Ever heard of the ransomware Slammer?

It happened in 2003, when a computer worm infected 75,000 servers across the world. 13,000 of the Bank of America’s ATMs were unusable. 27 million people did not have access to mobile networks in South Korea. Computer sites were frozen in China. All of these happened in just 10 minutes.

More than a decade later, enterprises are still facing cyber attacks, and they are more deadly than ever. In fact, in 2017 we faced one of the largest ransomware – WannaCry – where more than 200,000 computers across 150 countries have fallen victim. According to cyber risk modeling firm Cyence, the WannaCry ransom attack losses could reach as high as US$4 billion.

Clearly, cyber security is no longer an IT issue. It is a concern for business leaders too. This is undeniably due to the growing sophistication of cyber threats.

Change in Paradigm

We used to build castles, with strong walls, one door, and few narrow windows. It is an air-tight security perimeter and was all about preventing attacks using strong walls.

However, cyber threats have evolved. They are increasing in volume and sophistication. Cyber criminals are also sharper and craftier. Crime-as-a-Service is a reality and a proven business model. According to Carbon Black’s Threat Analysis Unit report, the Dark Web Marketplace for Ransomware is growing at a rate of more than 2,500% per year.

The Cyber Security Agency of Singapore’s inaugural cyber landscape report also highlighted that an unnamed public organization here was hit by a state-sponsored advanced persistent threat in 2016.

Who can we trust these days?

Trust has been shattered by the very institutions that are supposed to guarantee it.

Cyber defense in Maslow’s Pyramid

At Orange Business Services, we believe in a tiered approach to cyber security.

Picture Maslow’s pyramid.

At the bottom, we have physiological and safety needs such as food, sleep, and shelter. These are the basics.

Likewise, for cyber security, the fundamentals need to be in place. Most organizations will already have the traditional cyber defense infrastructure, such as the firewall, implemented. However, the basics will not suffice. A single level of security for everything inside the castle is not enough.

Thus, we move on to the next layer of the pyramid – belonging. This means, preventing threats not only from the outside, but on the inside as well. There is a need for different levels of cyber defense, different levels of access control.

This is similar to how an airport operates. There is a public area where one can wander freely, a passenger area where one must show their boarding passes, and a restricted zone that only the airport and airlines staff, with badges and biometrics, can access.

It is also easy to imagine that the biggest threat to a company is external. However, companies are beginning to realize that trusted employees can also pose an enormous threat. It could be an innocent action by an employee falling for a phishing attempt, or it could be due to negligence. A good example is the recent Equifax data breach, where an internal email requested that the IT team fix a software. However, the message was not communicated to the right person to manually patch an application, which eventually resulted in the hack.

Once the right infrastructures are implemented, and employees are well-informed, the top layer of the pyramid is self-actualization. This is where organizations move away from a reactive security stance, to a proactive or event predictive stance. The right detection and mitigation measures are employed, and the holy grail is to be able to understand what and who is coming for you next.

And this is how we build a cyber defense network.

Implementing a robust cyber defense ecosystem may sound daunting and tedious. However, as cyber criminals and malicious state actors continue to evolve, business leaders cannot ignore the need to match them. On a positive note, IT teams are no longer fighting this alone. Now, they are finding staunch allies in the board room.