Business First Family Business, Accounting, Finance, Investing, Marketing And Management
It only takes one IT security lapse to undermine the foundations of an otherwise sound organization. Some organizations are large enough for the government to care about its compromise. Others suffer crippling breaches in quiet anonymity. Regardless of your organization’s position, you have an obligation to your stakeholders and employees to do everything in your power to strengthen your cybersecurity posture.
As we prepare to close out the second decade of the 21st century and welcome the third, it’s as good a time to improve your cybersecurity protocols and stay updated on the latest threats. That way, you can avoid the worst office security mistakes and protect your business. Keep reading to discover the most risky trends that threaten your company’s cybersecurity posture.
Increasingly Sophisticated Ransomware Attacks
You’ve heard of ransomware. Could you explain to a room full of investors why your company should invest in a comprehensive set of ransomware mitigation strategies, including cloud backup protocols that limit data loss and minimize downtime? Ransomware is an insidious threat. And it’s only growing more so. In upcoming years, expect to face an array of sophisticated desktop protocol attacks that compromise your system before you ever realize something is amiss. All you can do is prepare for what’s coming.
Growing Complexity In The Regulatory Landscape
This isn’t a direct threat to your IT security posture, per se. But it could complicate your response to compromises that do occur and may put your organization at odds with regulatory and law enforcement authorities in territories where you do business.
Because regulatory complexity isn’t on its face a cybersecurity matter, your in-house IT department and external security partners may not be the best resources to deal with it. Instead, you may need to redouble your investment in internal and external counsel.
The Rise Of Social Media Phishing
Email phishing has been with us since the earliest days of the Internet. Businesses still deal with phishing attacks on a daily basis. Social media phishing is a newer beast, but it’s increasingly impactful as the digital center of gravity migrates to social networks and away from Internet 1.0 infrastructure like email.
Social media phishing is a difference of degree, not kind. The same general principles apply to its execution, as do the same general mitigation strategies for its would-be victims. Education is key. To the extent that your employees and contractors use your internal social media assets to communicate, you need to apprise them of the associated risks.
New And Improved Spearphishing Campaigns
Spearphishing is another perennial cyber threat that’s experiencing something of a resurgence. The latest trend is evasive spearphishing attacks, which resemble old-fashioned “long cons” in the digital space. Evasive spearphishing attacks use a complex combination of tactics to lull victims into complacency and bypass email security filters. The typical play can take months or even years to pull off.
The most involved spearphishing attacks are reserved for the highest-value targets, generally occupants of larger organizations’ C-suites and vendors for enterprises or government agencies with abundances of sensitive information at their disposal.
Again, training is essential here. It’s on you to educate your employees on the signs of a spearphishing attack. You need to develop protocols and policies to mitigate their impact.
Targeted “Weakest Link” Attacks
Could you identify your company’s weakest links, right now? Its very survival could depend on your ability to do so, not to mention your ability to protect (and educate) those links. You’ll need to grapple with the prospect of “weakest link” attacks targeting the most vulnerable people on your team — and, perhaps more importantly, the most vulnerable vendors in your supplier ecosystem.
At the risk of beating a dead horse, education is key here: You need to keep your employees apprised of the approaches they may or may not see and the procedures for reporting and parrying those threats. And you’ll need to hold your vendors accountable for their own security procedures, knowing full well that a single exploited lapse at any position on your value chain could redound to devastating effect.
Public Sector Vendor Attacks
It’s not just “weakest link” vendors and employees. Direct attacks on government IT are increasingly common, as well. You might not helm a public sector agency. But there’s a decent chance that your organization has designs on contracting with one. If that’s the case, your present cybersecurity posture may not be adequate to address the threats you’re likely to face in your role.
Ever Stricter Vendor Compliance Requirements
As cyber threats grow more sophisticated, enterprises and governments grow pickier about with whom they choose to work. This manifests in mushrooming data security standards for prospective vendors. What’s new these days is that the same exacting and often bureaucratic requirements imposed by public agencies and highly regulated private enterprises (such as banks) for years are beginning to appear in formerly freewheeling corners of the private sector, thanks to high-profile data breaches at companies. Vendors without the resources to adapt risk losing out on lucrative contracts.
An Explosion In Mobile App Fraud
Furthermore, mobile app install fraud is on the rise. The increase in mobile app fraud is very nearly geometric, and the trend shows few signs of slowing. In a BYOD environment, it’s incumbent upon your leadership and IT security teams to educate your employees on the pitfalls of mobile app fraud and the steps they can take to reduce its impact.
The Rise Of Insider Threats
Let’s zoom out a bit and find something on which we can all agree: Insider threats are responsible for some of the most devastating data breaches in recent memory. Moreover, the trendlines are moving in the wrong direction, with insider threats growing more common and more impactful with time.
In short: Industry does not have a handle on the insider threat.
At a minimum, your company needs to adopt the best-practice recommendations for insider threat mitigation. That means implementing a panopticon-style monitoring system where everyone is watched, including the watchers. It means adopting “minimum permissions” protocols, wherein your employees and contractors have only those credentials that are absolutely necessary to do their jobs. And it means investing in redundant systems that minimize the adverse impact of insider attacks.
Mobile Browsing Cloud Insecurity
Another rising risk of the BYOD environment is the woeful insecurity of the mobile browsing cloud. You really don’t want to know just how badly exposed your employees’ devices are to compromise. Actually, you do, but you’ll need a strong stomach to absorb it all.
To make matters worse, even well-defended mobile devices are vulnerable to compromise. These devices are up-to-date with small business firewalls, antivirus suites, and virtual private networks. This is all the more true for devices possessed by high-value targets or privy to sensitive permissions. Savvy black hats know to target those with the most to lose. In upcoming years, you’ll want to increase your investment not only in mobile browser security, but in devices and applications with fewer inherent vulnerabilities.
Non-Optional Data Security Governance
The line between data security and business case management has blurred to the point that it’s no longer meaningful. One could make a case that the line was never meaningful, but that’s a conversation for another day. In future years, the imperative is impeccable data security governance. You can’t afford not to have a plan.
The IT Security Talent Shortage
Some might say that the IT security talent shortage is biting already. Without fundamental change in the labor markets or a technological breakthrough that appears nowhere on the horizon, conditions are poised to take a turn for the worse in the months and years to come.
For organizations concerned about preserving their advantage over threat actors, that’s going to demand managed expectations. You probably won’t have your pick of the litter when you’re hard-pressed to retain the talent you have managed to acquire; you’ll need to make do with less.
Single-Factor Credentialing On The Way Out
On a happier note, the bane of IT security professionals’ existence is finally in its death throes. If you’ve yet to institute organization-wide two-factor authentication, now’s the time to hop on the bandwagon.
The Password Could Follow
An even happier note, rapid advances in biometric technology (and less sexy applications, like dynamic credentialing) may soon render the password obsolete. That’s sure to open up a host of potential exploits for creative black hats.
Potential Backlash Against Connected Home Devices
Like growing regulatory complexity, privacy concerns around connected home and personal devices don’t represent a direct IT security threat in and of themselves. However, these concerns may contribute to volatility in the consumer IoT sector. They could threaten business cases (and entire business models) for products and organizations that have embraced the space to date.
Should a high-profile hack or compromise occur as consumer IoT privacy concerns escalate, an industry-wide retrenchment may occur. Even in its absence, players will surely feel compelled to redouble investments in hardware security, software defenses, and privacy protections.
Increase In State-Sponsored Attacks
We’ve heard a great deal about state-sponsored attackers in recent years. Unfortunately, we’re likely to hear even more about (and from) them in the years to come. No matter how mundane your organization’s activities, it too may find itself in the cross-hairs. Expect to see an uptick in state-sponsored malicious activity around major world events. If your company is involved in either, however tangentially, steel your resolve now. You’ll need every ounce.
New Year, New Threats. Time to Buckle Down. Digital threats never sleep. Your organization’s cybersecurity team can’t either. As should be plain as day by now, you’ll face a multitude of serious digital security risks in the upcoming year and beyond. You’ll also face threats that are best described as cross-disciplinary: issues that involve the intersection of regulation and politics and public opinion, all wrapped up in a mushrooming matrix of traditional IT risks.
It’s more than enough to make your head spin. Unfortunately, even the best-resourced cybersecurity teams can’t be everywhere at once. Even the most diligent organizations and individuals fall victim to cyberattacks. If you’re to keep your head above water in the years to come, you’ll need to learn to pick your battles — after you’ve surrounded yourself with the very best IT security professionals and support staff money can buy. Some investments are too important to delay.
