Cyberattacks are becoming more sophisticated in today’s digital world, where high-profile data breaches and cybercrimes have grabbed international headlines almost every month.
This article was first published in The Business Times on 30 March 2018.
In recent years, an increasing number of high-profile data breaches have been grabbing international headlines.
The largest data breach of personal information to date happened just one year ago, when hackers stole the data of over 148 million Americans from credit agency Equifax.
Closer to home, Uber came under fire in December 2017 when the personal information of 380,000 people – including names, e-mail addresses and mobile numbers – were exposed.
No one is spared from the looming threats of cybercrimes, and when the seemingly impregnable multi-million-dollar organisations are compromised, it begs the question: Who is next?
Stepping up the defence
To stay off the radar, it helps to know whom you’re dealing with. The modern cybercriminal is highly organised and resourceful, using a wide array of advanced tools and techniques for attack.
Many enterprises are not well-equipped to deal with it. Microsoft reports that more than 60 per cent of organisations are understaffed in the security department.
In addition, the shortfall of security personnel is expected to reach 1.8 million by 2022. Evidently, organisations are being outgunned by hackers hiding in the shadows.
To level the playing field, many enterprises have invested in automated, software-based processes that continuously monitor the environment and respond swiftly to potential threats.
Some of these advanced solutions have built-in capabilities that call for human intervention when the need arises, ensuring that a company’s security resources are channelled only to the most critical cases.
Importance of a trusted cloud
Organisations that find themselves lacking in a holistic security strategy can start by leveraging the security expertise of a large-scale cloud provider.
These providers’ sheer scale of resources and investments in defence give them an edge in capabilities and security intelligence that few companies can match – or hack into, for that matter.
Microsoft, for example, invests more than a billion dollars annually to secure its multi-billion-dollar cloud service. It is even protected by the Microsoft Cyber Defence Operations Centre (CDOC), which can respond to security threats in real time.
When considering the big move to a cloud-based system, it is imperative to carefully evaluate each service provider. After all, you are not merely selecting a service, but entrusting a third-party with your business’ most valuable and sensitive data.
The mark of a good cloud service provider is complete transparency. Vendors should have no issues publishing detailed reports about security, privacy, and compliance of their cloud services.
They should also be able to verify their claims by producing audit reports.
Added layers of authentication
A secure cloud-based system is especially imperative for a growing base of employees who are allowed to work remotely. This may seem innocuous but presents as a potential nightmare from a security point of view.
While an organisation can work to tighten security within its perimeters, there is little it can do to secure an employee’s home, personal devices or public hotspots.
According to industry reports, a whopping 70 per cent of breaches stem from compromised end-points. As mobility gives rise to more security risks, organisations need to employ an identity-driven security strategy to overcome these challenges.
Identity and access management (IAM) solutions enable companies to exert control over their data based on roles and needs. By authenticating and managing users’ access to data, an organisation can protect its assets regardless of where and how the user is connecting from.
For added security, organisations can introduce another layer of protection in the form of multi-factor authentication (MFA). MFA is not a new technology; we go through a multi-factor check when verifying our online credit card purchases with a numeric one-time password (OTP).
Artificial intelligence is your new security talent
To level the playing field, many enterprises have started to invest in AI-based security solutions that continuously monitor the environment and respond swiftly to potential threats. Some of these advanced machine-learning solutions have built-in capabilities that call for human intervention when the need arises, ensuring that a company’s security resources are only channelled to the most critical cases.
More importantly, AI-based security solutions can help to solve today’s talent shortages, and at the same time elevate existing security talents to uncover new threat vectors, or to improve on security processes.
Staying on guard
A majority of security breaches can be easily avoided with some basic safety measures. Most companies diligently conduct fire drills, going over emergency procedures and exit routes on a regular basis.
Likewise, companies need a security protocol in anticipation of a looming cyberattack.
The average Fortune 500 company receives up to 17,000 malware alerts every week. Preventing a breach is a critical part of security, but fortifying the walls of defence is no longer sufficient.
Threats are so advanced that security teams need to assume that a breach has either already occurred or will occur at any given moment.
Organisations must be at the ready to fend off new attacks as quickly as they come, and focus on reducing the time it takes to detect and recover from a breach.
Companies can leverage advanced security solutions that make use of analytic tools and machine-learning capabilities to prevent threats autonomously.
When combined with human knowledge and experience, fast-moving threats can be dealt with quickly and effectively.
Cyberattacks are no longer a question of “if”, but “when”. These threats to cybersecurity can put a wrench in an organisation’s need to innovate and grow.
It is no longer enough to simply build “better walls” and deal with the problem when it surfaces. Companies need a multi-faceted approach to security which includes early detection of a breach, protecting all end-points, anticipating attacks, and minimising recovery time from a breach.
Having a holistic security strategy is vital to address the realities of today’s cybersecurity. Coupled with constant vigilance and software advancements, we can focus on innovating, creating and thriving in a safer digital world.