Importance of Changes in Corporate Mindset in Preventing CyberSecurity Issues

Cybersecurity news is becoming a dime-a-dozen these days, to a point that the daily trend has started to blur the line which it can still be defined as “news.” There was no single week in the past five years that had no news about a “well-known enough” organization getting hacked, becoming a victim of a virus infection incident, a phishing attack or a social engineering episode.

Data right now is fast becoming synonymous with money, all known organizations, including the criminal syndicates, are after money. That equals to the hypothesis if data is money, then if you hold data – you are at risk of becoming a victim of cybercriminals. It is happening, cybercriminals are making a living and earning a lot of profit from the weaknesses of organizations and individuals. Take a look at the rise of WannaCry ransomware of 2017, where an estimated $4 billion went to the packets of its unknown authors.

The world of corporate computing is evolving at a fast rate. It used to be that the cybersecurity of an organization is based solely on the shoulders of system administrations and the rest of the members of the IT team. Such responsibility has been shifted to everyone in the organization, all people that use the workstation and bring their personal devices for business use also known as BYOD.

A typical protection that firms used to depend on like the corporate endpoint security (the enterprise-grade antivirus package) is no longer effective compared to its counterpart a decade ago. With the introduction of BYOD to the organization (whether the company supports it officially or not), the restrictions placed on the company-issued devices are no longer the source of the risks.

BYOD is not covered by the company-restriction through Windows Active Directory, as both iOS and Android cannot be controlled using it. Companies can issue a BYOD policy, though, but detection of issues on one device is inherently harder than restricting a Windows machine through Group Policy. Blocking Internet access to lessen the diversion of the employees to their tasks at hand is also can no longer be imposed, as through their personal devices, they can access the Internet through their smartphones anytime any day through a data connection.

Keeping the company from the harm of malware attack or a phishing attack requires a lot of effort at the end of the employees. The workers using the devices are the primary defense line of any organization. Educating them about cybersecurity risks and learning the best practices is a lifeline of an organization in preventing cybersecurity trouble. Part of IT audit is penetration testing, a series of external white hat hackers simulating a real hacking incident against a company for a fee. There is an organization that does not believe in the value of penetration testing, they see it as a cost to a company. However, this view needs to change as the cost of recovering from a hack, a virus infection, phishing incident or data breach is definitely much more damaging. The aftermath of a hacking incident may point in the direction of a company going out of business due to the decline in customer trust.

With this point-of-view, it can be concluded that penetration testing is an investment not to get hacked or fall for a phishing scam. Companies need to have a change of perspective in order to prevent cybersecurity issues in the future.