Common Mistakes
With a cybersecurity skills gap and a growing threat landscape, attacks have become a regular occurrence
As the cyber threat landscape
has matured and
evolved, cybersecurity
incidents have become a
regular occurrence. Data
breaches occur daily, and headline-worthy
ones at least weekly. These data breaches
can cost their victims millions of dollars,
damage their reputations and can even
force them out of business.
As cyber threat actors become more
skilled and sophisticated, they pose an
ever-increasing threat to the average business.
Development of advanced malware
and the use of automation allow hackers
to attack, scale their operations and increase
their probability of success.
As a result, even the smallest organization
requires comprehensive cyber defenses
to protect themselves from attack.
However, the cybersecurity industry is experiencing
a massive manpower shortage,
and skilled cybersecurity practitioners are
becoming increasingly harder to come by.
As organizations try to make do with
underskilled and understaffed cybersecurity
teams, they don’t have the resources to
create a mature security program, and essential
tasks tend to slip through the cracks.
Weak Policies
Human beings have become the main target
of cybercriminals trying to gain access
to an organization’s network. While most
modern software has bugs, and it is possible
for an attacker to identify and exploit
these vulnerabilities, it is much easier for
an attacker to take advantage of simple
mistakes that human beings make while
using business accounts and devices.
For example, it is commonly known
that many people use weak passwords
and reuse them across multiple accounts.
These passwords are frequently exposed
in data breaches and can be a threat to an
organization’s security.
If a business does not have a strong
password policy and doesn’t test to determine
if an employee is using a password
revealed in a breach, it can be exposed to
credential stuffing attacks.
As ransomware attacks become more
frequent, and businesses increasingly
move to the cloud, strong controls limiting
access to sensitive data are becoming
more important.
If an employee account is compromised,
it may allow an attacker to access
sensitive data (either on-premises or in the
cloud) or give ransomware the access necessary
to encrypt this data and demand a
ransom from the organization.
Achieving compliance with most regulations
requires an organization to have
appropriate cybersecurity policies in place.
However, these policies only help the organization
avoid cybersecurity incidents and
data breaches if they are enforced.
Organizations need to have visibility into
the events and the ability to take prompt remediation
actions if violations occur.
Ignoring Compliance
Requirements
In recent years, the regulatory landscape has expanded dramatically.
The EU’s General Data Privacy Regulation (GDPR) is the
first of several new laws that have changed how enterprises can
collect, process and store their customers’ data.
One of the most significant changes that came with the GDPR
is the increased fines that can be levied for non-compliance. If an
organization is the victim of a data breach that includes EU citizen
data, they can be fined 20 million Euros or 4 percent of global
turnover, whichever is greater.
While no EU regulator has levied the full fine to date, they
have demonstrated a willingness to penalize businesses severely
for non-compliance with the regulation, as shown by the fines announced
last year for the Marriott and British Airways breaches.
Under GDPR, a business doesn’t even need to suffer a breach
to be fined for non-compliance. While the maximum penalties
are halved for non-compliance that doesn’t lead to a breach, the
amount of the fine can still be significant. Failing to learn about
and comply with data protection regulations can cost an organization
severely.
Only Investing in Technology
A growing skills gap exists in cybersecurity, with about 3 million
unfilled roles in 2019. The difficulty and cost of filling cybersecurity
roles with skilled individuals have led many organizations to
focus their limited cybersecurity budgets on technology.
Cybersecurity research and development is a rapidly evolving
field with many different providers offering solutions for a range
of cybersecurity threats. While acquiring best-of-breed technology
can help to increase an organization’s visibility into its network
and to protect against new threat vectors, only having technology
is not enough.
A failure to invest in cybersecurity talent can leave an organization
open to attack. While new tools can be effective at detecting
and mitigating specific threats, they require a skilled operator
to be genuinely effective. Malicious actors have become
very sophisticated and skilled in concealing malicious content
within an organization’s usual traffic. A trained cyber analyst
is required to analyze the events and alerts generated by cybersecurity
technology and to differentiate between false positives
and real threats.
With the ever-widening cybersecurity skills gap, most organizations
no longer have the resources to acquire the skilled practitioners
needed to protect their networks. Enterprises need to invest
in their people in order to keep up with the rapidly evolving
cyber threat landscape.
Not Understanding Data Flow
Collecting, processing and storing sensitive data is a core part of
most organizations’ standard business practices. While the specific
type of data may vary from customer data to research and development
information to financial information, failing to manage and
secure this data properly can put a business in trouble with regulators
and impact their ability to continue doing business.
A core part of protecting sensitive information is having complete
visibility into its location within the network. Most organizations
take precautions to lock down access to their “crown
jewel” database. In turn, an attacker who gains access to an internal
network may not be able to access this database.
However, this doesn’t mean that the attacker will not be able
to access and steal that data. Sensitive data may be stored in less
secure locations, like backups designed to protect against the impact
of a ransomware attack or test databases used in development
environments. The failure to understand where data lives
and moves in the network may mean that sensitive data is left
exposed to an attacker.
Even if an organization secured its data stores and flows, this
does not guarantee the data is protected. Employees within the organization
require access to sensitive data in order to conduct daily
business. If these accounts are compromised, the data may be open
to attack. Organizations need complete visibility into how sensitive
data is accessed in order to detect and prevent data theft.
No Full-Time Monitoring
The cyber threat landscape is rapidly accelerating as cybercriminals
increasingly take advantage of automation and artificial
intelligence (AI)/machine learning (ML). As a result, the time
between the start of an attack and compromise of sensitive data
may be measured in minutes.
The global nature of the internet means that attackers are unlikely
to operate during business hours when the organization’s
security team is on-site and ready to respond instantly to a potential
threat. If an organization only performs monitoring during
regular operating hours, an attacker could compromise a network
and achieve their objectives with little or no opposition.
Securing a network against cyberattacks requires round-theclock
monitoring. An organization needs to have enough trained
staff on duty at all times to detect, investigate, and respond to
potential threats. The impact and cost of a cybersecurity incident
increases the longer that the attacker has access to the network.
Waiting for the security team to get out of bed and into the office
may be too late.
As the cyber skills gap grows, it will grow more difficult to
acquire the in-house cybersecurity talent that a business needs
to secure its network against attack. As skilled cybersecurity talent
becomes rarer, organizations will increasingly make these and
other mistakes that leave them vulnerable.
One solution to the cyber skills shortage is partnering with
a Managed Security Services Provider (MSSP). An MSSP has
the resources and security talent needed to provide the continual
monitoring of an organization’s network that is to protect it
against attack. By partnering with an MSSP,
a business also gains access to world-class security
expertise, which can be invaluable when
designing security architecture and trying to
avoid making common and critical cybersecurity
mistakes.
This article originally appeared in the March 2020 issue of Security Today.