By MARK SKELTON
IF 2020 GOES down in history as the year that shifted the priorities, goals, and needs of businesses across every sector, 2021 should go down as the year of learning, evaluation and growth.
This year and beyond, there are many learnings for businesses to consider and challenges to overcome. A key priority must be cybersecurity and how it is managed — which is a challenge, considering that many organisations don’t really know what they need in today’s fast-evolving threat landscape. Many — despite using a proliferation of cybersecurity tools — are still being hacked.
Recent research shows that 63 percent of CISOs have observed an increase in the number of cyber attacks, while a HISCOX study found that one-in-six businesses that were hit in the last year went under. The UK government has also reported that four in 10 businesses were victims of cybersecurity breaches or attacks. These are worrying statistics for business leaders and employees.
As companies look ahead and construct plans for the best way to conduct business, post-pandemic, it is crucial to evaluate the best cybersecurity posture for individual business needs.
Virtually overnight, the role of an IT support team adapted to the minefield of new tech issues that needed to be handled remotely. With many teams now set to move to a hybrid working mode, this diverse IT support role will continue to expand in terms of role requirements, with smart meeting rooms and increased reliance on mobile devices putting more pressure on teams.
Put simply, IT teams are unsustainably stretched — which the numbers back-up. According to UK government figures, half of all businesses have just one person managing or running cybersecurity in-house. Even among large businesses, the average cyber team comprises just two to three people. Defending businesses against increasingly sophisticated cyber threats is an incredibly demanding task. Teams struggle to stay on top of important security practices such as vulnerability management and 24/7 network monitoring.
Business leaders must evaluate the capacity of IT teams and stress-test for when things go wrong. How long would it take an IT team to spot a breach, for example? Would this time put many of the team offline and affect business operations?
Downtime is highly costly for businesses, with estimates of loss of income at more than £4,000 per minute, depending on company size and outage time. That’s why the speed of detection is what many customers are now focusing on. But few companies have 24/7 security professionals on hand to swiftly detect and remediate. Slow response time can cost businesses crippling amounts, especially when it comes to large-scale attacks. The significant ransomware attack on the Irish health service’s computer systems just last month is estimated to cost more than £850,000 in terms of reversing the damage.
Businesses need experts who understand the difference between false positives and real threats — and this needs to run across a company’s entire technology stack. But this is tricky for many organisations to acquire in-house.
Developing cybersecurity and ensuring staff have the knowledge to stay abreast of the latest technologies and threats — with training and ongoing education — is an investment that must be carefully managed.
To identify, deploy and update several best-of-breed technologies into one comprehensive security position takes time, effort, and resources. This’s why many under-resourced CISOs, CTOs and technical managers opt for smarter, security-as-a-service alternatives. Security consulting and managed services aim to take a proactive approach, learning from threat intelligence and the customer base, to help customers stay in-step.
A recent report from the UK government showed that many non-cyber organisations have staff who carry out IT security functions on an informal basis; only seven percent of businesses even had this responsibility formally written into the job description. The government has also formally identified a cybersecurity skills gap in the UK, which clearly marks the pressing need for more cyber-skills training. Encouragingly, there are some steps being taken to address this, but it stills falls to organisations and their in-house teams to do much of the heavy lifting.
The cyberthreat landscape is constantly evolving, meaning that it requires specialist knowledge and skills that must be continuously refined and updated. Finding time for in-house staff to undertake dedicated security training is often difficult, particularly if it falls within the remit of already-stretched IT teams.
To limit the risks posed to businesses, effective cybersecurity and risk management requires dedicated professionals able to identify threats and maintain digital resilience from infrastructure, apps and data, network and endpoints.
By outsourcing security, businesses can gain access to a breadth of specialised, honed knowledge, as well as an external viewpoint and fresh perspectives, which are essential when making any changes in or additions to IT infrastructure as businesses grow.
Mark Skelton is vice-president and CTO at Cancom UK&I
