entire supply chain is affected,” Venkata explained.
PwC: The Ultimate Security Stress Test
PwC presented a uniquely challenging environment for testing BSM. Unlike organizations with static perimeters, PwC operates as a “mobile army” of professionals connecting from thousands of diverse networks, often embedded within client infrastructures. Successfully implementing a standardized baseline within PwC, therefore, demonstrates its viability for any organization.
The initial deployment of the pilot immediately revealed hidden vulnerabilities – “load-bearing skeletons in the corporate closet” – particularly in the form of persistent legacy protocols. A key finding was the widespread assumption of modernization, which proved inaccurate. BSM’s observability tools exposed the continued use of deprecated technologies, such as Exchange Web Services, which many believed had already been retired.
These “technical debts” represent dormant vulnerabilities ripe for exploitation. The complexity of a global firm means that outdated protocols can linger for years, supported by specific client engagements. According to Venkata, a significant challenge was the lack of visibility into this “shadow infrastructure,” making it impossible to effectively monitor or remove. “You cannot secure what you cannot see, and you cannot modernize what you mistakenly believe is already gone,” he stated.
Overcoming Cultural Resistance to Standardization
Standardizing security postures isn’t merely a technical challenge; it’s a cultural one. In federated organizations, standardization can be perceived as an imposition, a loss of local control. When PwC’s team began enforcing the new baselines, they encountered resistance from teams who believed their custom configurations were essential for client delivery.
This pushback stemmed from a “survivorship bias” – the belief that because a system hadn’t been breached, it was inherently safe. “That communication was difficult because they said, ‘We’ve been using it, we haven’t been breached, so what does it mean if we turn it off completely?’” Venkata recalled. This highlights the perennial CISO dilemma of enforcing security without disrupting revenue.
The solution involved reframing the transition as a modernization of client service, emphasizing the protection of client data from emerging threats. By segregating sensitive data and empowering local teams to manage the transition within the new guardrails, PwC successfully enforced the baseline without jeopardizing business relationships.
The Power of Automated Remediation
Modern Security Operations Centers (SOCs) often struggle with “alert fatigue” – being overwhelmed by thousands of misconfiguration alerts without the resources to address them. The BSM pilot at PwC distinguished itself by moving beyond simple detection to automated remediation. The goal was to fix the problem, not just flag it.
A prime example involved legacy file-sharing protocols with permanently open connections for annual file transfers. The traditional fix – closing the port and waiting for a client to report an issue – was slow and reactive. Instead, PwC implemented a “just-in-time” access model, opening ports only when needed and developing alternative transfer methods.
This approach, Venkata suggested, represents the future of remediation, acknowledging business needs while eliminating unnecessary security risks. It required collaboration with client infrastructure teams to establish new, secure protocols. “We are building those things in to accelerate remediation so it is faster than expected,” he said, emphasizing the need for dynamic, automated responses to keep pace with AI-powered adversaries.
The Demise of the “Custom Tenant”
PwC’s experience points to the inevitable decline of the “custom tenant” – the practice of extensively customizing cloud environments. Venkata argues that in the cloud era, such customization is a liability, as the rapid pace of change in the threat landscape makes it impossible for human teams to maintain a superior security posture compared to hyperscalers like Microsoft.
Microsoft’s BSM approach, providing a “secure by default” baseline, challenges the traditional engineer’s mindset. Venkata contrasted this with vendors who place the security burden solely on the client. “Microsoft has been very clear: ‘If there is a known vulnerability, I want to share it right away and give you the tools to disable them or lower the risk.’”
This “single pane of glass” allows CISOs to shift the conversation from technical details to business risk. Configuration drift becomes a quantifiable risk, enabling informed decision-making. “Misconfiguration should not happen, especially in the cloud environment where it can be exploited so fast. I would rather fix it right away.”
A Tripartite Framework for Enterprise Security
The key takeaway from PwC’s pilot is that the future of enterprise security lies in aligning with global standards and automating their enforcement. The era of the “hero CISO” relying on manual effort and improvisation is over.
For organizations seeking to replicate PwC’s success, Venkata offered a three-pronged approach: embrace the tools for gaining visibility, establish processes for managing a “kill switch” through tabletop exercises, and prioritize relentless communication. “Accept it. Don’t push back. This is a good tool,” he advised.
In an increasingly interconnected digital ecosystem, the security of one organization is inextricably linked to the security of all. By embracing standardized baselines, PwC has not only strengthened its own defenses but has also validated a model that can help inoculate the wider enterprise market against the next generation of threats.