Cybersecurity needs to escape ‘groundhog day’ says IBM's Global Executive Security Advisor
Singapore: In 1993’s Hollywood movie ‘Groundhog Day’, Bill Murray plays a character who is caught in a time warp, and keeps reliving the same day for thirty years. Citing this example, Diana Kelley, Global Executive Security Advisor, IBM says the industry is also having its own version of Groundhog Day as the cybersecurity professionals keep repeating their mistakes as she highlighted the trends in the industry.
“The reason we make the same mistakes is collective amnesia – we forget and so we keep repeating the same mistakes. Why do we have to reinvent the wheel every time we change the technology? We still need to understand that technology changes, but we cannot forget the lessons of the past, because when we do, we repeat our mistakes,” said Kelley.
Recently, it has been seen that the attackers are getting more sophisticated, and they are sharing data and collaborating with each other on the dark networks, Kelley highlighted. She noted that the cybercriminals are using both new and old techniques, because they do not care about whether it is a new vulnerability or an old one.
“The attacker just cares about one thing - does the technique work?” she added.
One trend that has changed since the last year was that the attackers started branching out attacks, without knowing what they might discover in the data. Kelley explained, “The attackers think that I will grab any data I can and see later if I can monetise it.”
Spam emails are still going strong – there was a 6,000 per cent increase in the ransomware attachments and nearly 40 per cent of all spam emails sent contained ransomware in 2016. “They are getting better and they are following up on social media. They are incredibly engaging, very targeted, and very believable. This is why we need to continue training our users,” Kelley said.
Cyber criminals have made nearly one billion through ransomware in 2016, and Kelley highlighted that ransomware attacks will continue because they work.
Going forward, Kelley said the security professionals need to take lessons from the cybercriminals on collaboration and sharing. “The bad guys are so organised, and we need to make sure we do the same,” she added.
To stop IoT ‘weaponisation’, she suggested building security in by avoiding shared secrets and weak configurations. She gave some essential tips for the industry to combat these issues:
“Nineteen dollars per record is the average cost during a data breach. This happens just because a company does not have an incident response team. You can save a lot of money if you detect an attack,” she concluded.
The writer was hosted by RSA Security in Singapore.
_20240911192319_original_image_15.webp)
