Story image

Businesses can't outrun cybercriminals but they can 'outsmart' them

20 Jul 17

​Cyber crime in recent times has hit an all new high – think WannaCry and Petya, both of which were global attacks affecting hundreds of thousands and were just in the last couple of months.

According to Empired, most businesses believe that because they have security controls in place, they’re protected against cybercriminal but that simply isn’t true.

“Business beats with a digital heart and the rate of cybercrime is increasing exponentially,” says national business manager for Networks and Security at Empired, Mark Blower.

“It’s essential for organisations to understand the threat landscape and how to mitigate the risk of being attacked.”

Blower says cybercrime has become an industry in which large organisations pay educated hackers a daily wage to find and exploit vulnerabilities.

“There are around 390,000 new malware threats every single day: it’s impossible to keep up with this volume of threats by simply relying on traditional technology like antivirus,” says Blower.

“Simply having security controls recorded in a policy is not enough, they have to be lived and acted upon every day.”

Blower asserts that business can invest in tools, processes and policies to identify when they are being attacked and how to respond, contain and recover from a successful breach – so that they’re prepared when it happens from a malicious hacker.

One of the big problems, according to Empired, is that because of a lack of resources and competing demands IT teams can only spend a fraction of every day on security activities while a cybercriminal’s full-time job is to find ways to breach an organisation.

“The big trap many organisations fall into is taking a compliance-based approach to security. By definition, this means that the decision cycle on implementing and updating controls will be longer than the attackers’ development cycle, letting cybercriminals get ahead,” Blower says.

“Given businesses can’t outrun the cybercriminals, the only other option is to outsmart them.”

Empired has provided six key facets of cybersecurity protection for businesses to consider:

1. Set clear policies around what is and isn’t allowed, and what to do if a person suspects they’re being attacked.

2. Update perimeter protection to next-gen firewalls that meet reporting requirements, deep-dive into traffic, and decrypt traffic.

3.  Implement unified threat management tools as they give security teams full visibility into what people are doing on the network.

4. Real-time threat analytics are the only way to protect against zero-day threats and are vital as traditional signature-based protection is no longer adequate.

5. Application control devices (ACDs). ACDs are the last line of defence as they protect against people who are already inside the network, such as guests or malicious attacks from employees, ensuring only the right people access applications.

6. Security incident and event management (SIEM) lets IT teams automate parts of the security puzzle, letting the team proactively find threats that might not be visible using standard logs

Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.
Proofpoint launches feature to identify most targeted users
“One of the largest security industry misconceptions is that most cyberattacks target top executives and management.”
McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.
25% of malicious emails still make it through to recipients
Popular email security programmes may fail to detect as much as 25% of all emails with malicious or dangerous attachments, a study from Mimecast says.
Google Cloud, Palo Alto Networks extend partnership
Google Cloud and Palo Alto Networks have extended their partnership to include more security features and customer support for all major public clouds.