Why Business Leaders Need to Make Cybersecurity a First Priority

Based on an article by Mohamed Jafriin N H, Marketing Analyst, ManageEngine

Businesses are shifting critical files to the cloud at speed, and the number of cybersecurity threats keeps growing. Together, argues Mohamed Jafriin N H, a marketing analyst at ManageEngine, these pressures leave security teams struggling to keep valuable and frequently exposed data safe. No company is beyond the reach of a breach, as the recent criticism of the biggest technology firms over their security practices has shown.

He cites several examples. Google disclosed that it had kept the passwords of some enterprise G Suite customers in plaintext for more than ten years, adding its name to a list of well-known companies that have owned up to similar failures. A database of Instagram influencers turned up online, unprotected and open to anyone. Those revelations followed only weeks after it emerged that WhatsApp had been compromised with spyware built by the cyber intelligence company NSO Group Technologies.

Breaches this prominent, he says, should push companies to protect their proprietary information actively and make sure security procedures are enforced to the letter. That means spending on stronger defences so that security teams are able to investigate the gravest threats and report on them.

Regulators and outside attackers raise the stakes

Privacy regulators are paying closer attention to companies that hold critical customer data, and research shows that malicious outsiders caused more security incidents than any other kind of threat. High-profile cases in Malaysia and around the world have helped people see how valuable their data is and how it can be turned against them. The demand for more protection has brought a larger supply of security products, and companies are trying every available method to shore up their defences. Even so, the number of back doors, the skill of attackers and the sophistication of threats all make meeting security requirements harder. Even a very small breach can do serious harm to an organisation's reputation.

The warning signs that get missed

According to Jafriin, breaches can be stopped if IT security staff are able to recognise the telltale signs early. Those signs are often plain to see in audit trails, yet they get overlooked among the mass of harmless events recorded alongside them. Permission changes nobody is watching, a new service starting up on a server, or a user being locked out repeatedly are minor irregularities, but each can point to a breach in progress. Indicators like these can go unnoticed for a long time. Catching them fast requires event logs to be analysed as they are written, and the difficulty lies in finding these threats while there is still time to act.

What a workable defence includes

Staff in a security operations centre should be able to audit every device on the network in real time, Jafriin says. Organisations also need a structure that lets them tell affected people quickly and report to regulators without delay. He notes that Malaysia's Personal Data Protection Act is a step that would oblige businesses to report breaches to regulators within a set period once a breach has been detected and investigated.

In his view, every company's security strategy should include thorough reporting, alerting, threat detection and automated incident management. Security logs should be sorted by type of event, for example login events and file activity, and laid out in clear reports recording who did what, where and when. Collecting event logs from all network devices in one place makes it simpler for security teams to study the data and link related events.

Tracking what users do, from failed logins to the files they open, matters too, because it creates accountability if a breach is ever investigated. Security teams need to watch closely for permission changes on sensitive files and folders to prevent unauthorised access. When a threat is spotted, IT administrators must be alerted straight away. An automated threat response, he argues, means possible data loss incidents are handled quickly and efficiently, with a clearer view of who is accessing sensitive data and critical servers.

Keeping an audit trail of every action and every fix carried out across the IT environment serves one more purpose: it helps organisations comply with industry and government security standards.

News of cyberattacks and data breaches appears ever more often, and the rate shows no sign of easing. Jafriin's advice is that organisations work to keep themselves out of those stories, by applying strict security procedures across the business and giving the IT security team the means to watch the whole environment closely and fix problems immediately. Plenty of security auditing and reporting products provide some or all of these capabilities, and he recommends examining them carefully to find the one that suits each organisation's needs and gives it the strongest protection.