How to Improve your Cybersecurity in 5 Steps
A recent Microsoft study indicates that APAC experiences a higher-than-average encounter rate for malware and ransomware attacks – 1.6 and 1.7 times higher respectively than the rest of the world. Regional financial hubs Singapore and Hong Kong recorded the highest drive-by download attack volume in 2019, over 3 times the regional and global average.
The Cyber Security Agency of Singapore (CSA) notes in its 2020 Singapore Cyber Landscape (SCL) that attacks involving ransomware, malicious command and control (C&C) servers and botnet drones have increased drastically, and phishing, website defacements and cybercrime continue to plague the region. The ransomware threat is growing into a systemic problem, with threat actors exploiting loopholes in business processes and interdependencies.
Ransomware attacks will continue to evolve, remote workers will be targeted, and supply chains will be disrupted. Small and medium businesses (SMBs) are not exempt. If there was ever a good time to step up your cybersecurity game, it is now.
Here are 5 steps that you can take to secure and protect your business:
1. Protect your data.
Data collection and analysis used to give companies a competitive advantage, but now it is simply what we do. Today’s data-driven strategies require your applications to integrate with countless 3rd parties to give your customers the best experience. You can monitor activity day and night but staying on top of every single data connection is undoubtedly challenging. This is only compounded when those parties lack strong policies or processes that prevent the data being sold to bad actors.
Where data privacy and security traditionally held separate scopes in roles and responsibilities, now must work hand in hand.
A good first step in your cybersecurity recon is a data privacy gap analysis. Consult a cybersecurity expert to assess how data travels into, through and out of your organization. A gap analysis will help you determine security risks, map out compliance with local and international regulations (for example, GDPR) and recommend practical steps to implement stronger data privacy.
Singapore takes data protection seriously. The Singapore Personal Data Protection Act (PDPA), passed in 2012, is the baseline of protection for personal data in Singapore. It governs the collection, use, disclosure and care of personal data belonging to Singaporean citizens, whether the businesses using the data are located in Singapore or not. Businesses that do not comply can be fined up to S$1 million or 10% of their annual revenue.
2. Manage your endpoints.
While the whole world embraces distributed resourcing models and remote infrastructure, it’s left to your team to count the number of endpoints the new normal brings for you to oversee.
Any device that connects to your corporate network from the outside world is an endpoint. So, computers, phones, printers, routers, servers – and now IoT devices, are all endpoints that malicious users can use to infiltrate your network. Endpoint protection is the first line of defence in cybersecurity.
Bolster your systems with automation and managed services. Monitor all your endpoints in one interface, so that you can manage prevention, detection and response. Security patches and updates should be automated.
3. Shore up your firewalls.
Hyperconnected markets operating in multi-cloud and hybrid cloud environments have given rise to a proliferation of firewall solutions. Another component in the first line of defense, firewalls must be continually managed, updated and monitored.
Microsoft stated in their 2021 Digital Defense Report that their web application firewalls trigger upwards of 25 billion rules per week. Almost 5% of incoming traffic is deemed malicious.
Having to adapt to new firewall configurations to manage omnidirectional traffic is inevitable, but upskilling specialists to manage firewalls from different vendors and constantly update infrastructure takes time. The more time and effort you spend to chase after the latest firewall technologies, the more you risk exposure to security threats.
4. Conduct regular security testing.
CSA reported a 154% rise in ransomware attacks in 2020. The cases affected mostly SMBs, and ransomware operators deployed increasingly sophisticated tactics such
- - Shifting from indiscriminate, opportunistic attacks to more targeted “Big Game Hunting (BGH)”
- - “Leak and shame” tactics
- - “Ransomware-as-a-Service” (RaaS) models
Threat actors are no longer targeting just large corporates – they know that SMBs have more reputation to lose and less muscle to negotiate with. Business travel is opening up, and executives are trying to catch up to business goals that have long been on hold. Their activities across endpoints and networks beyond your scope of control gives potential attackers a larger surface area to play with.
5. Incorporate vulnerability management into IT strategy.
Digital transformation has had a watershed moment this past year and is now a priority agenda. Activities that used to require thorough, well-substantiated business cases are now at the forefront of execution. Racing through digital transformation engagements is likely to open up new vulnerabilities.
Unless risk management and security testing are integrated into transformation-related activities on an ongoing basis, digitalisation will only bring with it a counterintuitive burden of potential damage.
Using vulnerability management services will help you go beyond the scope of seasonal testing – you benefit from security experts who can give you contextualized, intelligence-backed analysis. Set up a long-term risk-based vulnerability management programme with a tailored approach to vulnerability prioritisation and remediation optimization. Map your security measures to your current business goals while also setting your organisation up for the future.
In their 2021 Insight Report for Principles for Board Governance of Cyber Risk, the World Economic Forum states that cybersecurity is not just an IT issue – it is a strategic business enabler. There is a clear need to go beyond reacting to market developments and adopt a cybersecurity factor at all levels from the top down – including ensuring organizational design supports cybersecurity and incorporating cybersecurity expertise in board governance. Every major digital transformation initiative needs to be viewed through the lens of cyber risk. Cyberthreats are persistent, strategic enterprise risks for all organizations, and navigating this risk requires a culture of cybersecurity and modelling of good cybersecurity decision-making.
Our increasingly digitalised world is the cybercriminal’s oyster. With business models evolving, and more partners and touchpoints being introduced in any given ecosystem, business as well as IT leaders need to reinforce cybersecurity collaboration across all roles. Legacy security infrastructure was not designed for the digital acceleration and cyber risks of today. We must know the cybersecurity landscape, shrink the cybersecurity knowledge gap, preempt threats and manage vulnerabilities as we continue to adopt modern technologies and practices.
The MyRepublic and Inspira partnership solidifies our commitment to a shared goal: delivering the most sophisticated cybersecurity solutions, consulting, and managed services in Singapore. Learn more about MyRepublic’s cybersecurity solutions and services and book your free assessment today.
