In fact, Trend Micro’s latest global risk report revealed 25% of Australians believe cybersecurity is the biggest business risk today, and 62% claim it has the highest cost impact of any business risk.
Yet major visibility gaps and alert overload are all too common. We’ve seen a significant shift in the way that cybercriminals are undertaking attacks. They are now taking a much more engineered approach, using sophisticated breach-like methods to shut down systems and threaten security teams. The first step towards effectively mitigating cyber risk is understanding the scale, complexity, and specific characteristics of the threat landscape.
The past 18 months have been challenging, but they have provided many lessons for the future. The following trends have emerged from Trend Micro’s annual Cloudsec event, for security teams and business leaders to stay conscious of in the year ahead.
Secure connectivity in the hybrid work environment through identification
The way employees connect to company resources have changed dramatically over the last few years. Cybersecurity demands a proactive, preventive approach and not a reactive one. With increasingly distributed workforces, working from home is becoming a gateway to new forms of data theft and organisations are struggling to adapt. Poor technological infrastructure and inadequate cyber and data security represent a cyber risk to businesses.
The traditional boundaries of the corporate network are no longer sufficient, seeing a rise in identity-based attacks. Trend Micro’s 2021 mid-year security report revealed that business email compromise attacks increased by 4% globally. In Australia alone, Trend Micro blocked over 92 million email threats in the first half of 2021 – a 61% increase year-on-year.
Identity has become the de facto perimeter for organisations today. Identity is the foundation of a zero-trust architecture, as you need to ensure the right people have the right level of access, on the right device, to the right resource, in the right context. A comprehensive, identity-first security strategy can tie the complexities of protecting people and assets together in a seamless experience. Beyond improving business security, there must also be a company-wide cultural shift in attitudes towards cybersecurity. All staff must be made aware of the issues and risks, and receive adequate training in managing sensitive data and any new responsibilities.
Migration to cloud has led to new risks for government agencies
Today’s operational and technological needs have resulted in government agencies moving their data into the cloud. Migration to the cloud will play an integral role in helping the Australian government’s goal to be one of the top three digital governments in the world by 2025. In fact, the government aims to have all NSW government agencies using public cloud for a minimum of 25% of their ICT services by 2023. Unlike previous legacy on-prem arrangements, the migration to cloud has brought about a new set of risks and considerations – and organisations must take serious precautionary measures. A lack of holistic cloud security strategy is detrimental to any agencies – from lack of visibility of data types residing in the cloud, to lack of security controls and absence of monitoring of cloud workloads and applications. Organisations need to have a comprehensive, proactive cyber plan that enables you to protect, detect and respond effectively to any cyber threats.
One of the grand challenges of a cloud strategy is securing the environment. Government agencies can leverage emerging technologies to help secure and innovate operations in an ever-changing cyberthreat landscape. A key approach is to adopt the Zero trust architecture in their security. Organisations keen to embark on their Zero Trust journey must take into consideration the transition process. By working with the right technology partners, organisations are able to implement a robust cloud security strategy, compliant with cybersecurity standards.
Both cyber security and cyber resilience are essential
Advancing technologies across all industries bring incredible new opportunities and business advantages, but it also brings unprecedented new threats. In today's evolving threat landscape, both cyber security and resilience respectively are methodologies to enable collaboration between IT risks and IT security teams in most organisations today.
The cyber security controls (process and technologies combined) are relevant to keep cybercriminals out as much as possible. However, as the lines between physical and digital disruption are blurred, there is a growing need to shift from a preventative mindset to a resiliency-based approach. Cyber resilience practice and strategy prepares the organisation to withstand or recover quickly when organisational breaches occur.
Cybersecurity and resilience both require an investment in time, resources, and education, but by combining the essentials of cyber security and resilience, security teams can mitigate damages and risks. The key is to ensure your security advisors are experienced across both areas. Regular cyber resilience evaluations are also critical to stay on top of the overall level of cyber resilience, particularly in relation to vulnerabilities identified during routine cyber security operations.
