Common Mistakes

With a cybersecurity skills gap and a growing threat landscape, attacks have become a regular occurrence

As the cyber threat landscape has matured and evolved, cybersecurity incidents have become a regular occurrence. Data breaches occur daily, and headline-worthy ones at least weekly. These data breaches can cost their victims millions of dollars, damage their reputations and can even force them out of business.

As cyber threat actors become more skilled and sophisticated, they pose an ever-increasing threat to the average business. Development of advanced malware and the use of automation allow hackers to attack, scale their operations and increase their probability of success.

As a result, even the smallest organization requires comprehensive cyber defenses to protect themselves from attack. However, the cybersecurity industry is experiencing a massive manpower shortage, and skilled cybersecurity practitioners are becoming increasingly harder to come by.

As organizations try to make do with underskilled and understaffed cybersecurity teams, they don’t have the resources to create a mature security program, and essential tasks tend to slip through the cracks.

Weak Policies

Human beings have become the main target of cybercriminals trying to gain access to an organization’s network. While most modern software has bugs, and it is possible for an attacker to identify and exploit these vulnerabilities, it is much easier for an attacker to take advantage of simple mistakes that human beings make while using business accounts and devices.

For example, it is commonly known that many people use weak passwords and reuse them across multiple accounts. These passwords are frequently exposed in data breaches and can be a threat to an organization’s security.

If a business does not have a strong password policy and doesn’t test to determine if an employee is using a password revealed in a breach, it can be exposed to credential stuffing attacks.

As ransomware attacks become more frequent, and businesses increasingly move to the cloud, strong controls limiting access to sensitive data are becoming more important.

If an employee account is compromised, it may allow an attacker to access sensitive data (either on-premises or in the cloud) or give ransomware the access necessary to encrypt this data and demand a ransom from the organization.

Achieving compliance with most regulations requires an organization to have appropriate cybersecurity policies in place. However, these policies only help the organization avoid cybersecurity incidents and data breaches if they are enforced.

Organizations need to have visibility into the events and the ability to take prompt remediation actions if violations occur.

Ignoring Compliance Requirements

In recent years, the regulatory landscape has expanded dramatically. The EU’s General Data Privacy Regulation (GDPR) is the first of several new laws that have changed how enterprises can collect, process and store their customers’ data.

One of the most significant changes that came with the GDPR is the increased fines that can be levied for non-compliance. If an organization is the victim of a data breach that includes EU citizen data, they can be fined 20 million Euros or 4 percent of global turnover, whichever is greater.

While no EU regulator has levied the full fine to date, they have demonstrated a willingness to penalize businesses severely for non-compliance with the regulation, as shown by the fines announced last year for the Marriott and British Airways breaches.

Under GDPR, a business doesn’t even need to suffer a breach to be fined for non-compliance. While the maximum penalties are halved for non-compliance that doesn’t lead to a breach, the amount of the fine can still be significant. Failing to learn about and comply with data protection regulations can cost an organization severely.

Only Investing in Technology

A growing skills gap exists in cybersecurity, with about 3 million unfilled roles in 2019. The difficulty and cost of filling cybersecurity roles with skilled individuals have led many organizations to focus their limited cybersecurity budgets on technology. Cybersecurity research and development is a rapidly evolving field with many different providers offering solutions for a range of cybersecurity threats. While acquiring best-of-breed technology can help to increase an organization’s visibility into its network and to protect against new threat vectors, only having technology is not enough.

A failure to invest in cybersecurity talent can leave an organization open to attack. While new tools can be effective at detecting and mitigating specific threats, they require a skilled operator to be genuinely effective. Malicious actors have become very sophisticated and skilled in concealing malicious content within an organization’s usual traffic. A trained cyber analyst is required to analyze the events and alerts generated by cybersecurity technology and to differentiate between false positives and real threats.

With the ever-widening cybersecurity skills gap, most organizations no longer have the resources to acquire the skilled practitioners needed to protect their networks. Enterprises need to invest in their people in order to keep up with the rapidly evolving cyber threat landscape.

Not Understanding Data Flow

Collecting, processing and storing sensitive data is a core part of most organizations’ standard business practices. While the specific type of data may vary from customer data to research and development information to financial information, failing to manage and secure this data properly can put a business in trouble with regulators and impact their ability to continue doing business.

A core part of protecting sensitive information is having complete visibility into its location within the network. Most organizations take precautions to lock down access to their “crown jewel” database. In turn, an attacker who gains access to an internal network may not be able to access this database.

However, this doesn’t mean that the attacker will not be able to access and steal that data. Sensitive data may be stored in less secure locations, like backups designed to protect against the impact of a ransomware attack or test databases used in development environments. The failure to understand where data lives and moves in the network may mean that sensitive data is left exposed to an attacker.

Even if an organization secured its data stores and flows, this does not guarantee the data is protected. Employees within the organization require access to sensitive data in order to conduct daily business. If these accounts are compromised, the data may be open to attack. Organizations need complete visibility into how sensitive data is accessed in order to detect and prevent data theft.

No Full-Time Monitoring

The cyber threat landscape is rapidly accelerating as cybercriminals increasingly take advantage of automation and artificial intelligence (AI)/machine learning (ML). As a result, the time between the start of an attack and compromise of sensitive data may be measured in minutes.

The global nature of the internet means that attackers are unlikely to operate during business hours when the organization’s security team is on-site and ready to respond instantly to a potential threat. If an organization only performs monitoring during regular operating hours, an attacker could compromise a network and achieve their objectives with little or no opposition.

Securing a network against cyberattacks requires round-theclock monitoring. An organization needs to have enough trained staff on duty at all times to detect, investigate, and respond to potential threats. The impact and cost of a cybersecurity incident increases the longer that the attacker has access to the network. Waiting for the security team to get out of bed and into the office may be too late.

As the cyber skills gap grows, it will grow more difficult to acquire the in-house cybersecurity talent that a business needs to secure its network against attack. As skilled cybersecurity talent becomes rarer, organizations will increasingly make these and other mistakes that leave them vulnerable.

One solution to the cyber skills shortage is partnering with a Managed Security Services Provider (MSSP). An MSSP has the resources and security talent needed to provide the continual monitoring of an organization’s network that is to protect it against attack. By partnering with an MSSP, a business also gains access to world-class security expertise, which can be invaluable when designing security architecture and trying to avoid making common and critical cybersecurity mistakes.

This article originally appeared in the March 2020 issue of Security Today.

Featured

  • Analysis of AI Tools Shows 85 Percent Have Been Breached

    AI tools are becoming essential to modern work, but their fast, unmonitored adoption is creating a new kind of security risk. Recent surveys reveal a clear trend – employees are rapidly adopting consumer-facing AI tools without employer approval, IT oversight, or any clear security policies. According to Cybernews Business Digital Index, nearly 90% of analyzed AI tools have been exposed to data breaches, putting businesses at severe risk. Read Now

  • Software Vulnerabilities Surged 61 Percent in 2024, According to New Report

    Action1, a provider of autonomous endpoint management (AEM) solutions, today released its 2025 Software Vulnerability Ratings Report, revealing a 61% year-over-year surge in discovered software vulnerabilities and a 96% spike in exploited vulnerabilities throughout 2024, amid an increasingly aggressive threat landscape. Read Now

  • Evolving Cybersecurity Strategies: Uniting Human Risk Management and Security Awareness Training

    Organizations are increasingly turning their attention to human-focused security approaches, as two out of three (68%) cybersecurity incidents involve people. Threat actors are shifting from targeting networks and systems to hacking humans via social engineering methods, living off human errors as their most prevalent attack vector. Whether manipulated or not, human cyber behavior is leveraged to gain backdoor access into systems. This mainly results from a lack of employee training and awareness about evolving attack techniques employed by malign actors. Read Now

  • Report: 1 in 3 Easily Exploitable Vulnerabilities Found on Cloud Assets

    CyCognito recently released new research highlighting critical security vulnerabilities across cloud-hosted assets, revealing that one in three easily exploitable vulnerabilities or misconfigurations are found on cloud assets. As organizations increasingly shift to multi-cloud strategies, the findings underscore significant security gaps that could provide attackers with potential footholds into networks. Read Now

  • Built for Today, Ready for Tomorrow

    Selecting the right VMS is critical for any organization that depends on video surveillance to ensure safety, security and operational efficiency. While many organizations focus on immediate needs such as budget and deployment size, let us review some of the long-term considerations that can significantly impact a VMS's utility and flexibility. Read Now

New Products

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation.

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.