Cyber Defense eMagazine December 2019

79
Consequently, companies of all sizes will find themselves faced with more costly, sophisticated, and
disruptive cyber attacks. Although technology threats remain mostly the same with cybercrime-as-aservice,
from an enterprise perspective, it’s important to remember that more people are able to partake
in cybercrime as a result. Moreover, the malicious hacker delivering the service is likely to have carried
out their attack many times before. As such, the danger posed by cybercrime-as-a-service must be
understood by businesses in order to mitigate its damage.
This is where the importance of data visibility becomes most apparent, which means keeping on top of
shadow IT -- no mean feat. Although a pertinent problem in companies of all sizes, the issue is (somewhat
ironically) exacerbated when a company experiences rapid growth and success -- whether that’s through
a string of fresh hires to keep up with new business or a long-awaited acquisition. In all other aspects,
business might be booming, which is brilliant -- but as growth increases, so does the struggle for IT teams
to keep on top of threats, both on and off the company network.
This can be particularly difficult for mid-market and high-growth businesses, such as startups and scaleups,
where it can be a struggle to keep on top of threats amid a continually increasing headcount. We
need cyber binoculars, if you will, to see ahead, identify threats early, and give the experts the chance to
analyse and take appropriate action. Here, a forward-thinking cyber security operations centre (CSOC),
supported by a hands-on team of analysts, can really help -- which means a CSOC that’s both reactive
and proactive. The CSOC team should undertake specific research into cybercrime-as-a-service as well.
Compliance is the cornerstone to all of this because, as networks and requirements change, disparate
security systems across the IT environment create a significant compliance headache for businesses,
making it almost impossible to accurately assess compliance adherence across a multitude of interfaces.
The result? A fragmented view of compliance that is prone to error.
Now, however, technology and systems exist that are designed to monitor for compliance to multiple
standards -- across different geographies, if needed. The specific nature of this form of monitoring
relieves a heavy burden when adhering to regulations such as European GDPR, as real-time compliance
monitoring can be continually illustrated to anyone from a regulator to a supplier. This is achieved by
collecting, aggregating and correlating system and network information. What makes this so important is
that strong cyber security protection relies entirely on data visibility -- if an organisation can’t keep track
of its data or its stored insecurely, this paves the way for a host of possible cyber security threats, from
simple phishing scams to ransomware attacks.
By taking a proactive approach to security protection, it becomes possible to use threat intelligence to
prevent attacks, rather than just react to imminent threats. Beyond technology, this should take the form
of trusted team of third-party experts who have the time and wider resources to spend on cyber security
protection. In doing so, it becomes possible to limit the chaos of added cost and simplify security to focus
on business strategy and risk. After all, when it comes to security, it’s the actionable information,
integration, and the end-to-end capabilities that equips businesses with the tools they need to take on
cybercrime-as-a-service -- giving them that much-needed edge to survive.