The average cost of an online security breach for UK businesses is between £1.46 and £3.14 million. Worse still, in 2015 the industry reported a significant increase in the number of breaches in both large and small organisations at 90 and 74 per cent respectively.
[easy-tweet tweet=”Cyber #security is the biggest challenge for the UK right now and it’s spreading across many industries ” hashtags=”Cloud”]
One suggested reason for such a high increase in security breaches is that businesses are becoming more aware and effective in detecting and reporting cyber crimes. Good news if that is the case, but that doesn’t explain why organisations are still under threat. More importantly, what can they do to protect themselves?
Cyber security is the biggest challenge for the UK right now and it’s spreading rapidly across many industries – not just in IT. To tackle the issue head on, we must first understand the causes behind it.
The tidal wave of cyber threats
Data explosion has amassed huge amount of Internet traffic that flows through corporate networks at rapid speed. Nowadays, up to 80 per cent of a company’s data traffic is Internet-related. Lurking inside is malware and spyware waiting for the right moment to strike and infiltrate corporate networks. Our growing reliance on public and on-premise Wi-Fi is creating opportunities for criminals to conduct illegal activities right in front of us – yet these are often hidden in blind spots.
As the Internet traffic ebbs and flows, corporate users are also downloading unauthorised mobile and cloud-based applications, and uploading sensitive data onto public cloud storage systems like DropBox and Box. Many employees are unaware of the dangers of shadow IT. As such, they are unintentionally destroying their corporate security – and along with it the company’s reputation – from inside out.
CISO/IT has no choice but to fire fight in these situations. But without a clear single view of the various elements, it’s difficult to pinpoint where the cause of the breach originates or where is the best place to start (re)building defences.
Tackling cyber threats from high and low
The challenge can be very different depending on the size of the organisation.
Large enterprises have established IT security teams that grow with business needs. As such, they often have multiple point products implemented in silo. This creates a significant amount of data for analysis, which is an ineffective and time intensive way of monitoring potential threats. Target was one such example. Their silo approach became a risk in itself because IT was not able to act on the data quick enough to stop the data exfiltration from happening.
For small and medium size businesses, the challenge escalates in other ways. Many cannot afford to hire their own security specialists as these are often expensive and in high demand. Yet, SMEs experience the same level of cyberattacks as any large enterprises. In some cases, they are at a greater risk than most.
Blocking the attack is key, but organisations also need to be agile enough to be able to react to imminent threats quickly and effectively. The paradigm shift to adopting Security-as-a-Service solves these problems for both large and small organisations.
A security service removes the need for hiring a dedicated team of security specialists to maintain hardware and deal with uptime/availability. As an example, the Zscaler Internet Security Platform provides up to date threat feeds and adds scalable new functionalities (for example, sandboxing) to detect new threats as they emerge.
Running a security platform on the cloud offers the added advantage of 24/7 coverage protection for roaming users. It also provides better integration with SIEM systems to automate the identification of new threats and infected devices.
As a result, this will free up valuable time for security specialists to focus on protecting the architecture of the internal network, the data centres and inbound firewalls. They will also have a more effective way of identifying infected devices and ensure procedures are in place to quickly disinfect those devices and ensuring business users maintain a high level of productivity.
Cyber security strategy is a collective effort
Organisations need to wake up to the fact that shadow IT is happening right here, right now. CISO/IT cannot stop users from using their own apps. Enforcement will only encourage more people to deviate and break the rules. Instead, they should create an open policy but one that put the onus on the individual to stay safe online.
Cyber protection requires a consortium across the whole organisation. IT lays out the policy guidelines; HR coordinates training and oversees employment liability; marketing ensures the message resonates through internal communications and partner networks. But most important of all – the initiative must be led from the top, which is why savvy CEOs are fast becoming the driving force behind cyber security strategies.
Once the strategy is in place, the next step is to introduce it to the wider company, as well as supplier and partner networks. Education is key and part of the roll out must ensure all employees buy into the concept and understand why they may be held accountable for security breaches.
Users need to be made aware of the inherent risks on the Internet and shadow IT. This applies to the workplace as well as their private lives. BYOD continues to strive in the workplace, and employees are increasingly logging onto public Wi-Fi networks using their work laptops and mobile devices. In both cases, they are opening up the defence system and inviting hackers to invade.
Skills shortage attracts ‘cowboy’ services
The bigger skills gap challenge, however, is that global demand for cyber security experts outstrips supply by almost a third. According to the non-profit security consortium (ISC)2, private and public sector organisations will require six million security professionals by 2019 to effectively tackle cyber crimes. However, only 4.5 million have the necessary qualifications.
Skills shortage in cyber security will mean that IT and business leaders need to outsource security protection and defence mechanisms. As applications move outside of traditional data centres into the cloud, the smart approach is to deploy security measures that also runs on the cloud. One of the immediate benefits is 24/7 monitoring, which provides CISO/IT with better visibility into unusual spikes in traffic and allows them to anticipate possible cyber attacks before they hit the core network.
However, the lack of technical skills in-house restricts the freedom in which organisations can customise and manage their own security infrastructures. Instead, they have no choice but to look externally for assistance from consultants and managed service providers.
Businesses need to be careful when selecting a technology supplier. A wrong choice could lead to a false sense of security, more chaos and disastrous consequences.
[easy-tweet tweet=”Choosing the wrong supplier can lead to a false sense of #security, more chaos and disastrous consequences” hashtags=”Cloud”]
All is not lost. If executed and promoted in the right way, the spike in market demand and generous training investment will spur a new generation of talent into the industry, guaranteeing a safer digital future for everyone. This is why cyber security initiatives must be driven from the top and be incorporated as part of the boardroom strategy.
Matt Piercy, Vice President and General Manager EMEA, Zscaler
Matt Piercy is the Vice President and General Manager of EMEA, Zscaler. He is responsible for the overall productivity, growth and effectiveness of the entire EMEA sales organisation.
Prior to Zscaler, Matt spent seven years as the Vice President of North EMEA at VMWare. He led over 1,000 people through immense growth, while simultaneously bringing in revenue measured in the high hundreds of millions. His responsibility included building and leading both the channel and direct sales organisations as well as all associated field functions.
A veteran in the security industry, Matt has 22 years of experience in sales and general management positions throughout EMEA. Previously, he was the general manager at F-Secure and also took up channel management positions at Citrix.