According to the UK government, half of the country’s businesses were hit by a cyber security attack in the past year – an increase of almost 40% from the year before.
Cybercrime cost the nation’s economy £30.5 billion in 2023, and small businesses saw an increase in breaches of over 40%. Little wonder then that reports reveal nearly half of businesses are currently feeling more threatened by the impact of ransomware on their finances than they are by the recession.
Despite the statistics, less than 10% of the average company’s IT budget goes towards cyber security, and while almost 70% of firms recognise the need to improve security measures, their main barriers include staff shortages and insufficient automation.
Additionally, while it takes the average UK organisation 15 to 17 days to fix a vulnerability in their IT structure, the National Cyber Security Centre in the UK recently released guidance recommending firms patch up any vulnerabilities within five to seven.
So, most organisation’s cyber security personnel are feeling the pressure, regardless of size.
For larger enterprises, Chief Information Security Officers are in a position where they are pushing for more support from the board, while full-time IT employees in smaller businesses are becoming loaded with security responsibilities, according to Richard Seiersen, San Francisco-based chief risk technology officer at cyber security firm Qualys.
Either way, expectation is loaded on the person responsible for security in any organisation, regardless of their job title or size, argues Seiersen.
“CISO is a relatively new career,” explains Seiersen. “They didn’t really start coming in the US until about 15 years ago, and now you’re seeing a lot of people with the CISO title.”
“SMBs meanwhile, are under attack just as much, if not more, than big corporations and those with no experience are having to educate themselves in cyber security.”
According to Seiersen firms in the latter category that decide they need a head of security, tend to recruit someone from IT “…or whoever has a pulse.”
“We call this person security a ‘stucky’,” explains Seiersen. “Upper management will tell this person: ‘We get that you have a full-time job, but here’s another one. That’s where you get burnout.”
Seiersen claims to that combat this, tools are needed that have “visibility, easy access, easy patching, and easy reporting.”
In the UK one in ten primary schools suffered financial losses, data theft or compromised accounts due to cyber attacks in the past year. Many such incidents happen when pupils are on holidays, the virtual lights are off, and no one is in.
Enterprise network and cyber security team leader, Murat Dilek at Falkirk Council in Scotland is responsible for the cyber security of 55 primary schools across the region.
This responsibility and all the devices that – both in school and out of school – this entails is a huge task.
One pressure point is software updates: weaknesses in institutions present themselves to hackers when desktop browsers such as Google Chrome releases security updates for a vulnerability in its app.
For schools or offices with tens, or hundreds, or thousands of devices, this means IT needs to manually (although it can be done from one device) ensure that the app is updated across the establishment.
Unfortunately, however, hackers know that this vulnerability is there to be taken advantage of, and if they do, they can access the application, read sensitive information on other apps, or cause crashes.
On a usual weekday, when IT is active, this can be handled. However, Google has been known to release these patches over a weekend or the holidays.
“On a Saturday morning about early June last year, I read that Google released a patch,” recalls Dilek. “But I was in the middle of a park in Aberdeen with my daughters.”
It was fortunate that Dilek saw the update and was able to open his laptop in the park and perform the patch, but the disruption to his weekend and the pressure of the schools across the region meant he had not choice but to get to work at this moment.
Following this experience, Dilek and his team started to research auto-patching solutions as well as options that could help them monitor everything at ease and detect and kill any malware or ransomware threats – which is where security vendor Qualys’ automated platform came in to save Christmas, according to Dilek.
He recalls: “On Christmas Day, I had my lunch, I was having family time and enjoying a game of football on FIFA and then six minutes before the end, I recieve a text message and an email from Qualys announcing that malicious activity had been detected.”
“Before the FIFA match had ended, Qualys had killed the connection, killed the process and quarantined the device.”
The CISO later found the source of the issue: a device in a children’s care home. “So, I defended the game, I wasn’t interrupted, everything was fine,” he adds.
Subscribe to our Editor's weekly newsletter
Share
