CSOs, CIOs and CISOs have never had it so tough. Alongside their traditional responsibilities, they must now face a cybersecurity threat environment that is growing exponentially, and a growing cyberskills gap. As a result, many of them are reporting burnout.
As per the findings of the 2022 IBM Security X-Force Threat Intelligence Index, the Middle East and Africa region was ranked fourth worldwide for the most ransomware attacks.
According to a report by Group-IB, between Q1 2021 and Q1 2022, the data belonging to 147 companies from the MEA region was uploaded on ransomware dedicated leak sites. And this is only one of the many threats that organisations have to deal with.
While most employees have basic knowledge of cybersecurity best practices that is pretty much all they have
There are also distributed denial of service, DDoS attacks, Man in the Middle attacks, social engineering, insider threats, malware, and advanced persistent threats to contend with – and those are just the most common network security threats.
The problem for CSOs is that, while most employees have some basic knowledge of cybersecurity best practices, that is pretty much all they have. Without ongoing training, knowledge testing and awareness, staff behaviour is one of the biggest cybersecurity risks that organisations face.
A study by Accenture revealed that less than half of new employees receive cybersecurity training and regular updates throughout their career. Just four in ten respondents said insider threat programs were a high priority.
Organisations must look to create a robust and distributed digital immune system with a radical re-engineering of staff behaviour. Business leaders need to have accountability for cybersecurity; security teams need to collaborate with business leaders to create and implement policies that will actually work, and those policies need to be routinely re-evaluated and tested.
Data belonging to 147 companies from the region was uploaded on ransomware dedicated leak sites
A security-first culture requires that all members of the culture appreciate the concept of network security threats. For this to actually have an impact on culture, however, staff must be trained routinely to ensure that their knowledge is current.
Well-trained staff and a monitored environment are crucial to the successful protection of any organisation but without a foundational Zero Trust environment, defences will be intrinsically weak.
A key part of a disaster recovery plan involves backups. However, it is surprising how often restoring from backup systems in real-world situations do not perform as expected. It is important to know which digital assets are and are not included in backups and how long it will take to restore content.
CSOs should plan the order in which backed-up resources will be recovered, know what the start-up window will be, and test backups as a routine task with specific validation checks to ensure that a recovery is possible.
The CSO’s job is not getting any easier, but solid planning using the four strategies will help ensure an organisation’s digital safety. In addition, partnering with top-level enterprise cybersecurity vendors will ensure that critical security technology and best practices are central to the organisation’s cybersecurity strategy.
