The coronavirus crisis has exposed many areas in business that had been neglected prior to the pandemic. And IT is no exception.
Cybersecurity in particular has proven a huge obstacle to overcome, with cybercriminals taking advantage of the chaos. Whether its targeting healthcare organisations involved in the development of the COVID vaccine, or businesses grappling with a speedy cloud migration to support their employees’ move to remote working. No industry has been left unturned and where there’s a vulnerability, there’s a risk.
Now the uncertainty is set to continue for longer than we could have ever expected, with the UK enforcing new restrictions across the country. So how can businesses look to ensure both their employees and customers are kept cyber safe throughout the disruption?
Embedding Cybersecurity Into Company Culture and IT
“With data breaches reported on a near-weekly basis in the national news, the view around cyberculture has changed considerably over the last few decades,” that’s according to Keiron Shepherd, Principal Solutions Engineer at F5. “We’ve gone from lone hackers in bedrooms to nation-states weaponising zero-day attacks.
“More than ever, businesses and individuals are starting to understand that data is a valuable currency that needs to be protected. This means that cyberculture is increasingly embedded into both our work and everyday lives. Cybercrime is now just an inevitable part of everyday life.”
Chris Huggett, SVP EMEA, Sungard AS agrees, suggesting that, “in today’s IT-driven business world, assessing technology risks is a critical part of business continuity planning in every company across every industry.” Huggett continues, “this is especially true when it comes to cybersecurity, where even the smallest IT footprint provides attackers with a gateway to global supply chains, and the ability to wreak havoc on countless stakeholders.”
Adapting to New Circumstances
But with everybody suddenly operating from home, patterns of work, and therefore network usage, changed too, which have had further impacts on the cybersecurity risks businesses are vulnerable to. According to Tim Hickman, Partner and data protection lawyer at law firm White & Case, “it is simply impossible for most businesses to be pro-active on all cybersecurity issues.” In light of this, Tim advises that, “it is essential for any business to understand its legal and regulatory compliance responsibilities and identify the relevant cybersecurity risks, take a pro-active approach wherever possible, and have a reactive plan in place where needed.”
Similarly, Chris Hodson, CISO, Tanium believes that increased threats are “a timely reminder for business leaders to incorporate resilience into their distributed workforce infrastructure if they’re going to manage the security challenges of this new world of work effectively.”
Hodson says, “many of the issues that emerged at the start of lockdown resulted from considerably overestimating preparedness for the security challenges that came with shifting to a distributed working environment. Our research found that 85% of business leaders thought they were prepared to manage the shift to widespread WFH. This confidence turned out to be ill-founded with 98% admitting they faced security challenges in the transition away from the office.
“Even before the virus emerged, concern among IT leaders was growing with tool sprawl, shadow IT, and legacy tech creating a slew of security challenges. Not only did widespread remote working exacerbate these existing issues, it also created a host of new security challenges, allowing cybercriminals to run amok during a period of deep confusion and uncertainty for businesses.
“Whether companies choose to permanently move their operations, return employees to the office, or some combination of both, implementing endpoint management and efficient security solutions should be a priority.”
No One is Safe
It’s not just businesses that need to make cybersecurity a priority. According to Shepherd, “cybercriminals are [also] becoming very adept at misleading voters with disinformation. This includes propagating false news, using bots to drive social media engagement and the strategic leaks of incriminating emails or confidential documents.” Shepherd continues, “mainstream awareness on these issues is growing. However, the fact remains that people spend a significant amount of time online and it is getting increasingly difficult to understand what is real and what is a bot-generated media post.”
Dave Palmer, Director of Technology, Darktrace said “cyber-attacks have evolved but the key to fighting them remains the same. Static security – creating rules about what is ‘good’ and ‘bad’ simply can’t keep pace.
“There is no silver bullet to cybersecurity but today we have the technology available that can stop novel attacks at machine-speed. Finding the right people with the right skills to defend organisations is important, but they cannot handle the challenge alone. We need to augment teams with AI that can make decisions in seconds.”
The Potential Consequences
So, what happens when businesses don’t have the appropriate security measures in place? Huggett warns that “while cybersecurity is a universal imperative of business resilience, there are certain industries in which the reputational damage of a cyber-attack can be particularly impactful. According to a recent poll of 2,000 UK consumers, organisations in the financial services industry are most at risk of losing their customer base, with over two-thirds (67%) of respondents claiming they would switch providers immediately if they became aware of cybersecurity flaws. The results also show home broadband and online retail service providers to be in high-risk categories, with the potential to lose 64% and 58% of the customers, respectively.”
To avoid such consequences, Hickman advises that, “in the wake of a cyber incident, establishing [an] initial snapshot assessment is incredibly important as it will drive not only the prioritisation of the response but the entire process. If an incident is correctly identified as high risk at the onset, the response timeline will accelerate, with organisational resources deployed more appropriately…. Principally, it’s about damage limitation and controlling the incident, so understanding the mitigating factors that might help to reduce risk to the business is key.”
Where Next?
Cybercriminals’ tactics are increasing in sophistication. They’re looking for vulnerabilities, and eventually, they will find them. Paired with the chaos of the pandemic; it’s a recipe for their success.
If businesses want to remain competitive and cope with the disruption of today’s unpredictable world, they need the skills, expert advice and technology to do so.
