Cybercrime: Is your company at risk?

As more and more business is done online, cybersecurity threats are getting worse. Most companies know this and are aware of the need to protect themselves. But in practice, they often wait until it’s too late to act, after they’ve already been attacked and their data, finances, customers and reputation have been compromised.

Every day, new reports of major cybersecurity breaches create headlines in the media and huge headaches for businesses. Two of the latest were the Snake ransomware attack on Honda and the phone spear phishing Twitter hack in the summer of 2020, which joined other infamous data breaches that have become more common and much costlier in recent years.

Cyberattacks are the most rapidly increasing crime in America, growing in size, savvy and damage. In 2019, the FBI revealed that, for that single year, there were nearly 470,000 internet crime complaints from companies and individuals, costing more than $3.5 billion. Industry experts expect that global cybercrime will rob the world of $6 trillion annually by 2021, double the prediction in 2015. But the costs far exceed stolen money; attacks cause significant losses of personal and financial data, productivity, intellectual property, operational functionality, customer trust and brand strength.

A growing threat for remote working

Cybercrime affects all companies, from Honda and Twitter all the way down to local mom-and-pop shops. Infact, small and medium-sized organizations usually have fewer resources to spend on protection and are therefore more likely to suffer from a security breach.

While COVID-19 has impacted all our lives and devastated the global economy, for hackers, it has been a golden age. The coronavirus pandemic has spawned a ransomware epidemic, as criminals exploit employees now working from home with less protection. Malware targeting smart devices has spiked and both encrypted malware and cryptomining have picked up after dropping off in 2019.

While the cybersecurity market is filled with an abundance of products and tools that all claim excellent defense they still result in frequent, destructive data breaches.

Cybersecurity problems

In an extremely complex cybersecurity environment, threats are always evolving as criminals are becoming cleverer. At the same time, organizations have remained alarmingly unprepared, resisting necessary investment and much-needed innovation in information security. Even basic safeguarding steps are not being taken to protect themselves from a breach.

These are some of the reasons why businesses remain at risk:

Growing cybersecurity threats: Malware, phishing, hacking, business email compromise, SQL injection, eavesdropping, password, birthday, drive-by, man-in-the-middle, denial-of-service and distributed DoS attacks. There’s no shortage of ways businesses can be infected by bad guys that have only gotten better at cybercrime.

Shortage of cybersecurity knowledge: Suffering from overreliance on too many tools, platform complexity, alert fatigue and recruiting challenges, the industry lacks the skills and expertise to be effective. Training is the most underfunded aspect of organizational cybersecurity and there is a knowledge deficiency from executives on down, so employee education might be the best, most cost-effective solution.

Return on cybersecurity investments: A fundamental issue for many businesses is that cybersecurity, as a risk-prevention or reduction strategy and not a revenue-producer, is not viewed by decision-makers as a priority. Without resources, data security programs have limited effectiveness, which can perpetuate the problem.

Awareness and attitude: While companies know the risk, many operate as though cyberattacks won’t happen to them. A mindset of organizational security and constant vigilance is as important as metrics and monitoring tools. There is a need to build up foundational capabilities because a company is only as strong as its weakest link.

The evolution of cybersecurity

Business, IT and information security risks have evolved. So, the people, processes and technologies involved in information security must evolve, as well.

At one time, protecting the perimeter with firewalls, using passwords and active directory, patching holes and backing up files was sufficient. But now, even with more sophisticated defense-in-depth tools – such as endpoint agents, data loss prevention solutions and intrusion detection and prevention systems – cyberattacks have continued. As a result, end-user training and active monitoring capacities are needed more than ever to provide dependable, 24/7 coverage.

Tomorrow’s cybersecurity demands network detection and response solutions, like log aggregation and correlation mechanisms, incident detection and response and human analysis of threat intelligence. The cyber protection of the future will likely involve intrusion containment, remediation and policy changes.

The importance of information security

The goal of information security is simply to maintain confidentiality, integrity and availability of data.

Good security posture enables a business to consistently perform its core operations, protects sensitive data that maintains the trust and confidence of customers and stakeholders and complies with regulations and standards. Information security protects against attacks from adversaries outside the organizational firewall, secures data and information against security breaches and insider abuse and builds resilience in business IT to function, no matter what.

Necessary safeguarding measures are tech-enabled. These include patch management for hosts and applications, next-generation antivirus, use of multi-factor authentication, distributed and reliable backups and active monitoring. But, at Calance, we believe they’re also business-enabled – educating end-users, reviewing critical organizational processes and adopting strong authentication and limited-access policies.

Learn, educate and adapt

In a complex environment where companies often have a shortage of cyber protection skills and see a limited return on information security investments, businesses must continually adapt and improve their defenses. Perimeter security alone is no longer enough. It’s vital for organizations to focus on the basics: training people, improving processes and updating technology.

The best cyberattack prevention is proactive defense, from awareness and preparation to strategy and software. Companies need to build, hire or rent cybersecurity expertise. They should do a cost-benefit analysis on developing those abilities in-house vs. using a managed security service provider.

Utilizing an educational framework that explains the cybersecurity environment so you can understand it, Calance offers a robust range of managed defense systems and solutions, which help identify threats and shield your company from crippling attacks.