Regardless of industry or market, CISOs are facing new classes of attackers, from sophisticated teams of hackers who want to obtain an enterprise’s lucrative customer data to activists who want to ruin a company’s reputation and fraudsters who imitate a brand for financial gain. Cybercrime has become organized crime and criminals are finding new ways to harm businesses and individuals on a daily basis.
Without being alarmist, depending on the size and notoriety of your company, it's not unreasonable to assume that while you are reading this, someone is working to pry private, sensitive data from your servers. CISOs must stay ahead of the curve to combat the rapidly evolving cyber threats that have resulted from an increasingly global and digital business landscape.
The Necessity of Regulatory Compliance
In addition to general security regulation put forth by governmental agencies in North America, certain industries have other regulatory bodies with which they must comply. For example, financial institutions in the U.S. must comply with FDIC and FFIEC regulations to help ensure the integrity of communications and online activity. On a global scale, foreign financial institutions with a large presence in the U.S. subject to those same U.S. regulations. However, compliance initiatives are not usually sufficient to stem security concerns.
To better understand potential security gaps, especially in regards to cyber threats beyond the perimeter, many enterprises have joined their industry’s ISAC organization, such as FS-ISAC, the premier security working group for financial services industry. Through organizations like this, and emerging ISACs and ISAOs, institutions and enterprises are able to pool knowledge and plan for the latest kinds of cyber threats, and implement robust threat detection architectures, controls and information sharing programs.
But even as organizations develop and implement strategies for staying ahead of the cybercriminals, they have been unable to solve their security problems – particularly when relying solely on in-house resources. Because of the massive costs and resource requirements necessary to build a team to detect and manage outside threats, outsourcing a portion of cyber security has become the norm for most companies.
Ensuring Security Beyond the Perimeter
A large North American firm with a global presence recently worked with BrandProtect to estimate the costs of protecting the firm (employees, assets, partners, reputation) from third party cyberattacks and brand abuse through a wholly in-house effort. It determined that it would have to assemble a team of at least six people and invest between $2 to $3 million annually to create coverage that at best would only attain a small fraction of the coverage that it enjoyed through its partnership with a security firm – in this case, BrandProtect.
A strong partnership with a security services provider effectively adds highly trained, deeply experienced cyber threat specialists to a firm’s existing security team without the need for additional training or technology investments. From phishing scams and domain abuse to mobile application fraud and sophisticated identity theft schemes, a dedicated managed service can provide multiple layers of threat detection, analysis, threat correlation, and threat mitigation. All day, every day, these services will patrol online sites and markets to discover and understand any threats to a business and unauthorized or infringing online content related to the firm or its employees.
An increased use of technology across all business models has led to more threat vectors than ever before, as attackers have exploited gaps formed by business being transacted digitally and employees having access to an organization’s data outside of its walls. As a result, cyber threats are moving beyond the traditional security perimeter, which is making it harder for organizations to detect potential attacks using existing perimeter-focused tools. Without the proper preparations, such as implementing holistic external monitoring and collaborating with security experts, organizations will struggle to detect and diffuse online threats. Forward-thinking CISOs are already adopting external monitoring to better protect their organizations, and that number will increase throughout 2016.
Will you be ready?