Cyber Security - How Confident (Complacent?) Are You?

Attention all cyber security professionals! We all know that today’s cyber security landscape is an ever-changing one. So how often should organizations review their cyber security strategy? If it’s a question that hasn’t been asked in a while, chances are that in this world of constant threat, you’re probably at risk. 

For despite the near constant stream of data breaches making headlines, far too many organizations insist their current cybersecurity model is good enough. However, the contrary holds true.

Quite simply, if any of the statements below apply to your business, then it’s arguable that cyber security confidence is actually misplaced complacency:-

  • We haven’t been hacked before, and I know where my organization’s critical or sensitive data is at all times. Why change something that’s working today?

No business can ever be 100% sure where its data is or that it hasn’t been compromised in transit. Failure to recognize this issue is a board-level responsibility.

  • We tick the boxes when it comes to GDPR, PCI DSS, HIPAA (and other regulations) so my organization is secure. No company that has met their compliance requirements has ever been hacked, right?

Taking a compliance-led approach to securing customer data will cause a fundamental vulnerability within the cyber security infrastructure, simply waiting for hackers to exploit. Compliance is important, clearly, but it should be a subset of the overall, continuously evolving security strategy, rather than an end-point goal in itself.

Organizations are understandably concerned about the financial penalties associated with failing to achieve regulatory compliance. But take a step back and consider the financial implications of a data breach, of high profile customer data compromise. That is a far more significant cost and an event that will have long-term repercussions on customer perception and loyalty.

  • We trust that our WAN (Wide Area Network)  provider has the necessary controls in place to keep our data secure as it moves between locations.

But WAN providers can’t guarantee the security of their environments and the security of your data is ultimately your responsibility. What’s needed is a data-first ‘Zero Trust’ mindset that protects data before sending it to the carrier network.

  • IT costs need to be reduced, so the easiest thing is to cut the security budget; it reduces cost without reducing functionality. But, just in case, we’ve increased our cyber insurance coverage. 

Cyber security insurance policies require customer diligence. You cannot buy a security policy, not deploy security and then expect a post-hack payout. More significantly, think about the cost and loss of earnings associated with the fallout of a data breach.

  • My network is secure so I don’t need to secure our data in motion. After all, we own the entire infrastructure end to end, wherever our data goes.

When 70% of all breaches are as a result of internal user compromise, this is a false sense of security. Not only are current security models broken, current trust models are too so they must be realigned and rebuilt.

The only way to do that is to change the emphasis. Shift the security focus from infrastructure to the user or application and it doesn’t matter how complex technology has become, or becomes in the future; the security model remains simple and hence both manageable and relevant. Moreover, whether the environment is owned by the business, third party, or in the cloud, when access is based on users and application, only a user with cryptographic keys and credentials gains access. It is that simple.

  • We need not worry: we can do encryption on our firewall, switches and routers for less money and achieve the same result.

Turning on encryption in a network device WILL degrade the performance, typically by 50%. The reason lies in the way encryption has been deployed to date. In order to address the continued friction between operational goals and security imperatives, organizations need to decouple encryption from the infrastructure completely and instead overlay the security measures, leaving the underlying infrastructure untouched. The answer is Layer 4 encryption.

Layer 4 encryption is dedicated to providing the level of trust of data in motion and applications moving across the infrastructure, yet avoids any impact on network performance and complexity. Furthermore, Layer 4 encryption operates in ‘stealth’ mode: it is only the data payload that is encrypted – not the entire network data packet. All of the complex management and maintenance problems created by traditional encryption deployment are removed. The data in motion is secure without adding complexity or compromising the operational performance of the infrastructure.

  • We don’t need encryption because our firewalls will keep the hackers out, or if not our intrusion detection will let us know immediately so we can stop a breach while it’s happening.

The current security mindset must move away from outdated thinking about securing the perimeter, assuming that breaches can be ‘protected’ against, ‘detected’, and ‘reacted’ to. With the average time to detection being 120 to 150 days, depending on the source, this clearly is a fallacy. When it comes to data breaches, it is a case of ‘when’ not ‘if’, so organizations must think about how they can best ‘contain’ a hacker from wreaking havoc on their data by adopting a software-defined approach to security and leaving the infrastructure-based security mindset behind. 

  • Data compromise is something that happens to other businesses, not ours!

That’s what all the brands that have been in the headlines over the past 18 months thought as well. The game has changed; it’s no longer about the high profile, kudos-winning breaches. Today’s hacking community is far more focused on the theft of sensitive, critical customer data that will leave those affected with long-term repercussions. Cybersecurity must be a process of continual evolution: just because you feel protected today doesn’t mean you will be tomorrow.
 
About the author: Paul German is CEO at Certes Networks

You Might Also Read:

Zero Trust Architecture - No Longer A ‘Nice to Have’:

 

« Top Nine Technology Trends Of 2021
Facebook Is 'making hate worse' »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Thycotic

Thycotic

Thycotic prevents cyber attacks by securing passwords, protecting endpoints and controlling application access.

DataLocker

DataLocker

DataLocker offers both hardware based external storage and software based cloud storage encryption solutions.

Atlantic Council Digital Forensic Research Lab (DFRLab)

Atlantic Council Digital Forensic Research Lab (DFRLab)

The Atlantic Council’s DFRLab has operationalized the study of disinformation by exposing falsehoods and fake news, documenting human rights abuses, and building digital resilience worldwide.

Navarino

Navarino

Navarino is the maritime industry’s most advanced communications and connectivity company. We develop advanced technologies and innovative IT solutions including cyber security.

Dell Technologies

Dell Technologies

Dell Technologies Consulting Services enables a highly resilient business amidst the proliferation of cloud-based IT services and constant threats to your most critical information.

Practical Assurance

Practical Assurance

Practical Assurance helps companies navigate the rough terrain of information security compliance.

DreamIt Ventures

DreamIt Ventures

DreamIt Ventures is an early stage venture fund that accelerates startups building transformative tech products in the fields of Healthtech, Securetech, and Urbantech.

Slice

Slice

Slice offer subscription based Cyber Insurance for small businesses.

Ampliphae

Ampliphae

Ampliphae gives you an easy-to-deploy, sophisticated and affordable cloud-discovery, security and compliance platform.

Privakey

Privakey

Transaction Intent Verification. Privakey delivers a secure channel to streamline high risk transactions, enabling digital trust between services and their users.

Auriga

Auriga

Auriga create innovative software and have become a benchmark for high quality banking software including cyber security solutions to protect business critical devices.

ClearSky Cyber Security

ClearSky Cyber Security

ClearSky cyber security provides cyber solutions, focused on threat intelligence services, mainly for the financial sector, critical infrastructure, public sector and the pharma sector.

Relatech

Relatech

Relatech is a Digital Enabler Solution Knowledge (D.E.S.K.) Company that offers digital services and solutions dedicated to the digital transformation of businesses.

Illustria

Illustria

Illustria is your agent-less “watchdog” for all open source libraries. Our mission is becoming a dev-velocity company, enabled via cyber security.

Security4Media

Security4Media

Security4Media is a non-profit association set up to reduce risks and support trust in media, in the face of increasing cybersecurity threat levels.

Panasonic Automotive Systems

Panasonic Automotive Systems

Panasonic Automotive Systems brings together security technologies and human resources cultivated across an extensive range of businesses into the automotive field.