With cybersecurity continuing to be a big area of concern, as bigger and bigger cybercriminal takedowns highlight the prevalent danger, it’s clear that businesses around the world need to hold it in priority. If you’re not, it’s clear that you’re leaving yourself at risk.
We sat down with Scott McKinnel, Country Manager ANZ of international cybersecurity company Tenable, to discuss the cyber threats putting businesses at risk and what can be done to crack down on these vulnerabilities.
1. What are the most common cybersecurity threats facing businesses?
Based on a study by Forrester Consulting commissioned by Tenable, the most common cybersecurity threats facing Australian businesses today are fraud (45%), COVID-19 phishing incidents (44%), data breaches (43%), ransomware (39%) and software vulnerabilities (36%). The impact of these threats resulted in financial loss, loss of productivity, customer and employee data.
2. How will these threats evolve over time?
To thrive in today’s competitive environment, businesses know they need to get smarter with technology and are tapping into cloud-based technologies and the Internet of Things as a way to increase productivity and profitability. However, this, in turn, is expanding the cyber attack surface making IT systems more vulnerable.
“5G is going to be the next big threat, set to revolutionise the security landscape”
We’re already witnessing the convergence of OT and IT across many industries and as this becomes more commonplace the desirability for high-quality connectivity and real-time application will grow.
As more devices continue to be connected to the cloud, while businesses seek better connection and faster speeds, 5G is going to be the next big threat, set to revolutionise the security landscape. As data continuously flows through potentially vulnerable 5G infrastructure, it’s going to become key for businesses to build an ecosystem of trusted vendors and service providers to combat these new and emerging threats.
5G is going to be the next big threat, set to revolutionise the security landscape
3. How can businesses identify which threats are most relevant to them?
For instance, implementing cybersecurity frameworks is a vast undertaking – how can businesses narrow in on what will be most useful to them? Is this a matter of pivoting from legacy-based to risk-based vulnerability management?
Business leaders in Australia require a new way to measure and manage cybersecurity as a strategic business risk. This new approach needs to be focused on both understanding the current organisational risk posture and predicting the greatest threats to the business.
Legacy vulnerability management is traditionally compliance-driven and IT-focused meaning it measures success based on the number of vulnerabilities remediated, irrespective of whether or not they pose any degree of risk to the organisation. This means there is no real visibility into the actual risks. Often, organisations who adopt such measures suffer from “vulnerability overload” and ultimately aren’t able to adequately understand and reduce their cyber risk.
Organisations must evolve from this static approach to a risk-based approach, which includes the prioritisation of vulnerabilities that are most likely to be exploited. A combination of threat intelligence, vulnerability research, and probability data, can provide an overview of the unique vulnerabilities that pose the greatest risk to the business. This will help categorise roles and responsibilities in order of importance and save resources along the way.
4. How can you find out your cyber exposure score and what should you do after you have it?
The Cyber Exposure score is an objective measure of cyber risk, derived through data science-based measurement of vulnerability data together with threat intelligence and asset criticality. The score is automatically generated through machine learning algorithms which combine the Tenable Vulnerability Priority Rating (VPR), for the likelihood of exploitability, with the Tenable Asset Criticality Rating (ACR), for the business criticality of the impacted asset.
Organisations can also leverage scoring to trend improvement over time as a measure of security program effectiveness. It is a number between 0 and 1000, where 0 is least exposed and 1000 is most exposed. Exposure Score can be applied to any group of assets, either a single asset, a subset, or an entire organisation.
5. What are the most important ways businesses can continue to improve and maintain their cybersecurity frameworks?
There are a few key ways that businesses can improve and maintain security. Firstly, security needs to be linked to business performance through cyber resilience and cyber risk. Organisations must also adhere to a baseline standard of care with a strong focus on cyber hygiene.
Another key method is to use security metrics that speak to business risk. In practical terms, this means using language that executives across the board understand. Security leaders should be using risk metrics, cost and performance indicators to communicate the level of risk to executives.
Finally, businesses should tap into predictive business risk context for incoming threats. While many businesses still remain heavily reliant on a reactive approach to security, with thousands of vulnerabilities identified in environments each day, security teams today just don’t have the time and the business doesn’t have the luxury to guess which ones to focus on first. Organisations need solutions to help them better understand the actual, not theoretical, impact of vulnerabilities, and focus remediation efforts based on business risk.
Keep up to date with Dynamic Business on LinkedIn, Twitter, Facebook and Instagram.
