Credit: ID 98106719 © Mast3r | Dreamstime.com
Australian businesses have been affected by more than 300 cybersecurity breaches in 2018, according to The Office of the Australian Information Commissioner (OAIC). The volume, variety and velocity of these incidences are accelerating at an alarming rate, and in some cases they are losing their shock value in the media.
Case in point – the recent PageUp hack which exposed recruitment records of major Australian organisations, including government agencies, and which is now estimated to have affected hundreds of thousands of job seekers.
Even though awareness and cyber spend continues to rise – Australia is expected to spend $3.8 billion on cybersecurity in 2018, up 6.5 percent from 2017 according to Gartner – remediation and consequences are increasing at similar rates.
Despite more damaging and more sophisticated cyber-attacks happening every year, organisations don’t seem to be learning from these incidents, with cybersecurity technologies continuing to function in siloes and with multiple teams required to address aspects of each cyberattack making an instant response difficult or even impossible.
Such an approach signals gaps in an organisations’ cybersecurity strategy. Cybersecurity needs to be approached from a holistic business perspective, so that gaps can be identified and addressed beyond a purely technological standpoint.
Identifying core cybersecurity gaps Businesses must look beyond the implementation of a cybersecurity strategy to its impact on all business units. Lacking the key internal resources to counteract cyber risks, combined with an absence of appropriate remediation strategies, is a step towards misfiring on cybersecurity strategy.
Here are some of the common gaps enterprises experience:
Risk detection: When a security breach does happen, according to a Marsh & McLennan report, it takes on average 99 days for the team to detect it. This is a clear gap exposing how Security and IT teams are prioritising things differently. Staying a step ahead on risk mitigation and detection strategies is a journey that requires an intersection between leadership understanding and buy in, and executional intricacy. The IT team needs to be proactively communicating their plans: speaking the language of the business, and bringing in the right partners during digital transformation to mitigate risk at the outset.
Communication breakdown: The impact of cyber-attacks is a board and C-Suite issue, but what still needs resolving is the lack of communication, priorities and expectation setting between the C-level and IT-level. The cybersecurity message to boards may not be ‘getting heard’ during the excitement of digital transformation. In other words, it’s the language and timing that are off. This can be anything from misalignment on timelines and expectations, right through to make-or-break strategic moves, such as rebuilding legacy infrastructure to suit tomorrow’s digital transformation requirements.
Skills shortage: With a large and widening skills gap, it is difficult for IT teams to adequately resource and scale up incident response teams without taking members off other important projects. According to AustCyber, over 11,000 new cybersecurity jobs will be required in Australia over the coming decade. This skills gap not only concerns the board, but puts immense amounts of pressure on capacity-strapped IT teams who don’t have the resources for instant responses or mediation to limit the scope of a breach. Many businesses feel that they have two options: to either up-skill the workforce or out-task the work.
2019 is around the corner – how can these gaps be addressed?
I believe 2019 should be a year of proactivity, not reactivity, for the enterprise.
The right partner can take on this burden whilst also helping IT decision makers assess the threat landscape in which their business performs, understanding their threat ‘footprint’ and how this may evolve over time, aligned with the implementation of new cloud technologies and other digital transformation journeys.
Security-as-a-service is a fast-growing field, which seeks to establish risk mitigation plans, align different business units on priorities and communications, and ensure that businesses are being protected by the brightest next-gen cyber experts. It can be a silver bullet solution for an organisation needing to fill its cybersecurity gaps.
Attack surfaces are expanding at a faster pace than cyber defences are being introduced. We are never going to reach an end stage in which cyber-attacks are completely eradicated. This is the new digital norm, but by closing in on these critical gaps, businesses will be far better positioned both proactively and defensively when 2019 arrives.