Answers to Your Most Pressing Cybersecurity Issues

In today’s connected world, security breaches are inevitable. Especially for organizations that handle sensitive data like PII, it’s vital to be prepared. Looking at your business with a hacker mentality and putting a cybersecurity strategy in place are your best ways to ensure that when your day comes, you can bounce back without any major interruptions to your business or harm to your brand and reputation. 

Our HORNE Banking (HB) team sat down with Mike Skinner (MS), Partner in Charge for HORNE Cyber, to discuss what this team of specialists is seeing in the marketplace and to learn how they help clients strengthen their cyber resilience.

HB:     What issues are HORNE Cyber clients experiencing?

MS:      We’re seeing two main issues: growing risk and IT security talent shortage. Our clients are experiencing extreme pressure and uncertainty from the growing number of cyber attacks. Each new technology we adopt increases our attack surface and risk universe. We are meeting those challenges by continuing to increase reliance on emerging technologies.

There is a growing shortage of security talent. It’s hard for organizations to find candidates with the skills necessary to fight modern cybercrime, and to analyze and comply with mounting regulatory requirements. Many of these companies are opting to outsource CISO roles and cybersecurity activities to experts completely focused on cyber risk.

HB:     What industries are experiencing particular challenges or changes to their cyber risk landscape?

MS:      With the growth in the number of connected devices, increased mobility, and the Internet of Things (IoT), all industries are experiencing change as their attack surface grows. No organization is immune to cyber risk.

However, we have seen a concerning trend in heavily regulated organizations. Regulatory mandates are enacted to protect organizations’ customers. In the financial services sector, for example, we have seen a laser focus on securing the systems that contain the organization’s customer data, while leaving other critical IT assets (often IoT devices) unsecured. Unfortunately, it’s often the IoT devices that an attacker will use to gain undetected access to sensitive data or to cripple the operations of the organization. 

HB:     What are the top three questions you answer for clients?

MS:      How do I motivate my employees to be more cautious and aware of their role in cybersecurity? How do I adequately secure my network from evolving threats like ransomware? And should I get cyber insurance – if so, how much coverage do I need?

HB:     What are the top three cybersecurity trends you are seeing in 2016?

MS:      The main cybersecurity trends we’ve addressed this year so far are:

1. The cybersecurity skills crisis, which has led organizations to outsource CISO roles.
2. The weakest link in cybersecurity continues to be humans. Humans leave IT assets in an insecure state. Social engineering guarantees hackers can access even the most secure networks. Someone will always click.
3. Reliance on automation and the increased adoption of IoT devices have introduced significant cyber risk to organizations that may not be prepared.

HB:     How will the trends change as we look toward 2017?

MS:      First, it’s important to note that these trends will continue into 2017. The ransomware epidemic will continue to impact the availability of organizations’ data. In the first half of 2016, ransomware evolved from encrypting a targeted user’s hard drive to encrypting their hard drive as well as any mapped or shared network drives. We are starting to see new attacks where hackers breach a network, actually exfiltrating data, then demand the target organization to pay a ransom in lieu of the attacker releasing the breached data on the Internet or dark web. This type of ransom attack is troubling because there is no way to guarantee that the breached data wouldn’t be (or hasn’t been), released on the dark web—even if the breached organization pays the ransom.

Another evolving 2017 trend we’re starting to see is the impact of previous breaches on organizations’ cybersecurity. Recently announced breaches such as the Yahoo! and LinkedIn hacks are proving that password security still needs improvement. The breached user credentials that are released after these incidents are a jackpot for hackers because many users re-use passwords between their corporate domains and other websites.

This is a great example of how HORNE Cyber takes a ‘hacker mentality’ to protect our clients—more often than not, we are able to access our clients’ networks with the user names and passwords that are posted on hacker sites as a result of headline breaches.

HB:     What lessons can banks learn from current cyber activity?

MS:      I think there are four main points that banks should keep at the forefront of their planning, based on what we have and are currently seeing.

1. First, and most importantly—more than 75% of organizations already have experienced a breach in the past 12 months. You must acknowledge that your organization will be breached. Focus your efforts on minimizing the impact of the unauthorized access.
2. A layered defense strategy is critical to ensuring cyber resilience.
3. At the end of the day, the C-suite has to answer when a breach occurs. Cyber resilience has to be a priority in your organization. Build it into all aspects from product development to employee training.
4. It can take months, weeks, and even years to identify an attack. The longer it takes to identify, the more damaging it can be to your organization. Organizations must develop, implement, and test cyber focused incident response plans.

HB:     What’s the most important thing financial institutions should do now to mitigate emerging cybersecurity challenges?

MS:      Approach cybersecurity with a hacker’s mindset. Perform penetration testing that emulates the advanced persistent threats that are utilized by modern attackers. Automated vulnerability assessments and surface-level penetration testing are no longer effective in securing today’s organizations.

HORNE Cyber knows that the best way to prepare and strengthen your cyber resilience is through value-driven risk management and offense-oriented cybersecurity assessments. Don’t wait for a breach. Contact our team today to learn how you can build resilience for your organization. 

Join the conversation and receive updates of new posts: