Page 44 - Security Today, March 2020

“Even the smallest organization requires comprehensive cyber defenses to protect themselves from attack.”
Ignoring Compliance
Requirements
In recent years, the regulatory landscape has expanded dramati- cally. The EU’s General Data Privacy Regulation (GDPR) is the first of several new laws that have changed how enterprises can collect, process and store their customers’ data.
One of the most significant changes that came with the GDPR is the increased fines that can be levied for non-compliance. If an organization is the victim of a data breach that includes EU citi- zen data, they can be fined 20 million Euros or 4 percent of global turnover, whichever is greater.
While no EU regulator has levied the full fine to date, they have demonstrated a willingness to penalize businesses severely for non-compliance with the regulation, as shown by the fines an- nounced last year for the Marriott and British Airways breaches.
Under GDPR, a business doesn’t even need to suffer a breach to be fined for non-compliance. While the maximum penalties are halved for non-compliance that doesn’t lead to a breach, the amount of the fine can still be significant. Failing to learn about and comply with data protection regulations can cost an organi- zation severely.
Only Investing in Technology
A growing skills gap exists in cybersecurity, with about 3 million unfilled roles in 2019. The difficulty and cost of filling cybersecu- rity roles with skilled individuals have led many organizations to focus their limited cybersecurity budgets on technology.
Cybersecurity research and development is a rapidly evolving field with many different providers offering solutions for a range of cybersecurity threats. While acquiring best-of-breed technolo- gy can help to increase an organization’s visibility into its network and to protect against new threat vectors, only having technology is not enough.
A failure to invest in cybersecurity talent can leave an orga- nization open to attack. While new tools can be effective at de- tecting and mitigating specific threats, they require a skilled op- erator to be genuinely effective. Malicious actors have become very sophisticated and skilled in concealing malicious content within an organization’s usual traffic. A trained cyber analyst is required to analyze the events and alerts generated by cyber- security technology and to differentiate between false positives and real threats.
With the ever-widening cybersecurity skills gap, most organi- zations no longer have the resources to acquire the skilled practi- tioners needed to protect their networks. Enterprises need to in- vest in their people in order to keep up with the rapidly evolving cyber threat landscape.
Not Understanding Data Flow
Collecting, processing and storing sensitive data is a core part of most organizations’ standard business practices. While the specific
42
type of data may vary from customer data to research and develop- ment information to financial information, failing to manage and secure this data properly can put a business in trouble with regula- tors and impact their ability to continue doing business.
A core part of protecting sensitive information is having com- plete visibility into its location within the network. Most orga- nizations take precautions to lock down access to their “crown jewel” database. In turn, an attacker who gains access to an inter- nal network may not be able to access this database.
However, this doesn’t mean that the attacker will not be able to access and steal that data. Sensitive data may be stored in less secure locations, like backups designed to protect against the im- pact of a ransomware attack or test databases used in develop- ment environments. The failure to understand where data lives and moves in the network may mean that sensitive data is left exposed to an attacker.
Even if an organization secured its data stores and flows, this does not guarantee the data is protected. Employees within the or- ganization require access to sensitive data in order to conduct daily business. If these accounts are compromised, the data may be open to attack. Organizations need complete visibility into how sensitive data is accessed in order to detect and prevent data theft.
No Full-Time Monitoring
The cyber threat landscape is rapidly accelerating as cybercrimi- nals increasingly take advantage of automation and artificial intelligence (AI)/machine learning (ML). As a result, the time between the start of an attack and compromise of sensitive data may be measured in minutes.
The global nature of the internet means that attackers are un- likely to operate during business hours when the organization’s security team is on-site and ready to respond instantly to a poten- tial threat. If an organization only performs monitoring during regular operating hours, an attacker could compromise a network and achieve their objectives with little or no opposition.
Securing a network against cyberattacks requires round-the- clock monitoring. An organization needs to have enough trained staff on duty at all times to detect, investigate, and respond to potential threats. The impact and cost of a cybersecurity incident increases the longer that the attacker has access to the network. Waiting for the security team to get out of bed and into the office may be too late.
As the cyber skills gap grows, it will grow more difficult to acquire the in-house cybersecurity talent that a business needs to secure its network against attack. As skilled cybersecurity tal- ent becomes rarer, organizations will increasingly make these and other mistakes that leave them vulnerable.
One solution to the cyber skills shortage is partnering with a Managed Security Services Provider (MSSP). An MSSP has the resources and security talent needed to provide the contin- ual monitoring of an organization’s network that is to protect it against attack. By partnering with an MSSP,
a business also gains access to world-class se-
curity expertise, which can be invaluable when
designing security architecture and trying to
avoid making common and critical cybersecu-
rity mistakes.
Dan Hoban is the chief strategy officer at Nuspire.
0320 | SECURITY TODAY
CYBERSECURITY