As you are reading this, the systems you use are being hacked.

They could be your internal infrastructure, your externally facing systems or a website that you visit to “get stuff done”.

Don’t panic. The sky is not falling, but there is a need for cyber urgency.

This urgency is driven by the requirement to develop or hire the skills and processes needed to detect, and prevent cyber-attacks. It is more about “when” you get hacked and no longer “if” you get hacked. When you are attacked, how will you manage the incident, deal with business continuity, and recover from the ordeal?

As a cybersecurity specialist, I have spent the past 20 years working with businesses to help them answer questions exactly like this.

The statistics post incident aren’t great.

93% of companies without a disaster recovery plan don’t survive.
66% of organisations would not recover from a cyber-attack.

Organisations need to develop proper cybersecurity governance to ensure business needs are met whilst ensuring the security profile, and business resilience is enhanced. Trying to explain the need for cybersecurity and governance is not always easy without delving into the history of IT systems development, such as how ARPANET was developed, the concept of trust between a limited number of known systems.

Cybersecurity and governance is finding the balance between security and the need for fast flexible service delivery. Security should be empowering and not restrictive. Brakes on a car are not designed to stop your progress – they let you go faster in the safe stretches of road and slower in the unsafe stretches. Overall, you are travelling much faster and safer. The customers (internal and external) may desire speed and the organisation requires safety and governance. With no brakes, your maximum speed is much slower than a car with brakes.

The growth in information has seen an exponential growth in networked devices.

The recent fascination with big data has involved the following:
• Add more and more devices to the network.
• Collect as much data as possible.
• Get more complex software to help generate more complex reports.

My concern here is that often the data and the reports go unread and unused. Organisations spend vast amounts of money to build a data lake that no one ever swims in. Part of the cybersecurity governance process is to better work with the business to understand the business objectives and how they can be achieved without compromising the cybersecurity of the organisation.

What is the future for cybersecurity?

We have witnessed the concept of “move to the left” for software development. This sees security consideration being discussed as early as possible, right from the feasibility stages, as opposed to a late consideration tacked onto the end of a project. The same is also being seen in system architecture.

Currently about 200 new devices are added to networks globally every second! Every one of these devices could include a vulnerability that may be exploited. This will need to be addressed. The cost to adding a device to the network was traditionally always seen as low, but the real cost, when cybersecurity issues are considered is much higher and business will need to justify the costs. This is where Zero Trust Networking comes into play. Every packet is potentially dangerous.

So, what should you do?

1. We are seeing newer and smarter Unified Threat Management devices that will consolidate several security layers into a single appliance that will simplify the management and monitoring of cybersecurity protection. Consider looking into one of these for your business.
2. Better use of network segmentation and VLANs to help manage the growing and complexity of networks.
3. Eliminate devices from the network when there is limited business benefit.
4. Develop dedicated and secure protocols for management of specific networked devices by class, such as IoT / peripherals.
5. Greater focus on staff education. The Great Wall problem – 70% of security breaches are caused by people inside your network. Ransomware relies upon poor cyber hygiene by staff and this is a huge risk to all organisations and many choose to pay the ransom as this is seen as the most cost effect recovery process.

What’s your plan here, do you need some help?
Reach out to us at info@avecglobal.com to find out more.