.png)
When it comes to cybersecurity solutions and measures, how much is enough? Especially given today’s cybercrime activities that have been making the headlines on a daily basis. Worst, all signs point to a tremendous increase in this cybercrime activity that will not subside anytime soon and is becoming more advanced.
I know of no business that is keen on spending extra money on cybersecurity solutions and services. It’s easy to understand why as these expenses do not generate new sales, hire new people, or help pay the rent. It’s looked upon as a “necessary evil” expense, especially since it is intended to protect against the evil behind ransomware and such.
But today’s businesses have to be on high alert and adopt a more comprehensive security posture. The consequences of being a victim of a ransomware attack, breach or internal theft are too significant to ignore taking additional precautions to mitigate.
Some businesses must invest in additional cybersecurity solutions to satisfy compliance or regulatory requirements. Insurance companies are also now requiring additional security measures to be implemented to perfect claims in the event of a cybersecurity incident.
Hidden Costs of Cybercrime
While many business owners object to making these additional investments, they should most certainly understand the risk if they do not. The cost of these additional cybersecurity solutions may be expensive, but the hidden costs of cybercrime is even more.
For instance, consider the hidden costs of a ransomware event. These attacks have been occurring more frequently and with greater consequences. Just take a look at this sobering list of ransomware statistics and trends this past 2020 and it will put this threat in perspective.
The hidden costs of being a victim of ransomware or breach includes:
System downtime of network resulting in complete work stoppage.
Critical company functions and processes cease.
Damage to company reputation and brand.
Loss of trust by clients that are impacted indirectly.
Litigation if confidential data is breached or made public.
Theft of confidential data and IP that devalues the company.
Incident response costs for attorney fees, forensics, and IT services.
Fines for businesses in medical, financial and other regulated businesses.
Increased premium on insurance rates that will continue year-after-year.
PLUS, the costs of Implementing the same cybersecurity measures originally deferred.
The Bare Basics for Cybersecurity Today
At one time, not too long ago, it was sufficient to have basic IT protections such as anti-virus and a firewall. However, current day cybersecurity strategies require a more robust approach to mitigate the increasing threats.
Cybersecurity today is a layered approach requiring multiple solutions to secure and protect against cyber threats. Policies, processes and user training are also critical elements to ensuring a sufficient level of protection.
The baseline needs for a basic cybersecurity strategy include:
Next generation firewall with intrusion prevention.
Advanced endpoint protection with machine-learning analysis.
Single Sign-on & Multi-Factor Authorization.
Internet monitoring, filtering and protection.
Email security, filtering & continuity.
Mobile device management.
Written policies & procedures.
Security awareness training to prevent phishing attacks.
Cyber insurance.
Dark web monitoring.
Regularly scheduled cybersecurity risk assessments and vulnerability scanning.
For some companies that have more regulatory requirements or higher security risks, there are more advanced solutions that provide another layer of cybersecurity protection and includes:
Managed detection and response monitored by a 24/7 security operations center (SOC).
Log collection (SIEM) monitored by 24/7 SOC.
Other threat-specific solutions.
In addition, the core of your cybersecurity strategy should absolutely include business continuity, which is the ability to recover quickly in the event there was an incident. This goes beyond just ensuring good data backups, and becomes more important if your business is dependent on technology and IT. I’ll talk more about business continuity in a later blog.
If the business does not have these basic cybersecurity solutions, it is at risk of suffering a substantial cyber-attack and jeopardizing the well-being of the business.
How Much is Enough?
So, how much is enough? As you can see, it’s really a measure of comparing the ‘hidden costs’ of a one-time incident as compared to the costs of implementing the ‘basic’ cybersecurity solutions. Spend to the level required to protect the business based on what you now know.
Back in the day, I found it difficult at times to convince a client to invest in a sound backup solution that would allow them to restore in the event of a disk crash. However, it was a much easier conversation if this client had ever experienced a data loss and understood the hidden costs of that disastrous event.
I submit we’re at the same point whereby some businesses will make similar mistakes and underestimate the damage a cybercrime event may have on the business.
The time to take action and make preparations is now. I can assure you that cyber criminals are actively working to exploit your business and all others as you read this. Take action now to update your cybersecurity measures and technology to mitigate this very real threat.
Lastly, work with an IT professional that is knowledgeable in cybersecurity or has reputable partners that provide this specialized service. Many attacks have originated from IT and managed service providers so it’s important to partner with a qualified firm that has invested in these same technologies themselves.
* * * * * *
Tommy Wald is President and CEO of RIATA Technologies, an IT and security consulting firm specializing in cybersecurity consulting, cloud migration and business continuity solutions. For questions about how RIATA can help your company be better prepared, contact TWald@RIATATechnologies.com, or visit our web site at www.RIATATechnologies.com.