How the cybersecurity industry has changed with 20 years of Cybersecurity Awareness Month

This year’s Cybersecurity Awareness Month marks the twentieth anniversary of the event. Every year for the past twenty, October has reminded us about the importance of digital security and empowered everyone to protect their data from digital forms of crime. Towards the end of Cybersecurity Awareness Month we’ll take a look back – and ahead.

But over the past two decades, a lot has changed in the world of cybersecurity – new technologies have transformed the industry, the threat landscape has increased, and cybercriminals have grown in sophistication, forcing organisations to step up too. As Hugh Scantlebury, CEO and Founder of Aqilla, reflects, “cybersecurity and technology has changed so much over the past twenty years. The introduction of cloud computing and its huge growth over the past decade has changed how many organisations operate, store their data and, therefore, their cybersecurity needs. On-premises security was no longer enough – as data moved to the cloud, security measures had to follow. Simultaneously, the threat landscape grew as the collaborative capabilities of cloud enabled more data to be generated and shared than ever before. 

“And the industry is still changing rapidly twenty years later,” he continues. “The boom of AI, specifically generative AI, over the past few months has added a whole new level of complexity to cybersecurity by giving cybercriminals a new tool to execute attacks. AI provides the potential for bad actors to launch sophisticated attacks at previously unprecedented speed and volumes – those that once would have required hundreds of people to launch can be done by one man.”

With this growth of data generation, and the ability of AI to produce it at unprecedented speeds, “today’s organisations are working with more data than ever before,” notes Tim Sherbak, Enterprise Products and Solutions Marketing at Quantum.

“Data is swiftly growing in volume, value, and the potential for future enrichment, presenting a variety of challenges for businesses looking to optimise their data storage architectures to keep up with growing data demands. One of the top challenges—if not the top challenge—is ensuring data protection throughout the entire lifecycle of data, as cyber-attackers are increasingly targeting organisations that possess extensive amounts of sensitive information.”

In order to combat these challenges and protect all data from potential threats, the cybersecurity and data protection industry have begun to merge. Once separate entities – cybersecurity dealing with the protection against threats, such as anti-virus and firewalls, and data protection handling the management, access and recovery of data – the lines between them are now blurred. As Ian Wood, Senior Director – Sales Engineering UK&I at Commvault, explains: “Companies need to have a more united and in-depth strategy by creating a bridge between data protection and security practices, especially now that cybercriminals are benefiting from segregated processes with different management interfaces and codebases.” 

He continues: “Having a more holistic and proactive approach to cybersecurity is the only way to ensure safety online. It is time to take the blinkers off and see more than just the reactive measures – we need to start thinking in a preventative way. Why take an aspirin for a painful headache when hydration and a good night’s sleep could have saved you the pain in the first place? Why plague yourself with the coming winter flu when you can start taking vitamin C tablets right now? Treat your systems like a temple and don’t let the negative in. The best way to do this is to modernise your data protection solutions for a more cohesive approach, that combines data protection and security into one entity.” 

An ever-evolving industry

As we’ve established, the industry has changed a lot over the past two decades, and it certainly isn’t showing signs of slowing down anytime soon – with new innovative security measures continuing to emerge. Robert Sugrue, Cyber Security Product Director at Six Degrees, shares his insights into managed extended detection and response (MXDR) which “is seen by many to be the next evolution of cyber defence.”

He explains: “While managed detection and response (MDR) focuses on identifying and addressing activity that could indicate compromise, the intelligent addition of threat intelligence through an MXDR solution should be able to inform pre-emptive protective measures that reduce cyber risk much further. Imagine being able to harness low priority information from unsuccessful attack attempts and using threat intelligence to establish who is attacking you – and how.”

With cybercriminals growing in sophistication, threat intelligence enables organisations to increase their knowledge and stay on par with the bad actors they are fighting against. Kamil Fedorko, Global Cybersecurity Practice Leader at Intellias, also champions the technology, describing it as “the critical tool for businesses to pre-emptively identify and counteract cyber threats.

“This comprehensive approach encompasses not only the detection of attacks after they occur but a thorough exploration into their potential origins, nature, and motives. Crucially, this expansive monitoring provides an invaluable insight into the conversations of hackers. Beyond just spotting the company’s name or data, businesses can now comprehend the context, sentiment, and underlying intentions of these discussions. By gauging the tone and direction of conversations, whether it’s around a specific software vulnerability or newly discovered breach methods, organisations can then pre-empt potential attacks.” 

Managing the madness

Whilst all this new, innovative technology may make managing an organisation’s cybersecurity sound relatively simple, the reality is much more complex and requires a whole team to succeed. Brett Candon, VP EMEA at Cyware, quotes Steve Jobs saying: “‘Great things in business are never done by one person. They’re done by a team of people.’

Candon elaborates: “If you consider cybersecurity through this lens, you can see just how astute his comment is. The combination of a skills gap, a tsunami of security alerts from an overwhelming number of disconnected tools, and the never-ending assaults from cybercriminals are creating a perfect cybersecurity storm for businesses the world over. What’s needed to more effectively tackle the cybersecurity challenge is a pooling of resources – or an organisation or industry-wide, connected team of people. It cannot be done by individuals or isolated teams. As Steve Jobs alluded, there is strength in teamwork.”

Yet, as part of working in the security team, Samantha Humphries, Senior Director, International Security Strategy at Exabeam, highlights the importance of understanding individualism when it comes to cybersecurity. She recommends that the best “approach is for security teams to take the time to understand the different roles, motivations, responsibilities and business requirements of the people in their organisations. This will allow them to provide security that protects people on an individual basis without impeding their day-to-day activities. Once we better understand the employees, we can better tailor security controls, processes, and training to meet their needs.”

Yet, the cybersecurity of a whole organisation doesn’t have to be solely down to its people. Matt Hillary, VP, Security & CISO at Drata, acknowledges that “routine tasks and exhaustive manual processes open doors for greater risk from staff who can be better spent devoting work hours to larger, longer-lead projects.”

He recommends “using tools that streamline manual processes and reduce human error can help build trust, transparency and cooperation between these two, often separate, teams. For example, compliance automation eliminates blind spots through automated control monitoring and reduces the time it takes to close gaps and respond to noncompliance.”

Here’s to the next twenty years of cybersecurity

Cybersecurity has hugely changed in the past twenty years, and we can expect it to continue to transform over the next two decades. On the fortieth anniversary of National Cybersecurity Awareness Month, we’re bound to be talking about something that doesn’t even exist today! But, with the trusted security teams and latest technologies continuing to evolve no matter what new threat comes their way, we are put in good stead to stay one step ahead of cybercriminals for whatever the future holds.