While COVID-19 paused many activities in 2020, cybercriminals continued to keep busy evolving their arsenal of weapons for more lucrative cyberattacks. While companies adopted remote work models and third parties experienced heightened disruption, cyber risk skyrocketed with increased ransomware, credential stuffing, malware, and Virtual Private Network (VPN) exploitation. As a result, the number of data breaches in the U.S. reached 1001 cases last year, with over 155.8 million individuals affected.
Now following the SolarWinds hack, President Biden is set to sign off on an executive action to address gaps in national cybersecurity. The move is causing many CSOs to look for ways to evolve beyond the reactive model to an “always-on” approach — one that proactively mitigates potential threats and risks before they disrupt business.
Risk is a Raindrop Before It is a Waterfall
Today, most organizations focus almost exclusively on third-party financial and cyber risks. But this hyper focus leaves business exposed to risks of disruption from other sources. Without visibility into their entire risk landscape, they will often miss the early indicators, which then cascade to increasing cyber susceptibility risks.
Think of it as a waterfall. Other risk categories including operations, compliance, employee health, geopolitics, reputation and more – are often the early indicator water drops, that precede potentially costly cyber events (the waterfall). When evaluating and designing strategies for risk mitigation, the aperture needs to be widened in order to fuel awareness of the many vulnerabilities that may cause business disruptions.
To illustrate this point, let’s look to the recent pandemic. What began as a health issue localized in a single city, within mere weeks cascaded into employee and geo-political risks as absenteeism increased and governments enacted shutdowns. These events further cascaded into sudden remote work mandates that impacted operations’ health as many struggled with lack of available of equipment and local infrastructure challenges. As the crisis continued, financial health of third parties was impacted leading to increases in operational and cyber susceptibility. A wider risk aperture enables proactive risk mitigation through early warning when risk originates not when it’s later on cascaded to a bigger risk of disruption such as financial or cyber.
It’s also crucial that this visibility extended beyond third parties. When the pandemic hit, many third-parties ability to perform was negatively impacted by failures at the 4th and 5th party level. Enterprises realized during the pandemic that they had very little visibility beyond their third parties. Proactive risk mitigation requires a view deep into the supply chain to include Nth parties. By monitoring the entire risk landscape throughout their entire network of partners, companies are able to flag the earliest indicator that cyber trouble is coming.
Risk Doesn’t Sleep – Neither Should Your Risk Monitoring
Security’s new standard means taking a continuous approach to comprehensive risk monitoring. It’s simple: keeping track of risks posed by third parties should be more than a once-a-year, once-a-quarter, or even a once-a-month endeavor. These point-in-time assessments don’t cut it when vulnerabilities are dynamic and cascading – especially through a global crisis. Information collected through these outdated evaluations can go stale within a day.
Risk doesn’t sleep – but chances are, you and your team need to in order to function. Humans simply can’t take a continuous approach to risk monitoring alone. The risk landscape is so vast that the continuous monitoring required is beyond human capabilities. Additionally, the increased volume of risk findings puts an inordinate amount of pressure on human resources.
This is where automation, data science and artificial intelligence (AI) comes into play enabling the risk team to do more with less. Today’s technology can enable automation of the process of identifying indicators that have the potential to start an avalanche of cascading cyber disruption and immediately channel risk alerts to the right person within the organization. As a result, employees can shift their focus from risk identification to risk mitigation.
To handle the increased level of risk findings, a significant portion of risk actions can be automated enabling internal teams to focus further on only the most critical risk mitigation efforts. For example, a predetermined threshold for deterioration in financial health could trigger an automated health assessment or sourcing process to find an alternative qualified supplier.
This human + automation model can remove many of the obstacles that keep organizations from dealing with risk proactively, by:
- Widening the lens through which risk is seen, ensuring that vulnerabilities of all kinds are monitored, flagged, verified against multiple data sources and assessed on severity.
- Providing always-on monitoring and near real-time risk intelligence for a steady-state of protection that empowers people to make the right decision, fast.
Security’s New Standard, Powered by Automation
Today’s reality is that any single vulnerability may ultimately cascade into increased cyber susceptibility, making awareness of the universe of potential risks essential to any robust proactive risk mitigation strategy. Automation fuels the continuous intelligence and insight that make it possible for people, processes and technology to work in concert to act on the intelligence and mitigate the risks to prevent major breaches.
As globalization continues, organizations become more and more decentralized and the complexities of business grow, so too do the cyber threats and vulnerabilities that plague businesses today. Companies that invest in solutions that turn continuous data into actionable intelligence and develop a 360-degree view of risk across the organization and its ecosystem will be the ones that set the new standard for prevention and protection.
Source: https://www.securitymagazine.com/articles/95081-securitys-new-standard-always-on-protection-and-prevention
