Cybersecurity continues to be a pressing issue for businesses across the Asia-Pacific (APAC) region. We’ve all seen the headlines and statistics, and threats continue to escalate as cybercriminals employ tricker tactics to breakthrough company defenses.
By James Forbes-May, Vice President, Asia-Pacific, Barracuda
In the past year alone, we’ve witnessed a number of worrying trends threatening businesses in the region, including a huge 64% uptick in the number of ransomware attacks; with 81% of organizations in APAC, Europe, the Middle East, and Africa (EMEA), and the United States (U.S.) reporting having suffered at least one security breach in the last 12 months. Our research also shows that the average organization is targeted by over 700 social engineering attacks each year- and it’s not just CEOs or personnel in financial roles who are being targeted. In fact, 77% of Business Email Compromise (BEC) attacks are targeting lower-level staff across a variety of roles, and why? Because cybercriminals know that even with the strongest security strategy and safeguards in place, the weakest link is usually the human link.
This situation has been exacerbated by the COVID-19 pandemic, which has made remote working the norm for most employees across APAC, seeing IT teams scrambling to roll out solutions to allow employees to access company data and systems from home, balancing usability with risk. Ultimately, however, the risk is increased, as thanks to increased work pressures, stress, isolation, and reliance on home computer systems and networks, employees are more likely to make mistakes and new vulnerabilities arise – potentially opening the door to attackers.
This month is National Cybersecurity Awareness Month (NCSAM), a United States led initiative with global relevance. This year’s theme is “Do Your Part. #BeCyberSmart,” underlining the need for all employees to do what they can in the fight against cybercrime.
To help you and your employees play their part, we have put together some key pointers to ensure your team has the best possible chance of success when it comes to playing an active role in defending your business from cybercrime.
- It all starts with training
Your people are your first line of defense against attack, so in these increasingly challenging times, email threat simulation and training are an important first step in turning employees into one of your most effective security assets.
In today’s complicated threat landscape, every employee must be responsible for email security. Just one mistake by one employee, clicking on one link in one email, could result in fraud, a data breach, huge costs, and damage to your company’s reputation.
User security awareness training helps every employee in your organization to recognize, avoid, and report potential threats that can compromise critical data and systems, including phishing, malware, ransomware, and spyware. As part of the training, mock phishing and other attack simulations can be used to test and reinforce good behavior, encouraging a culture of cyber awareness and security best practices across your organization. And while we would always recommend frequent training, we know that this is not possible for every organization. The good news is that even a little goes a long way. We discovered that after just two security awareness training campaigns, the accuracy of user-reported emails increased by 74%. That means users were more likely to spot an actual or simulated email threat, at a much higher rate than prior to completing any training activities, making even the most basic training a valuable step towards securing your business against attack.
- Securing your remote workforce
Remote working has created numerous new challenges for businesses across APAC. Ultimately, functionality needs to go hand in hand with security – which has seen many companies struggle to secure the endpoint with a growing range of work and home systems to support. Meanwhile, cyberattacks continue to intensify, being predicted to inflict $6 trillion in damages globally this year.
Establishing strong security policies for employees to follow when working from home is therefore essential. This can include making sure that employees are regularly updating desktop security such as anti-malware, antivirus, and personal firewalls, whilst also making sure they secure network appliances and smart devices. IoT botnet attacks have risen approximately 500% over the past couple of years. These botnets harness millions of routers, and other vulnerable devices which can be used in DDoS, remote command execution, and other attacks. To minimize this risk, employees need to make sure they are using strong passwords for all devices and applications, while also making sure to regularly update device software to protect against new exploits. Likewise, it’s important to ensure that employees are installing and maintaining solutions to protect them from malicious email attacks. Many email systems have some built-in protection, but the best defense is always going to be a security-conscious email user. Making sure they know your policies around reporting threats, can go a long way in keeping your business safe from attack.
- Don’t underestimate the power of backup & data protection
As one of your most valuable assets, it’s never been more important to protect your data, so making sure employees are regularly backing up data stored on their desktop, home network devices, or in a cloud application like OneDrive, should be your top priority. After all, it’s a key safety net, which if done correctly, should ensure they don’t lose access to any important data, no matter what happens. Beyond straightforward backup, data protection now includes archiving, off-site replication, encryption, and more, which can all play their part in saving valuable data in the event of hardware failure, human error, natural disaster or in the event of a breach. These days, utilizing the cloud offers a convenient way to help you do this, especially when following the best practice 3-2-1 backup rule: that is, backing up at least three copies, in two different formats, with one copy stored offline. Malware including ransomware often targets backup servers and can spread across logical domains, meaning that it’s vital that organizations have a safe “air-gapped” copy of their data off-site for disaster recovery purposes. This is where the cloud comes in handy, making this process child’s play and the easiest possible way to stay backed-up and protected against all odds.
- Taking a Zero Trust approach
While personal accountability and awareness play a significant role in the fight against cybercrime, making sure you are providing your team with the backup firepower they need to win in the fight is an absolute must. This means having a watertight cybersecurity strategy in place with a suite of tools to deliver secure end-to-end access, addressing application, cloud, and network security concerns, whilst protecting data and email. The requirements list is long but should start with a Virtual Private Network (VPN) that funnels traffic through a firewall, VPN concentrator, or remote desktop, which forms the starting point for building a robust Zero Trust roadmap, which is the cornerstone of securing your work-from-home team.
While traditional networks were usually based on a “trust but verify” security model, with the implicit trust of everything within, a Zero Trust model creates an environment of “never trust, always verify”, which in this increasingly complex threat landscape could be your saving grace. In the words of Institute of Electrical and Electronics Engineers (IEEE) Senior member Jack Burbank: “Zero trust is not a single product, nor is it a single approach or technique. It is a mindset, a decision. It is an organization saying, ‘Network security is a priority and then putting resources behind that statement.”
About the Author
James Forbes-May is the Vice President for the Asia Pacific region at Barracuda Networks, where he is responsible for the company’s growth and expansion in the core markets such as Japan, China, ANZ, India, and Southeast Asia. James joined Barracuda in 2015 and since then has been pivotal in developing the region.
James has over 30 years of experience in the software industry, where has a track record of building the Asia Pacific region and leading teams, He also has over 15 years of experience in the software storage sector.
James is based out of Barracuda’s APAC headquarters in Hong Kong. Previously: Arcserve, CA, Vision Solutions, Yosemite Software and Seagate Software.
DISCLAIMER
Views expressed in this article are personal. The facts, opinions, and language in the article do not necessarily reflect the views of CISO MAG.
See also: Cybersecurity Awareness Month 2021: Here’s What the Experts Have to Say
