The International Computer Security Day is a great reminder for IT pros to review company security levels. We've asked information security expert Dejan Kosutic to which 'bumps on the road' you need to pay attention to.
Dejan Kosutic is an experienced consultant in the fields of information security and business continuity. He's currently main ISO 27001 standardization expert at Advisera Expert Solutions Ltd, a company specialized in publishing websites for compliance, security and IT professionals, and author of the ISO 27001 & ISO 22301 Blog.
With yesterday's Computer Security Day in mind, we asked Mr. Kosutic to provide us with some insights on information security and to advise our readers on how to battle the cyber-threats in the future.
GFI TechTalk: Looking at the constantly growing levels of evolving cyber threats, such as ransomware infections or massive DDoS attacks using IoT devices, which ones would you highlight as the most powerful and most frightening?
Dejan Kosutic: For me, the worst attacks are those that are very difficult to detect, and even more difficult to stop – those are the insider attacks. Such attacks are still creating the greatest damage, and most of such attacks are not reported.
In the 2016 Cyber Security Intelligence Index, IBM found that 60% of all attacks were carried out by people on the inside, where three-quarters involved malicious intent. Strict internal procedures, along with tight security policies, can partially address this issue, but the largest threat definitely lays in people trying to damage your company from the inside.
GFI TechTalk: With further technology adoption in all segments of our lives, do you think that individuals and companies would be able to mitigate threats coming from cyber criminals, and what assets and knowledge they need to successfully battle against these modern menaces?
Dejan Kosutic: Yes, I think that eventually we will be able to fight successfully against cybercrime; however, we are still very far away from this goal – it will take us perhaps 10 or 20 years to reach that stage.
To achieve that we will need a couple of things: (1) to change the architecture of Internet and other technologies that are enabling such threats to materialize, (2) to evolve existing technologies that are used to fight against cybercrime – in the future those technologies might include also some artificial intelligence elements; (3) to integrate better the information security concept into business processes of organizations, and finally (4) to share cybersecurity / information security knowledge between organizations and government agencies worldwide.
GFI TechTalk: Business and IT are relying more and more on cloud-based infrastructure and allowing employees to bring their own devices into the company infrastructure. What do you see as the most effective way to battle the dangers of 'shadow IT'?
Dejan Kosutic: Regarding BYOD, every organization needs to have a clear policy on what it allows and what it doesn't allow, and to have software tools to enforce such policy. For using cloud infrastructure, the problem is more complex – every company should assess which risks exist when using the cloud, decide which cloud providers are acceptable in terms of risk, and then work only with those providers, who can offer very strict SLAs and security agreements.
GFI TechTalk: Most of the modern cyber threats come through email, and it seems like we'll never be able to get rid of spam and viruses coming as attachments. Do you see a way out of this, and what needs to be done in order to reduce these email-borne threats?
Dejan Kosutic: I think that the solution is probably in evolved tools that we will use in the future for protection against malware, combined with regulations that will enforce better security control with providers that are sending email messages and/or transmitting those messages.
GFI TechTalk: According to research done by US National Cyber Security Alliance, one in five small businesses falls victim to cyber-attacks each year, and 60 percent of them are out of business within six months after the attack. What would you suggest to business owners in order to successfully protect from this huge danger to their business?
Dejan Kosutic: Business owners should change their way of thinking – "this is never going to happen to me" is not a very wise approach. The same way as most business owners are already paying insurance premiums for e.g. house or a car, very similarly cyber security needs to be considered as a normal business expense. Only this time, such small investment can save their whole business.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
