As the Western world continues to deal with the fallout of the COVID-19 pandemic, the war in Ukraine, and resultant economic headwinds, cybersecurity is more important than ever.
Global events have already exacerbated events in the cyber sphere, explains Chris Cooper, Cyber Security Practice Director at Six Degrees: “2022 has already seen two of the largest Distributed Denial of Service (DDoS) attacks on record – fortunately successfully blocked by Google and Cloudflare. Ransomware and phishing continue to grow in volume, with attacks launched by socio-political groups fighting on either side of the Ukraine war inevitably spilling over into commercial and public sector organisations.”
This is why it is so crucial to ensure our cybersecurity is up to scratch – and National Cybersecurity Awareness Month allows us to do just that.
Acknowledging the ‘people’ factor
It is easy for discussions on cybersecurity to become focused on the latest technologies and systems – however, people also play a huge role in an organisation’s cybersecurity.
Matt Rider, VP of Security Engineering EMEA at Exabeam, acknowledges this: “This year’s theme for the month is ‘See Yourself in Cyber’, encouraging us all to focus on the ‘people’ part of cybersecurity. There are a multitude of ways a cybercriminal can infiltrate an organisation’s systems, so knowing what ‘normal’ looks like for your business – and therefore what ‘abnormal’ looks like – is crucial.”
But monitoring employee behaviours and access can be tricky, emphasises Andy Swift, Technical Director – Offensive Security Six Degrees: “People often see their work as very personal, rather than necessarily belonging to their employer, and that makes controlling and monitoring access to data very important. However, that is very easy to say but very hard to actually implement properly.”
This is why cybersecurity awareness is so important, with training being an essential tool in an organisation’s arsenal against cyber attacks. Richard Barretto, CISO at Progress, agrees, explaining that,“to initiate measurable change within your organisation, training and communication efforts should be consistent and not only focus on behaviours for employees to follow at work – but can help protect them at home too. Employees who are more conscious of security best practices in their personal lives will exercise those same precautions at work. Perhaps most important – creating a culture where reporting security concerns is encouraged and praised.”
With the logistical challenges brought about by the increasingly common move to hybrid working, the importance of these training practices cannot be understated. As noted by Raffael Marty, General Manager, Cybersecurity at ConnectWise, “the workplace has undergone an evolution in recent years” and “the overnight shift to work-from-home practices and constantly changing regulations, have left many businesses struggling to keep up.”
Consequently, as Okey Obudulu, CISO at Skillsoft, states, “Cybersecurity training is vital to defend against phishing attacks and malicious threats.” He adds that, “a solid cybersecurity culture thrives when employees are educated and enabled”.
It’s not all doom and gloom
Cybersecurity attacks are often pretty nasty, targeting the systems we rely on most – such as healthcare and transport systems.
As Konrad Fellmann, CISO and VP of IT infrastructure at Cubic, explains, “we are living in a time where every person and business is vulnerable to cyber threats. Mass transit agencies are no exception—in fact, they are appealing targets simply because, as part of the critical infrastructure, they help U.S. commerce and cities to run. If a transit agency is shut down and we can’t move people or goods, the criminals claim victory.”
However, even though attacks like these are on the rise, organisations are not completely defenceless against cyber-criminals!
The first step to protecting against such attacks is to keep ahead of the game in a world of rapidly changing tech. As Chris Spargen, Sr. Manager, Solutions Engineering at HelpSystems, expresses, “championing updated policies by being an early adopter, praising early adoption when you see it, and spearheading the latest security updates for the software solutions in your realm of influence will lead to a more secure organisational posture. Look for opportunities to partner with your vendors, testing new versions and helping them find any weaknesses that may exist before they reach the mainstream market.”
With the latest tech on their side, and the correct policies in place, organisations (though not impenetrable) are far better equipped to handle cybersecurity attacks. Gary Lynam, Director of ERM Advisory at Protecht, agrees, stating “smart security practices, risk assessment, compliance management and operational resilience will help businesses minimise attack surfaces and recover quickly if attackers get through.”
Technology is your friend
In the fight against cybersecurity attacks, there are plenty of technological strategies organisations can implement to help protect themselves.
One such technology is Software-as-a-Service (SaaS). As Marco Fanizzi, SVP and GM at Commvault International, explains, “businesses can implement a trusted SaaS solution that not only protects the data the business creates, collects, and stores, rendering it recoverable should an attack succeed, but that also puts up defences against cyberattacks that can prevent an attacker from succeeding in the first place.”
An additional technological strategy that can help is Cyber Deception. “Cyber Deception is an emerging cyber defence that puts organisations one step ahead of the attacker. They become the manipulator, rather than being blind-sided. The methodology revolves around deploying decoys to throw the attacker off course and lure them to fake assets,” according to Cesar Cid de Rivera, INTL VP of Systems Engineering at Commvault.
Above all else, it is vital that organisations have backup strategies in place – so their data is protected when all else fails. Eric Bassier, Senior Director Products at Quantum, advises how this can be implemented successfully: “The answer is to keep three copies of data – one primary, plus two backups – and to keep those backups of different media types like disk and tape. For a company’s primary backup storage, they need to integrate a high-speed disk or flash-based infrastructure which employs immutable snapshots to protect backup datasets. For the last line of defence, tape libraries should be utilised, providing an option for secure, offline storage to keep a copy of the data in the case of a damaging attack.”
While these technologies do offer crucial protection from cyber attacks individually, Ross Hosman, CISO, Drata, concludes that, “in reality, security in the cyber landscape is something that needs to be considered from the ground up to effectively protect data. Business leaders need to adopt a cybersecurity mindset to critically identify the ways to incorporate cybersecurity at every level of the organisation.”
You can find our other articles on cybersecurity awareness month here, here and here.
Pingback: Cybersecurity Awareness Month, part 3 - Cyber Protection Magazine