Microsoft and Frost & Sullivan Study also reveals that:
- Cybersecurity attacks have led to job losses in more than three in five (64%) organizations over the last year
- Cybersecurity concerns delay Digital Transformation plans
- Nine in ten (92%) of Indian organizations surveyed are looking to leverage Artificial Intelligence to enhance their cybersecurity strategy
Delhi, 05 December 2018- A Frost & Sullivan study commissioned by Microsoft reveals that a large-sized organization in India incurs an average of US$10.3 million of economic loss from cyberattacks whereas a mid-sized organization incurs an average of US$11K. Cybersecurity attacks have also resulted in job losses across different functions in more than three in five (64%) organizations that have experienced an incident during the survey period.
The study, titled “Understanding the Cybersecurity Threat Landscape in Asia Pacific: Securing the Modern Enterprise in a Digital World”, aims to provide business and IT decision makers with insights on the economic cost of cybersecurity breaches in the Asia-Pacific region identify the gaps in organizations’ cybersecurity strategies. The study involved a survey of 1,300 business and IT decision makers ranging from mid-sized organizations (250 to 499 employees) to large-sized organizations (>than 500 employees). The study reveals that more than three in five organizations (62%) surveyed in India have either experienced a cybersecurity incident(30%) or are not sure if they had one as they have not performed proper forensics or data breach assessment(32%).
“As companies embrace the opportunities presented by cloud and mobile computing to connect with customers and optimize operations, they take on new risks,” said Keshav Dhakad, Group Head & Assistant General Counsel, Corporate, External & Legal Affairs (CELA), Microsoft India “With traditional IT boundaries disappearing the adversaries now have many new targets to attack. Companies face the risk of significant financial loss, damage to customer satisfaction and market reputation—as is evident from high-profile breaches this year.”
To calculate the cost of cybercrime, Frost & Sullivan has created an economic loss model based on macro-economic data and insights shared by the survey respondents. This model factors in three kinds of losses which could be incurred due to a cybersecurity breach, viz., direct (financial losses associated with the incident; indirect ( the opportunity cost to the organization such as customer churn due to reputation loss); and induced (impact on the broader ecosystem and economy, such as the decrease in consumer and enterprise spending). “Although the direct losses from cybersecurity breaches are most visible, they are but just the tip of the iceberg,” said Benoy CS, Director & Business Unit Head – Digital Transformation Practice Middle East, North Africa & South Asia, Frost & Sullivan. “There are many other hidden losses that we have to consider from both the indirect and induced perspectives, and the economic loss for organizations suffering from cybersecurity attacks can be often underestimated.”
The Study also examined the current cybersecurity strategy of organizations in India. It found that for organizations that have encountered cybersecurity incidents, remote code execution and data exfiltration are the biggest concerns as they have the highest impact with the slowest recovery time. A large number of cybersecurity tools and a complex environment also add to the turnaround time. Most organizations lack a cybersecurity strategy, while for a large majority cybersecurity was an afterthought. About 59% (3 in 5) of respondents in the Study said that the fear of cyber attacks has hindered digital transformation projects. (37%) see cybersecurity strategy only as a means to safeguard the organization against cyberattacks rather than a strategic business enabler. A mere 18% seeing cybersecurity as a digital transformation enabler.
Focus on AI: While the threat of cyberattacks is ever increasing, the report also highlights that rapid advancements in technologies like AI will act as a key equalizing factor. The study reveals that more than nine in ten (92%) organizations in India have either adopted or are looking to adopt an AI approach towards boosting cybersecurity. Additionally, more than one in five (22%) of Indian organizations have already witnessed benefits of using AI to achieve faster and more accurate detection of threats.
In conclusion, the report also recommends a set of best practices for organizations to improve their defence against cyber threats. This includes positioning cybersecurity as a digital transformation enabler; ongoing investment in strengthening security fundamentals; reducing the number of tools and complexity, and leveraging integrated best-of-suite tools; continuously assessing and reviewing compliance and leveraging AI and Automation to increase capabilities and capacity. According to Mr. Dhakad, “The ever-changing threat environment is challenging, but there are ways to be more effective using the right blend of modern technology, strategy, and expertise. Microsoft is empowering businesses in India to take advantage of digital transformation by enabling them to embrace the technology that’s available to them, through its secure platform of products and services, combined with unique intelligence and broad industry partnerships.”
For more information on the study, please visit: https://news.microsoft.com/apac/features/cybersecurity-in-asia/
To better understand the cyberthreats happening globally and in the Asia Pacific, please download the Microsoft Security Intelligence Report version 23 here: https://info.microsoft.com/ww-landing-Security-Intelligence-Report-Vol-23-Landing-Page-eBook.html
Microsoft in cybersecurity
Microsoft’s approach to cybersecurity rests on three core functional areas: protect, detect and respond. To support a comprehensive, cross-company and cross-industry approach to cybersecurity, Microsoft invests more than a billion dollars in a year in security research, innovation and development. It is the first company in the industry to win a certification ISO/IEC 27018 that validates the highest levels of data security and privacy. More information and access to tools and resources can be found here: Microsoft Cybersecurity.
About Microsoft India
Microsoft (Nasdaq “MSFT” @microsoft) enables digital transformation for the era of an intelligent cloud and an intelligent edge. Its mission is to empower every person and every organization on the planet to achieve more. Microsoft set up its India operations in 1990. Today, Microsoft entities in India have over 8,000 employees, engaged in sales and marketing, research and development and customer services and support, across 11 Indian cities – Ahmedabad, Bangalore, Chennai, New Delhi, Gurugram, Noida, Hyderabad, Kochi, Kolkata, Mumbai and Pune. Microsoft offers its global cloud services from local data centers to accelerate digital transformation across Indian start-ups, businesses, and government agencies. In 2016, Microsoft opened one of its eight Cyber Security Engagement Centers in the country, to address security needs of both public and private sectors.
Understanding the Cybersecurity Threat Landscape in Asia Pacific: Securing
the Modern Enterprise in a Digital World
About the Report
This study involved a survey conducted with 1,300 respondents from 13 markets – Australia, China, Hong Kong, Indonesia, India, Japan, Korea, Malaysia, New Zealand, Philippines, Singapore, Taiwan and Thailand. All respondents are business and IT decision-makers involved in shaping their organizations’ cybersecurity strategies. 44% of them being business decision-makers, including CEOs, COOs and Directors, while 56% are IT decision-makers, including CIOs, CISO and IT Directors. 29% of participants are from mid-sized organizations (250 to 499 staff), and 71% are from large-sized organizations (more than 500 staff).
Key Highlights
The True Cost of Cybersecurity Incidents – Economic, Opportunity and Job Losses
The study revealed that:
- A large-sized organization in India can possibly incur an economic loss of US$10.3 million, more than 900 times higher than the average economic loss for a mid-sized organization (US$11,000); and
- Cybersecurity attacks have resulted in job losses across different functions in more than three in five (64%) organizations that have experienced an incident over the last 12 months.
To calculate the cost of cybercrime, Frost & Sullivan has created an economic loss model based on macro-economic data and insights shared by the survey respondents. This model factors in three kinds of losses which could be incurred due to a cybersecurity breach:
- Direct: Financial losses associated with a cybersecurity incident – this includes loss of productivity, fines, remediation cost, etc;
- Indirect: the opportunity cost to the organization such as customer churn due to reputation loss; and
- Induced: the impact of the cyber breach on the broader ecosystem and economy, such as the decrease in consumer and enterprise spending.
In addition to financial losses, cybersecurity incidents are also undermining India organizations’ ability to capture future opportunities in today’s digital economy, with close to three in five (59%) respondents stating that their enterprise has put off digital transformation efforts due to the fear of cyber-risks.
Key Cyberthreats and Gaps in India Organizations’ Cybersecurity Strategies
Although high-profile cyberattacks, such as ransomware, have been garnering a lot of attention from enterprises, the study found that for organizations in India that have encountered cybersecurity incidents, remote code execution and data exfiltration are the biggest concerns as they have the highest impact with the slowest recovery time.
Besides external threats, the research also revealed key gaps in organizations’ cybersecurity approach to protect their digital estate:
- Security an afterthought: Despite encountering a cyberattack, only 12% of organizations consider cybersecurity before the start of a digital transformation project as compared to 17% organizations that have not encountered any cyberattack. The rest of the organizations either think about cybersecurity only after they start on the project or do not consider it at all. This limits their ability to conceptualize and deliver a “secure-by-design” project, potentially leading to insecure products going out into the market;
- Creating a complex environment: Negating the popular belief that deploying a large portfolio of cybersecurity solutions will render stronger protection, the survey revealed that 24% of respondents with more than 26 to 50 cybersecurity solutions could recover from cyberattacks within an hour. In contrast, 32% of respondents with fewer than 10 cybersecurity solutions responded that they can recover from cyberattacks within an hour; and
- Lacking cybersecurity strategy: While more and more organizations are considering digital transformation to gain competitive advantage, the study has shown that a majority of respondents (37%) see cybersecurity strategy only as a means to safeguard the organization against cyberattacks rather than a strategic business enabler. A mere 18% of organizations see cybersecurity strategy as a digital transformation enabler.
Artificial Intelligence (AI) is the Next Frontier in Cybersecurity Defense
In a digital world where cyberthreats are constantly evolving and attack surface is rapidly expanding, AI is becoming a potent opponent against cyberattacks as it can detect and act on threat vectors based on data insights. The study reveals that more than nine in ten (92%) organizations in India have either adopted or are looking to adopt an AI approach towards boosting cybersecurity. Interestingly, more than one in five (22%) of Indian organizations have already witnessed benefits of using AI to achieve faster and more accurate detection of threats.
AI’s ability to rapidly analyze and respond to unprecedented quantities of data is becoming indispensable in a world where cyberattacks’ frequency, scale and sophistication continue to increase.
An AI-driven cybersecurity architecture will be more intelligent and be equipped with predictive abilities to allow organizations to fix or strengthen their security posture before problems emerge. It will also grant companies with the capabilities to accomplish tasks, such as identifying cyberattacks, removal of persistent threats and fixing bugs, faster than any human could, making it an increasingly vital element of any organizations’ cybersecurity strategy.
Recommendations for securing the modern enterprise in a digital world
AI is but one of the many aspects that organizations need to incorporate or adhere to in order to maintain a robust cybersecurity posture. For a cybersecurity practice to be successful, organizations need to consider People, Process and Technology, and how each of these contributes to the overall security posture of the organization.
To help organizations better withstand and respond to cyberattacks and malware infections, here are five best practices that they can consider in improving their defence against cybersecurity threats:
- Position cybersecurity as a digital transformation enabler: Disconnect between cybersecurity practices and digital transformation effort creates a lot of frustration for the employees. Cybersecurity is a requirement for digital transformation to guide and keep the company safe through its journey. Conversely, digital transformation presents an opportunity for cybersecurity practices to abandon aging practices to embrace new methods of addressing today’s risks;
- Continue to invest in strengthening your security fundamentals: Over 90% of cyber incidents can be averted by maintaining the most basic best practices. Maintaining strong passwords, conditional use of multi-factor authentication against suspicious authentications, keeping device operating systems, software and anti-malware protection up-to-date and genuine can rapidly raise the bar against cyberattacks. This should include not just tool-sets but also training and policies to support a stronger fundamental;
- Maximize skills and tools by leveraging integrated best-of-suite tools. The best tools are useless in the hands of the amateur. Reduce the number of tools and the complexity of your security operations to allow your operators to hone their proficiency with the available tools. Prioritizing best-of-suite tools is a great way to maximize your risk coverage without the risk of introducing too many tools and complexity to the environment. This is especially true if tools within the suite are well-integrated to take advantage of their counterparts;
- Assessment, review and continuous compliance: The organization should be in a continuous state of compliance. Assessments and reviews should be conducted regularly to test for potential gaps that may occur as the organization is rapidly transforming and address these gaps. The board should keep tab on not just compliance to industry regulations but also how the organization is progressing against security best practices; and
- Leverage AI and automation to increase capabilities and capacity: With security capabilities in short supply, organizations need to look to automation and AI to improve the capabilities and capacity of their security operations. Current advancements in AI has shown a lot of promise, not just in raising detections that would otherwise be missed but also in reasoning over how the various data signals should be interpreted with recommended actions. Such systems have seen great success in cloud implementations where huge volumes of data can be processed rapidly. Ultimately, leveraging automation and AI can free up cybersecurity talents to focus on higher-level activities.
