The month of October celebrates Cybersecurity Awareness Month with the aim to raise awareness about the importance of cybersecurity and provide people with the knowledge and resources to stay safe and secure online.
In the current climate of rising cyberattacks, this has never been more important. Cybercrime has risen by 600% over the past year according to insurance firm Embroker; and this trend shows no sign of slowing down. Not only are cyberattacks growing in frequency, but the severity of such attacks are also increasing as cybercriminals become more sophisticated and their next moves get harder to predict.
With this in mind, eWeek UK has spoken to 10 security experts to understand the rise in attacks and gain insight into how organisations can best prepare themselves to defend cyberattacks from accessing their systems.
New Working Habits = New Cybersecurity Risks
Since the outbreak of the COVID-19 pandemic at the beginning of 2020, we have seen a huge increase in the number of people working remotely. Whilst this undoubtedly has its benefits – and allowed many organisations to survive the pandemic – it has led to increased cybersecurity risks.
“Remote work unexpectedly became the norm in 2020, and as we close out 2021, the hybrid work model may be here to stay for decades to come,” notes Tyler Farrar, CISO at Exabeam. “These changing approaches to work have caused security leaders and their teams to balance what’s necessary to keep sensitive company data and assets safe and secure in organisational landscapes that no longer have a security perimeter. People are everywhere now.”
“With hybrid working now commonplace, many employees are still working outside the ‘castle’, without the protection of the secure office environment (or the moat and drawbridge),” furthers Gary Cheetham, CISO at Content Guru.
“Cybercriminals are all too aware of this opportunity and are going full throttle with email phishing attacks designed to lure unsuspecting employees into downloading malware. The biggest threat is ransomware. With new threats coming from every angle, it is essential that business leaders empower and encourage employees to maintain cyber hygiene – the basics of cybersecurity and the most fundamental defence of all.”
Thomas Cartlidge, Head of Threat Intelligence at Six Degrees, summarises: “Strong cybersecurity hygiene has never been as important as it is today. As workers get settled into hybrid environments it is critical your employees protect their identity while at work and at home.”
Educating Employees
With employees working remotely and outside of the corporate firewalls, it is essential that they are knowledgeable about how to avoid falling into the traps laid by cybercriminals.
“In today’s digital age, companies must continuously train their employees and build a security-minded workforce that’s aware of the multitude of threats they face. Indeed, with threats rising across expanding attack surfaces, having a good understanding of cybersecurity is no longer just a ‘nice to have’,” explains Don Mowbray, EMEA Lead, Technology & Development at Skillsoft.
“Having a creative approach to training can make a significant difference in both engaging employees and making them more proficient in identifying cyber threats. Leveraging blended learning mixes styles, tactics, and content delivery modalities that make for a robust, effective and tailored environment for all. In cybersecurity training, it can involve putting the practical skills learned to the test in controlled practice labs or gamified style attacker versus defender environments, with traditional courses and lessons layered throughout, helping learners evaluate their skills via a hands-on approach. This can be particularly effective at taking security practitioners beyond traditional lessons and into real-life scenarios – giving them the tools and experience they need to tackle any threats that they may encounter head-on.”
Cheetham agrees: “Security leaders simply cannot overlook the importance of educating employees to keep the organisation watertight. We encourage our team to question anything that seems at all suspicious, and to go with their gut instinct or ask for advice where needed. Regular training on cybersecurity and the hygiene aspects using engaging and accessible resources is the best way to cultivate a highly secure workforce.”
However, with the cybersecurity skills gap persisting for the fifth year in 2021, finding the right fit for your security team can be a daunting and somewhat challenging task. With this ongoing shortage, it is key that organisations retain and utilise the employees that they have.
“When it comes to ensuring cyber talent retention, establishing the right working environment is critical to keeping people engaged and motivated to stay,” notes Tim Bandos, CISO & VP Security Managed Services at Digital Guardian. “Having policies to ensure there’s an effective work-life balance and offering solid benefits are important elements when it comes to employee retention. I also believe that if you have a highly collaborative and engaging team that focuses on achieving group goals and taking the time to reward and celebrate them, it goes a very long way in countering anyone’s interest in leaving.”
How to be Cyber Smart
Employees should not be your only line of defence against cyberattacks. Making cyber smart decisions that align with your wider organisational strategy is an essential element of ensuring success in an uncertain digital landscape.
“Cyber resilience is a renewed focus on keeping an organisation resilient and operational in the midst of adverse cybersecurity conditions,” explains Wes Spencer, Vice President of the External Chief Science Office at ConnectWise. “Let’s build resilience to keep our organisation functional when, not if, the big cyberattack happens. It allows us to focus on faster response and recovery to any threat. To be clear, we should not give up on prevention, we simply need to have a new focus on cyber resilience. After all, if we’re unable to stop all cyberattacks, maybe we should start to focus on making them less impactful when they occur.”
There are a number of different tools that can aid and support an organisation’s employees and cybersecurity defences.
“It can be difficult for busy internal security teams to allocate time and resources to essential, but not urgent, tasks such as identifying the most effective local or off-site backup location for each data tier, or analysing the operational impact to avoid performance degradation for systems and applications,” explains Andy Collins, Head of Security at Node4. “Security MSPs can provide great aid in preventing cyberattacks by providing technical support, filling technical gaps, and staying up to date with the latest threat and security technologies in order to resist their ever-changing nature.”
“Having multi-factor authentication (MFA) across your workforce is the sort of cybersecurity hygiene that should be absolutely fundamental in 2021,” adds Cartlidge.
Danny Lopez, CEO at Glasswall Solutions, stresses that “traditional sandboxing and antivirus software aren’t enough. Implementing solution-based file protection software like Content Disarm and Reconstruction (CDR) can rebuild files to a higher security standard so users can benefit from safe, clean files and organisational leadership can have peace of mind.”
“Sophisticated AI is able to predict, detect, and deter financial crime. By using advanced machine learning methods criminal activity can be exposed, whilst prioritising and contextualising security alerts for human assessment. Strengthening identity verification and monitoring every transaction using hundreds of collaborating detectors, enables emerging patterns of fraud to be identified with millisecond latency,” advocates Martin Rehak, Founder and CEO at Resistant AI.
Neil Jones, Cybersecurity Evangelist at Egnyte, concludes with the advice to “consistently update your cyberattack prevention strategies and implement practical measures like the following, which will protect you from falling victim to potential attacks:
- Make compulsory cybersecurity awareness training a way of life, rather than a once-a-year IT requirement.
- Limit access to mission-critical data on a ‘business need to know’ basis.
- Advocate a proactive approach to detect data misuse – including potential insider threats – before it’s too late.
- Encourage all of your company’s stakeholders to speak up if they see a potential IT security issue. Just like at the airport or in a train station, ‘if they see something, they should say something’.”
