According to the Global Cybersecurity Status Report conducted by ISACA International in 2015, just 38% of global organizations claim they are prepared to handle a sophisticated cyber-attack. This scarily small figure shows just how at risk we are. Cyber-attacks are becoming increasingly common; a 2017 Malwarebytes report found that the frequency of ransomware attacks alone has increased by nearly 2000% in the past 2 years.
“Cyber-crime is the greatest threat to every company in the world,” Ginni Rometty, IBM Chairman, President and CEO.
Clearly, something is wrong. Many systems are old and outdated, and unfit to defend against a cyber-attack. Choosing the right security solution for you and optimising all systems is imperative to ensure the safety of your data.
The Problem
A common practice is for businesses to deploy their security solution and then leave it untouched, to sort things out itself. 81% of data breach victims surveyed in the 2015 Global Security report by Trustwave, said they had neither a system nor a managed security service in place to self-detect data breaches, relying instead on notification from external sources. This was the case despite the fact that the average time for self-detected breaches is 14.5 days, compared to 154 days by a third party.
The main issue with neglecting to monitor, update or optimise your security solution is that organizations cannot then keep apace with the evolving threat landscape. Hackers are always finding new ways to infiltrate a website, network or app, making it even more crucial to optimise your deployment regularly.
For example, GitHub experienced a new type of attack earlier this year, a Memcached DDoS attack. Traffic reached a frequency of 1.35Tbps – a new record. This technique is now popular amongst DDoS attackers, despite it being a relatively new method. No one predicted this type of attack was going to take hold, making it that much harder to defend against; and with greater collateral damage.
In 2017, the Barkly Security Conference found that 52% of organisations surveyed weren’t making changes to their cybersecurity solutions, despite all being hit with cyber-attacks in the previous year. Companies obviously know the threat, and may well have experienced it themselves, yet are not employing solutions that are robust enough.
The Solution to Optimizing Your Security?
A common approach to fix this problem is by “throwing money” at it. However, this philosophy of blindly investing millions into new security measures is inefficient and not necessarily effective. Global spending on cybersecurity products and services is predicted, in a 2018 cyber security ventures report, to hit $1 trillion by 2021, yet the cost of damages is expected to hit 6 times this amount by the same date.
More investment in security ≠ Fewer incidents
Clearly, the current landscape is characterised by big spending for not much actual reward. An often overlooked area is keeping security systems optimised to ensure they are performing to the best of their ability. This means careful planning and thought; reviewing configuration & machine learning settings, resilience testing, and being in regular contact with your security solution provider to remain the best protected you can be.
Correct configuration of settings and optimisation of these is crucial in the first line of defence against a cyber-attack. In the 2016 Annual Security Report by Cisco, only 29% of SMBs used standard tools such as configuration and patching to prevent security breaches. This is a basic step, but it can drastically affect your readiness to deal with a possible breach, and it is essential to keep your systems optimised.
The key takeaway from these statistics is that you can’t just wait to be attacked. Even 6 months after initial deployment it would be incorrect to assume that all solutions were working optimally. So what can be done to fix this?
What Must Be Done?
By spending huge budgets on cybersecurity without due diligence, many businesses end up with a lot of hardware, software and cloud subscription services they may not necessarily need. As many as 30% of all security software purchases never get deployed, wasting hundreds of thousands of pounds. Furthermore, too many products can weigh a company down with unnecessary expenditure and management overhead. Eliminating this waste helps your IT team focus their budget on services that can really help defend an attack.
So where should this focus be? Re-evaluating your solutions by conducting resilience tests (DDoS and Pen tests, for example) and acting on the results, ensures that solutions are working at peak efficiency and do not have any leaks.
As a specialist in DDoS tests, activereach has found that 97% of all tests conducted on DDoS mitigation cause the DDoS defence to fail. This highlights the importance of choosing the mitigation that is right for you and testing it to ensure you are ready for a real attack.
To mitigate against the sophisticated efforts of today’s cybercriminals, we must transform our security mindset. Our current reactive model of minimal optimisation is not suitable for today’s threat landscape. We must move to a predictable, planned approach with a regular resilience testing and optimisation protocol.
Through a consultative approach, activereach can help you to understand what your business does and doesn’t need and ensure that you optimise your cybersecurity strategy.
If you would like to find out more about the services we can provide, please see our Network Security and DDoS Testing solutions.