Every day, millions of us start up our laptops, desktops and devices, and connect to networks at home and at work. Yet, each day hackers and cybercriminals are working away too, finding the vulnerabilities in software, systems, and even specific companies and organisations. The ranks of the hackers include mercenaries, organised criminal gangs and state-sponsored groups, all of whom have the skills and resources to devastate their chosen targets. No company or organisation is immune to every sophisticated attack.
At Kaspersky we looked at these threats as part of our IT Security Economics 2021 report. What we found was attacks have become more challenging, as companies and organisations have moved to hybrid working, using complex systems to support a workforce more likely to be working from home. Without these systems and risks being fully visible, cyber defenders can find themselves on the back foot, responding late or inappropriately to an attack they struggled to find.
Cyber security is not just about one organisation either. Every external supplier or customer is a potential route into systems, particular where there is shared data. Incidents involving shared data with suppliers were the costliest at an average of $1.4m in 2021, while attacks on supply chains cost an average of $2m.
The best way to protect against and respond to this new wave of cyber threats is through a well-coordinated and professional team of people. At Kaspersky, we work with organisations, big and small, to help them develop the cyber security and infosec systems that work for them, performing managed detection and response and incident response. Part of this process is “hunting” down threats before they strike, using our knowledge and expertise to develop the tools to do this automatically while retaining the skilled personnel to deploy where needed.
Hackers can also take advantage of systems that see “too many” risks and bombard cyber defenders with unnecessary incident alerts that they then have to investigate, increasing the chance that a serious attack slips through. Fortunately, Kaspersky has developed a comprehensive cyber security framework that helps to prioritise truly critical incidents and focus resources on tackling them.
Unfortunately, many organisations struggle to recruit qualified cyber security personnel, which is part of a wider shortage in the labour market for people with these valuable skills. Globally, it is estimated that there are 3.5 million unfilled cyber security jobs and it is very likely that that number will grow.
Other organisations are too small to be able to invest in an in-house team to safeguard their IT systems against general risks, let alone a targeted attack. Our research shows that the most common reason for small and medium businesses not to invest in cyber security is that management do not see a reason to do it, followed by the belief that their systems or recent investments have secured them against threats. The dilemma facing many businesses is the choice between constant investment in cyber security without any visible benefit or constant risk of getting substantial losses after the incident.
However, not being prepared can be dangerous and costly. According to our research, in 2021 the average cost of a data breach for a small business was $105,000 and closer to $1m for larger enterprises. That cost includes having to bring in external help after the incident, lost business, fines, compensation and damage to credit ratings. Investing in new staff, systems and training in cyber security after the breach may help mitigate the brand damage and reassure investors, but it is a poor substitute for having been prepared in the first place. Yet, the average budget for cyber security fell during this time and professionals are concerned about how to secure the more complex systems they are now working with.
Small and large businesses, and the public sector, face ever-changing cyber security threats from a range of sources, costing data, time and money to repair.
Hackers and cybercriminals work together across the dark web, trading and sharing in new tools, exploits, tactics and methods. That is why we need to be constantly innovating, investing in and developing cyber security to meet those challenges and create a safe environment for businesses and organisations to thrive. ●
Christopher Hurst is general manager, UK & Ireland at Kaspersky
Related
