It isn’t every day IT leaders from different worlds come together for a frank conversation. But the depth of the cybersecurity challenge, and worsening economic conditions, were enough to bring even the busiest and in-demand figures in the industry to the table for critical talks. 

The need for strong cybersecurity is no new phenomenon, but cyber threats are growing in intelligence and agility. It isn’t enough to throw money at extra defences; that’s only half of the story.

Your cybersecurity strategy needs to evolve with your technology setup, employee behaviour and threat level. 

We discussed overcoming alert fatigue, implementing counter-measures, solving resource issues and how to obtain comprehensive detection and response. Let’s take a look at each of those points and unpack the insights from our attendees. 

Cybersecurity challenge 1: organisations are falling victim to alert fatigue and missing warning signs

Alert fatigue  is real, and it doesn’t just apply to large organisations such as nuclear power plants, manufacturers, and financial institutions. When resources are stretched thin, it can be easy to miss the small details indicating that something isn’t right.  

The same is true of cybersecurity. A multitude of nuanced threats exist, and it is difficult to multitask across systems and services. These cybersecurity challenges stretch an organisation’s resources and can overwhelm people, increasing the risk of human error. 

Colin Lock, Cyber Security Business Manager at Ricoh, weighed in. “We regularly hear about employees stretched and bombarded with alerts. Some experience thousands in a day. In addition to their usual busy workloads, they find it a challenge to know which threats are actionable priorities.”

Attacks are evolving in sophistication. Organisations might miss the warning signs through lack of resources, training, and appropriate notification systems. This means they may not even realise they’ve been compromised until their operations are affected. At this point, it’s usually too late to update their cybersecurity measures.

With bidding and tendering coming up in the spring, getting this right is paramount. Airtight cybersecurity compliance is often a prerequisite for procurement, and governments are cracking down on the rules.

So what is the solution?

Roundtable participants agreed that a Managed Detection and Response solution (or MDR) could help with these issues. But what exactly is MDR?

What is Managed Detection and Response?

Managed Detection and Response is an outsourced package. It provides organisations with capabilities to detect cyber-attacks, respond when they occur, and helps recovery where necessary. This is an enhanced level of cybersecurity protection. It lifts the problem from the shoulders of IT teams and leaders, allowing them to place the responsibility with experts who are better resourced to meet the ever-evolving challenge of cybersecurity.

Cybersecurity challenge 2: organisations are relying on SOC or SIEM services alone — but more can be done.

The acronyms SOC and SIEM stand for Security Operations Centre and Security Incident Event Management, respectively. But the acronyms don’t matter as much. The key takeaway that organisations need to get right is maintaining a proactive process that both protects from and prevents threats. 

SIEM platforms are expensive, need to be configured and optimised correctly and need to be maintained on an ongoing basis. This requires skills and availability often not present in the IT team.

Some businesses set up their own on-site SOC, populating it with a full-time, expert staff. However, this is expensive and resource intensive – and is only set to become more so in the current, increasingly sparse global market of IT professionals. 

For example, in the UK specifically, ISC assessed that there are about 339,000 cyber professionals, up 13% year on year, but there is a shortfall of 56,811 workers, up over 70% year on year. These teams are also only available and responsive during working hours, limiting their ability to detect threats instantaneously.

Outsourced SOC

Alternatively, some businesses opt to outsource operation of their SIEM platform to a third-party who will oversee critical alerts.    

While an outsourced SOC/SIEM service can provide valuable cybersecurity insights, it usually leaves the onus on businesses to confront the challenges identified. They are not on-site and are removed from the source of the problem. Imagine a police service fifty miles away, calling to inform you of a break-in at your house — would that make you feel safe? 

Both options – insourcing and outsourcing – can provide a fragmented and incomplete approach. They both lack the comprehensive, end-to-end detection and response an MDR service can provide. 

As cyber threats evolve, businesses must move beyond passive or fractured solutions to proactive, exhaustive processes.

Cybersecurity challenge 3: companies have passively relied on insurance to reimburse losses — but this is no longer enough

By 2025, the cyber insurance market will hit $14.8 billion annually. Predictions indicate cybercrime will cost the world $30 billion annually by the same date. This rise in attacks and payouts happens when companies passively rely on reimbursement rather than solving the problem at the source. 

Steve Timothy, Cyber Security Specialist Director at Ricoh said, “Insurance companies are tightening criteria. Soon it will become more difficult to recoup losses from cyberattacks. We must also emphasise the importance of optics when going through lengthy legal processes to recoup losses; organisations want to be known as stellar service providers, not remembered as victims after an attack.”

While insurance is a business essential, its value comes after the fact. It is responsive, not preventative, and it can’t recoup the loss of time or reputation once a cyberattack has compromised a company’s integrity. Expensive legal cases to recoup losses keep companies in the public eye — and not in a positive light. 

In 2022, Shields Healthcare Group suffered a devastating attack that negatively affected its relationship with partnerships, hospitals, and other medical centres. In fact, using insurance to pay ransom could incentivise attackers to return; according to a 2022 IBM study, criminals attack over 80% of businesses more than once. 

Cybersecurity challenge 4: employee awareness and consistent training is essential at all levels of business 

Often, well-intentioned or busy employers schedule annual or bi-annual cybersecurity training, thinking doing so is enough to tick the right boxes. They make the mistake of thinking many other tasks take priority.

Technologies (and criminals!) develop and adapt very quickly. Cybercriminals also enjoy increasingly large budgets and sophisticated set-ups. Therefore, training needs to keep up. 

Frequent, updated training also keeps cybersecurity a priority in employees’ minds and demonstrates that employers take it seriously, facilitating a culture of safety at every level of business.

The Solution – Managed Detection and Response

Introducing MDR delivers a significant step forward in cyber resilience in a short timeframe, mitigating the risk of alert fatigue and human error when the proper resources and structures are not in place. 

Additionally, it offers comprehensive end-to-end detection and an ongoing security improvement. AN outsourced SOC/SIEM cannot usually provide this. With an MDR, businesses won’t have to rely on insurance if attacked (and lose money, time, and reputational value with partners). 

If you’d like to learn more about what MDR can do for you, more information can be found in our eBook.

We’d like to thank all roundtable attendees for their valuable insights and contributions.

The post Roundtable Report: Cybersecurity Challenge at Breaking Point appeared first on Insights - Empowering Digital Workplaces.

The latest GOV.UK cybercrime survey reported that nearly 40% of organisations suffered damaging cyber breaches in 2021². And around a quarter of those affected said they had recorded threats at least once a week. In situations like this, we often see decision-makers invest in more and more cybersecurity to deal with breaches – usually Anti-Virus products. 

But today’s cybercriminals don’t attack you with viruses. Most threats happen in plain sight using phishing and impersonation. They say knowledge is power, and the same is true in cybersecurity. 

To protect your organisation, you need more than end-point security. You need to proactively get ahead of attacks.

Threat intelligence gives your organisation the ability to pre-empt and prevent threats before they cause lasting damage to your key operations, finances and reputation. It can identify and monitor threats and even specific threat actors to predict movements and events. And If deployed in the right way, threat intelligence provides actionable advice for decision-makers and a clear ROI.

How does threat intelligence work?

Threat intelligence, in essence, is an organisation or piece of technology working on your behalf to provide intelligence about the cybercrime threats you’re facing. As with cybersecurity in general, it can be delivered in several ways, depending on your level of investment and preference. 

You can either access threat intelligence by purchasing a cybersecurity platform enriched with threat intelligence features or by using strategic threat intelligence consultants. They both provide different services. 

Operational threat intelligence – usually delivered through a platform – has the most value in providing daily defences. By working to identify attacks, events, or campaigns, this type of threat intelligence gives specialised insights that help IT teams understand the nature, intent, and timing of specific attacks.

In some cases, threat intelligence can even get ahead of cybercrime techniques by spotting patterns in the behaviour of specific threat actors. 

Using this knowledge, teams can act on events by putting measures in place to mitigate risks and take pre-emptive steps to prepare for what’s going to happen next. This can take the form of more security measures for credentials and permissions, staff training or risk assessments.

Machine learning and threat intelligence

Sitting on the leading edge, many threat intelligence products use machine learning techniques to improve data collection and data structure, as well as analyse text across multiple languages and even, generate predictive models. 

By combining data points from many different types of sources – including open, dark web, and technical sources – platforms can paint the most comprehensive picture of your threat landscape, helping to protect your organisation on all fronts. 

This is especially useful in cyber breaches using domain impersonation: those times when you think a domain looks like it’s owned by a well-known company, but you quickly realise it’s an imposter. Using machine learning, some platforms have the capability to scan the web for possible impersonations and inform your team, and your customers before any damage is done.

Focus on what matters to your organisation 

Having the technology to form a full picture of the global risks is hugely valuable, but focusing on the risks you know you’re facing frequently is the sign of successful threat intelligence. It’s also important to understand your weaknesses and be aware of the harm that could be done to your organisation. Gartner’s 2021 Hype Cycle for Security Operation’s report had this to say about threat intelligence:

Threat intelligence services provide an inward-looking viewpoint toward an organisation’s infrastructure from the outside. This renewed approach to looking at exposure provides better enrichment for organisations to decide what really matters to them – without having to look at the threat landscape in a more general way and wonder if they are affected.³

As with any other IT or digital project, it is always better to examine your own organisation’s challenges rather than seeking answers and solutions from competitors or the wider market. Any cybersecurity solution should be deployed and managed with your specific needs and concerns in mind.

Building threat intelligence into your cybersecurity strategy

As I’ve already mentioned, there has been a tendency for organisations to invest in one cybersecurity product when threats are on the rise. But with the changing nature of cybercrime, the sheer volume of breaches and the potential losses, it’s not enough to do what you have always done. You need a comprehensive and multi-layered strategy comprising many products, approaches and services to defend your organisation in different ways. 

By using threat intelligence, you can ascertain what your strategy should focus on and where your organisation should be pointing its efforts. And the key is to keep updating your strategy. Threats change like trends change. You’re competing with cybercrime organisations with much bigger budgets than you might think. To stay ahead of the curve, you need to stay innovative. They have the capital to find new ways to breach your systems and infrastructure.

Talk to the Ricoh Cybersecurity Team today

If you’re interested in learning more about what threat intelligence can do for your organisation, speak to one of our cybersecurity consultants or head over to our cybersecurity homepage to discover the solutions on offer. We can help you with operational and strategic threat intelligence. 

Our team has access to industry-leading cybersecurity products, the global scope to provide you with best-class service and is passionate about building cybersecurity strategies fit for the modern digitised world. 

You can also find out more about Ricoh’s Cybersecurity experience through our case studies. We work with all industries, including high-risk sectors such as schools and other public sector organisations that nation state actors commonly target.

1. https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2021/cyber-security-breaches-survey-2021

2. https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2021/cyber-security-breaches-survey-2021

3. https://www.gartner.com/en/doc/security-operations

The post Threat intelligence is crucial to your cybersecurity strategy appeared first on Insights - Empowering Digital Workplaces.

In 2020, there were more data breaches and cyber-attacks on companies, governments, and individuals than ever before. The sophistication of threats has also increased due to the application of emerging technologies like machine learning and 5G, and because of greater tactical cooperation among hacker groups and nation state actors.

The primary cost of cybersecurity is alarming, but the associated costs don’t often make it into the headline statistics. Due to a weekend-long cyber attack in October 2021², Tesco had thousands of customer orders disrupted and lost millions in missed sales, and we can assume the losses won’t stop there. They will now have to react quickly to implement more cybersecurity tooling and work hard to repair and restore brand reputation with its customers – potentially costing more money. 

By not regularly reviewing your cybersecurity strategy, you are leaving your organisation open to a multitude of complex threats. These have the potential to destabilise your operations and affect business outcomes for years to come. It isn’t enough to invest in one endpoint AntiVirus or Firewall solution, cybercrime is at a level of maturity where there is not one single product that can eradicate all threats. 

What makes a good cybersecurity strategy? 

Your cybersecurity strategy should be proactive rather than reactive and take the approach of ‘when’ an incident occurs rather than ‘if’. Instead of focusing on preventing a cyber attack, the most effective strategies stress the importance on how to detect, respond and recover from an inevitable breach. That said, any robust cybersecurity strategy should put you in a better position to respond to an attack. A comprehensive strategy aligned to a recognised industry certification such as Cyber Essentials Plus can make the difference between a minor incident and a major one.

Cybersecurity also needs to be tailored to your needs, challenges and digital journey. Each organisation is unique and requires a customised approach to strategy. 

Step 1: Review your cybersecurity setup

By reviewing your cybersecurity position, you can identify high-risk areas and any redundant tools which can be shelved. It is also essential to understand where the threats are deriving from and if there is a fit for purpose solution to plug the gap. By undertaking this process, you could identify some quick wins to unlock improvements and improve cyber resiliency. 

We often find that our customers are renewing existing ‘legacy’ security solutions which were developed and selected several years ago when the landscape was very different. Many of these tools are not able to respond to the latest emerging and “zero-day” threats. Today, cybersecurity isn’t about investing the most money. It’s about making tactical moves and spending budget intelligently. 

Step 2: Layer up with cybersecurity 

To prevent and mitigate cyber-attacks, your strategy must employ a range of technologies and solutions to cover all bases. And as the threats change, the bases can also change. Much like digital transformation in general – cybersecurity is a continual process that involves monitoring, threat hunting, training, and cultural change. 

Some solutions to consider are perimeter security, endpoint security, back-up and disaster recovery, authentication protocols, real-time monitoring and threat intelligence. 

Step 3: Make testing a priority

For any company undergoing a period of digital change, it is vital to promote a culture of continual security testing. Any new application rollout, change to IT infrastructure, or merger or acquisition activity can potentially expose new security vulnerabilities that threat actors can and will exploit unless these changes are tested proactively to ensure any holes are identified and remediated. Over the past two years, we have seen this frequently as organisations were forced to implement years of transformation rapidly. To make sure their workforce could work successfully from anywhere. Many fell victim to cybercrime due to poor implementation. 

Step 4: Scrutinise your resource 

Over recent years, the escalation of cyber-attacks has seen organisations rush to employ skilled professionals. As a result, leaving the market depleted of cybersecurity experts. There is currently a shortage of over 1.2 million. Your organisation might be feeling this impact directly. When considering your cybersecurity strategy, it is important to review resources and identify where you need extra expertise or whether tactical outsourcing is more appropriate. 

Ricoh Cybersecurity Practice

Working with a collaborative partner is a fantastic way to fortify your business against the risk of cyber-attack. Our team is innovative, forward-thinking, and works with a range of global clients across both the public and private sector. By taking advantage of our experience and expertise, you can build a cybersecurity strategy built to protect your business against new and evolving threats. 

Find out more about Ricoh’s Cybersecurity experience through our case studies. We can work with all industries including high-risk sectors such as schools and other public sector organisations. Read more about how we help St Bede’s school safeguard their systems and pupils. 

Read about our proactive Ransomware product and how it might benefit your organisation.

1. https://cybersecurityventures.com/hackerpocalypse-cybercrime-report-2016/

2. https://www.thegrocer.co.uk/finance/city-snapshot-tesco-website-back-online-after-weekend-cyber-attack/661110.article

The post Cybercrime is posing an unprecedented threat, it’s time to develop a proactive cybersecurity strategy appeared first on Insights - Empowering Digital Workplaces.

Business has evolved rapidly in the last few months, and remote working is one of the many changes which seem set to stay. But while we take advantage of new opportunities, so too are cyber-attackers.

Our professional lives have changed forever. And while we may have lost some of the camaraderie of a shared office space, we’ve gained all the benefits of agile and remote working.

But our new-found flexibility comes at a cost. Businesses must rapidly adapt to changes in order to provide the digital infrastructure and processes we now require.

And until all the right pieces are in place to ensure cyber resilience, we are at increased risk of attack.

What is cyber resilience?

This is a term used to describe your organisation’s ability to identify, prevent, detect and respond to the technological and process-related consequences of a cyber-attack.

It also relates to your organisation’s ability to recover from those consequences. As well as minimise any negative impact on your customers, reputation and finances.

Why is cyber resilience vital to business success?

Because cyber resilience is directly correlated to business resilience. The ability of your organisation to maintain business-critical processes if devices or workflows are disrupted, including by cyber-attack.

But cyber-attacks don’t just affect time and productivity. The average days of downtime due to ransomware outbreaks in Q2 2020 alone was 16 days. This could end up costing you a lot of money. The most damaging, disruptive and by far the costliest cyber threat that can hit you is ransomware, and it is imperative to stop any outbreak as quickly as possible.

If you don’t, the only two options are to pay the ransom or go through the expensive process of restoring and rebuilding your IT environment.

How do I know there’s been a ransomware attack?

It’s a good question. Sometimes an organisation might not know if there has been a ransomware outbreak until months after the initial infection. By which time huge amounts of your data will be inaccessible and under the control of cyber criminals.

But there are some signs an individual might be able to spot on their own devices which indicate an attack has occurred, including:

• Unresponsive systems
• Documents, data, photo and files encrypted
• Changed filenames
• Unable to access data
• Screens locked

If any of these things occur, your people should notify their IT administrators immediately.

Perhaps you would like to see an example of how an attack plays out in realtime – if so watch this video demonstration.

What steps can we take to protect ourselves against cyber-attacks?

Where once our IT managers only had to concern themselves with securing centralised locations, with servers, staff and hardware all situated under one roof, they must now consider how to proactively protect your people across multiple locations and devices with improved cyber resilience across the business.

Watch out for phishing scams

Phishing attacks involve hackers sending seemingly legitimate and deceptive emails to your people, which include malicious links and attachments. Once your employee clicks that link or downloads a malicious attachment, the ransomware outbreak has been initiated.

As we now rely almost exclusively on digital communications, we’re more vulnerable than ever to fall for these tricks.

Educate your employees

Carrying out virtual training – such as phishing simulations – can be a great way to improve your organisation’s security. Have your IT teams educate your people on what to look out for – such as suspicious phishing emails and malware – and on what to do if a cyber-attack does take place.

It is then a great idea to follow up these sessions with regular reminders to keep your people on their guard. But no matter how much training and education you do, people will still make mistakes – it’s all about reducing risk.

Establish a last line of defence

If your people do make a mistake, or if any of your existing security solutions fail, you will need to have a last line of defence in place.

For cyber resilience, this comes in the form of a containment solution. Just as white blood cells rush to the scene of infection in your body. Containment solutions instantly identify and shut down ransomware outbreaks at the source.

Ricoh Cyber Security Practice

Working with a collaborative partner is a fantastic way to fortify your business against the risk of cyber-attack. By taking advantage of their experience and expertise you can build cyber resilience and ensure continuity.

Read our guide Cyber Security

Ricoh’s Cyber Security Practice provides a revolutionary “Last Line of Defence”. It delivers a 24/7 automated containment solution focused on stopping a ransomware outbreak as soon as encryption starts.

If you’d like to hear our experts share insights and discuss how best to secure your data and remote workers at a time of increasing cyber-attacks, have a listen to our webinar.

The post Why remote working has made cyber resilience crucial for future business success appeared first on Insights - Empowering Digital Workplaces.