Cyber Defense eMagazine February 2021 Edition

Approach cybersecurity as an org-wide strategy
Far too often, digital risks are treated as an IT problem rather than a business priority. Increased digital
transformation means that online risks impact all business areas and have greater, longer-lasting effects
on revenue and operations as a whole. According to IBM’s 2020 Cost of a Data Breach report,
organizations incur $1.52M, on average, in lost revenue per breach.
And these business impacts aren’t just due to increased cybercrime like phishing and ransomware—
cyber-enabled threats are implicating a variety of business operations.
For example, damaging viral content or misinformation, evidence of theft or internal threats, and physical
security risks are all facilitated by and discoverable through online sources. This information is now
valuable for cybersecurity and marketing, compliance, and physical security teams, to name a few.
So how can CISOs and IT managers tackle digital risks more holistically?
For one, security teams should rethink their toolkit. While threat intelligence tooling is valuable for
cybersecurity personnel, security teams should consider software that is also accessible for non-technical
teams like compliance who require digital risk data.
Security officers must also communicate digital risks to executives and board members as business
risks—how do online threats, from data disclosure to theft, translate to lost business in dollar value? This
will ensure that digital risk is clearly understood through the lens of business impact and prioritized by
leadership accordingly.
Prioritize breadth of data
As digital risk covers a greater diversity of use cases, more online spaces are relevant for detecting risk
and defending your organization. Beyond standard threat intelligence sources—like technical feeds and
the dark web—security teams now need to consider a broader set of sources.
These could include mainstream and fringe social media sites (which tend to emerge quickly), deep web
forums, and messaging apps. For example, platforms like 8kun or Telegram could host compromised
information or other targeted risks, but may not be standard data sources in a security team’s toolkit.
Any one of these sources is not necessarily valuable on its own. However, access to a combination of
social, deep, and dark web data alongside technical cyber threat intelligence can help security teams
follow breadcrumbs more comprehensively across the web.
Security teams require multiple threat intelligence solutions to do their jobs effectively. But tools that
prioritize data diversity (rather than focusing only on the dark web or social media, for example) can
streamline toolkits, save analysts time, and provide more valuable context.
Rethink how you conceptualize the internet
These considerations point nicely to a third shift: integrating not only cybersecurity strategies and data
sources but also our understanding of the internet.
Adversaries are not segregated to distinct web spaces—and neither should threat intelligence strategies.
The internet has long been conceptualized as fragmented surface, deep, and dark web networks (so
Cyber Defense eMagazine – February 2021 Edition 85
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.