CS Nov-Dec 2023

cyber awareness
Don Boxley, DH2i: today's cyber threats
are escalating into full-blown crises -
we must urgently overhaul our digital
defences.
Simon Church, Xalient: invest heavily in
training to enable employees to make
smarter security decisions.
understand the process and who is doing
what. "And I'm not just talking about
technology here, but people and processes.
For example, what communications about
the attack will they share with employees,
customers and other stakeholders? What do
they want employees to do? What do they
want senior executives and the board to do?
All too often I see organisations assume
that, because they have the technology
in place, it will magically and seamlessly
recover their systems, but they neglect the
fine detail around communications and
reassurance."
He also identifies human risk as a major
factor. "In fact (depending on the sources you
refer to) 75-90% of all cyber incidents are
human initiated. So, it is very important to
focus on having employee security awareness
training in play. Today, employees operate in
a blended environment, moving seamlessly
between work applications and personal
apps. Whereas previously they have been
prevented from sharing company data
outside the network perimeter, in our world
of social media we often overshare, which
leads to a lot of freely available open-source
data, or OSINT.
"Cybercriminals use OSINT for social
engineering purposes. They gather personal
information through social profiles and use
this to customise phishing attacks. The most
recent MGM breach, for example, was a
result of a social engineering attack on an
employee who inadvertently gave hackers
access to MGM's systems. Investing heavily
in training to enable employees to make
smarter security decisions will help them
manage the ongoing problem of social
engineering and clever phishing attacks.
Performance should also be regularly
measured to see how employees are
implementing training in the real world
and there must be KPIs around this that are
ideally discussed at senior management or
board level. It is likely that the MGM attack
could have been averted, if the employee
had been more aware and better trained."
Also, as many breaches utilise a vulnerability
or flaw in operating systems' code,
the patching cadence and criticality need to
be agreed and assessed on a regular basis,
so that the organisation prioritises patches
based on risk to the business, Church adds.
"To put this into context, last year there were
approximately 20,000 new patches created
by software vendors; this year, that figure is
expected to increase to 22,000. This means
that the largest organisations have a
backlog of over 100,000 patches to deploy,
which is an almost impossible task without
clear risk prioritisation."
Managing their third parties and any
extended ecosystem cyber risk is equally
critical for CEOs. "It is very difficult from
an outside view to determine which
third party has strong cyber controls and
which ones are already, or likely to be,
compromised. Standard risk assessment
processes tend to be 'point in time',
involving questionnaires and audits. For
cybersecurity, this is a flawed approach that
usually leads to risk tolerance or acceptance.
Rather than just categorising third parties as
high or low risk, organisations should focus
on the nature of the relationship and their
adherence to the same security policies
and practices implemented by the organisation.
Do they control sensitive data or
have they got access to critical systems?"
Cybercrime is predicted to be worth
a massive $10.5 trillion dollars by the end
of the year, Church points out. "If it were
a country, it would equate to the thirdlargest
country in the world, in terms of
GDP, so it is clearly big business. Having
robust security controls, a solid risk management
plan and dynamic risk policies, as
well as a tried and tested recovery plan,
won't totally remove the threat of a cyberattack,
but it will certainly reduce not only
the probability of a breach, but also the
impact to the business."
24
computing security Nov/Dec 2023 @CSMagAndAwards www.computingsecurity.co.uk