Be Defensive: What Cybersecurity Experts Do (and Why it Matters)

Cybersecurity experts are often asked for advice on why cybersecurity is needed. Modern security means not only ensuring that you are physically safe and protecting your assets, but also includes the safety of your digital security and assets. Think about where you are the most vulnerable, and let that sink in for a moment.

What do cybersecurity professionals do?

The list of responsibilities for cybersecurity professionals is extensive, but essentially they are responsible for preventing online data from being compromised. According to Staffan Truvé, Chief Technology Officer of Recorded Future, “We spend a lot of money trying to fix things after they happen, but we should stop the attacks before they happen.”¹

To put the price of cybercrime into perspective, an Accenture report on the costs of cybercrime was published in 2017 – detailing the average costs for a cyberattack that lasts less than 30 days to total $7.7 million. If the cyber attack lasts longer than 90 days this average cost escalates to $12.2 million.²

We spend a lot of money trying to fix things after they happen, but we should stop the attacks before they happen.

STAFFAN TRUVÉ
CHIEF TECHNOLOGY OFFICE OF RECORDED FUTURE

If the following questions are making you uncomfortable, you should seriously consider re-evaluating some of your – and your team’s – online behaviours:

• When did your employees last change the password to any of their accounts?
• Have your employees replied with sensitive information to strange emails?
• Do your employees overshare moments of their life on social media by posting photographs of their houses, pets or children?

All the security systems and protocols that you have paid for, installed and implemented at great cost, mean nothing if reckless behaviour is still enabling cyberattacks. For this reason, we have outlined some useful advice from cybersecurity professionals below on how to increase the security of your organisation.

Access vs control vs privacy: these three variables provide vulnerable entry points. Increasing risk in the digital world has seen higher cybercrime statistics since we developed technological marvels like the internet, WiFi and cloud-based systems.

Why cybersecurity is needed

According to cybersecurity experts, consider implementing these security measures to protect your business from cybercrime and losses:

1. Complete a cyber risk security analysis

John Chambers, former CEO of Cisco said, “There are two types of companies: those who have been hacked, and those who don’t yet know they have been hacked.”³ Fortunately, it’s not all doom and gloom. There are ways to hinder cybercriminals from targeting your organisation. Dealing with this requires businesses to be aware of the risks posed through a cyber risk security analysis.⁴

This entails performing an assessment on the organisation’s technology and information systems, including processes, software and hardware:⁵ all things required to keep the organisation running in this digital age. This becomes an essential part of the risk management strategy. According to Sanjay Deo, President of 24by7 Security, “A risk assessment is often a mandatory baseline that compliance regulations ask for.”⁶

The importance of a cyber risk security analysis can’t be overstated as it:

• Determines the relevance of threats to your organisation
• Focuses on specific internal and external vulnerabilities
• Assesses the impact of exploiting the identified vulnerabilities
• Compares the risks of exploitation

Cyber risk assessments also raise awareness within the company of digital vulnerabilities by serving as an executive summary of sorts. This assists C-suite executives in highlighting specific problems without going into unnecessary details, and in determining what areas of the business need more growth and investment.

There are two types of companies: those who have been hacked, and those who don’t yet know they have been hacked.

JOHN CHAMBERS
FORMER CEO OF CISCO

2. Ensure you have cybersecurity insurance

Linking to the points above, if you want cybersecurity insurance, you will first need to have performed a cyber risk assessment.⁷ It’s becoming common practice to take out insurance against the harmful risks of cybercrime. Coverage for this is industry-specific and higher risk industries like retail and finance will be more expensive to insure.

Scott Lockman, the Director of Commercial Insurance at Clements Worldwide states, “Cyber-liability protection has been around for about a decade, but insurance companies have become better at identifying risks and are able to underwrite against those risks.”

3. Train your staff on secure practices

Human error is the greatest threat to cybersecurity, internally and externally, for your organisation.⁹ Cyrus Walker, CEO of Chicago-based Data Defenders says research shows approximately 80% of security-related incidents occur as a result of employee behaviour.¹⁰ The major risk factor in phishing and malware attacks is simply down to human nature, and our ability to be tricked by others. The trick to ensuring that your cybersecurity is secure, is by effecting behavioural changes to the users of your system.

Most organisations don’t properly train their staff on cybersecurity counter-measures. This training should be focused on everyone, up to CEO and including senior management level.¹¹ These people are the most likely people to be targeted due to their high-level positions within the organisation.

Most criminals use three simple sets of questions to obtain key information that can be mined to allow criminals access to your personal accounts.¹² The way they gain access to this information can seem innocent, such as those fun quizzes that you complete on social media.¹³

Research shows approximately 80% of security-related incidents occur as a result of employee behavior

CYRUS WALKER
CEO OF CHICAGO-BASED DATA DEFENDERS

There are three common questions that may be asked to retrieve or change your password:¹⁴

• What was your or your mother’s maiden name?
• What was the street that you used to live on as a child?
• What’s your pet’s name?

Training and awareness need to be reinforced consistently, as people allow criminals access points to sensitive data, not the internet. This training needs to demonstrate smart behaviours for how to interact with the digital world, to ensure you avoid making yourself the target of a cyberattack.

Chairman of IoD Surrey and Managing Director of ramsac, Rob May emphasises in his TEDx speech on cybersecurity, “An intelligent person needs reinforcement of an idea at least six times, but you won’t always work with intelligent people. Therefore, companies don’t reinforce this as frequently as they should.”¹⁶

4. Make sure your top-level employees understand the impact of cybercrime

If your board members aren’t making cybercrime a priority, then there is a disconnect between their understanding of the technological landscape, and the potentially harmful and often long-term effects of cybercrime.¹⁷ There should be board processes in place to evaluate, strategise, and handle cybercrime.

May succinctly puts this point across by stating that, “We should trust less in the digital world… cybersecurity isn’t merely an IT problem, it needs to be embraced from the top down to the bottom levels of an organisation.”¹⁸

5. Update your policies concerning privacy and cybersecurity

Are your privacy and security policies up-to-date? Most businesses outsource services or products to third parties and it’s important to ensure those third parties are following your privacy and security policies if they have access to your internal software and servers.¹⁹

6. Change your passwords regularly

Using one password or even one password with slight variations is risky. The problem with changing your password often is that you may not remember all the passwords. An easy method to circumvent this is by using a password manager that can assist with password generation and logging into your accounts.²⁰

7. Be smart about sharing personal information

Phishing is exactly what the name sounds like. Cybercriminals are fishing, hoping that with the right bait, you’ll be caught – hook, line and sinker.²¹ Phishing often resembles emails that ask you to reset your password or account information through an infected link. The email is supposed to represent a legitimate company, containing their branding and email style. Usually, small details on the email will help you to detect if this is a genuine email from that company or not. Phishing has also evolved into “whaling” – where top-tier people in the organisation are targeted to steal company-sensitive information.²²

8. Understand that your Internet of Things (IoT) devices have poor security

You may not think your printer needs to be secure, but that seemingly innocuous object has been the focal point of many cyberattacks in recent years. According to Wired, “A single open port on a network connected printer is all a sophisticated malware attack needs to infect a network, send copies of itself to other connected devices and potentially seize confidential data.”²³

Be more aware of your connected devices – every device is a potential backdoor that a hacker can use to infiltrate your organisation. These include: USBs, CCTV cameras, routers and printers. Most of these devices are made to connect to your security network, and have security features. The cost of overlooking cybersecurity for your IoT devices can run into millions, and simply using these features may mitigate the severity of a cyberattack quite drastically.

9. Lock your phone or laptop when unattended

The danger of leaving your device unattended with all your information readily available, especially in public or workspaces isn’t worth the risk. Always lock your devices if you leave their vicinity.²⁵

10. Be careful of free WiFi

Criminals can use this as an entry point into your devices and steal your personal data.²⁶ Most publicly accessible WiFi spots require you to login to use the free WiFi. Malware such as keyloggers or spyware can then be downloaded onto your mobile or the electronic device you’re using. From this, hackers can gain access to your private information. On top of being generally wary of free WiFi, it’s also a good idea to ensure you have anti-virus software installed on your devices.

Cybersecurity professionals play a vital role in identifying threats and protecting online data. As the world becomes increasingly more reliant on digital spaces, cybersecurity professionals need to be more proactive in preventing cybercrime. Become your own firewall to aid in the fight against cybercrime. Laziness and ignorance are weaknesses that cybercriminals rely on to exploit digital vulnerabilities. The future of cybersecurity rests upon humans being savvy enough to control access to their private information.

---