Imagine playing a game of Cluedo. Then envisage playing multiple games of Cluedo at once. Then imagine you must step out of the room for half of the game.
In order to win at any of the games and find out who, what and where the crime had been committed, you would need to be in several places at once, with full visibility of the narratives unfolding. Sounds impossible? That’s because it is when you only have one pair of hands, eyes, and ears. It would, however, be possible to triumph if you had a strong team behind you to keep track of the clues and take your turns, each well-versed in how the game works.
The challenges that internal IT teams are currently faced with when attempting to protect their business from multiple cyberthreats aren’t all too dissimilar, so they can’t be blamed when they struggle to keep up.
In a recent study, our security partner Sophos highlighted that 68% of organisations globally were hit with a cyberattack in the last year and, to make it worse, the average number of incidents experienced by those that fell victim was two. Additionally, 10% of organisations actually suffered attacks four or more times. Yet, many businesses are still playing with the same strategy and attempting to stretch their internal IT resources to the limit.
Sophos defines ‘fell victim to a cyberattack’ as a business experiencing a cyberattack that it was unable to prevent from entering its network and/or endpoints, which means the statistics above don’t even include any attempts to infiltrate that were stopped in their tracks.
The study highlighted the key takeaway from these worrying truths, which is that everyone should assume they will be a victim of a cyberattack.
Although, Sophos has also stated it is a good thing to have this pessimistic outlook when planning your security strategy, because being in denial will undoubtedly put you in more danger. Knowing the risks and making plans to address them appropriately is the first step to locking down your business.
However, there could be several factors preventing you from planning and executing an effective security strategy.
The Sophos study asked organisations how long it took to discover the most significant cyberattack in the last year – the average came out at thirteen hours. A few jaws may be dropping at the thought of the damage a cyber-criminal could cause sitting in a system for that long, but since the majority of threats aren’t discovered until they have reached the server, who knows how long the threats had gone unnoticed within IT environments? This suggests a distinct lack of visibility of the full picture, meaning many organisations are making important security decisions based on a partial understanding of their risk.
One of the main reasons for this lack of visibility is that most small and mid-sized organisations don’t have the tools, time and/or expertise required to fully assess and manage their IT environment.
1 in 5 IT managers said they are unaware how their most significant cyberattack got into the system, therefore these entry points are left uncovered and open to attack. It may be the case that larger organisations are more likely to be on top of this than smaller ones due to having more skilled resources and more comprehensive cyber security solutions. However, smaller businesses can now have that same level of expertise and resources by partnering with a dedicated end-to-end expert like TSG.
Furthermore, top-end security software doesn’t carry the same hefty price tag it may have in the past. Robust technologies are now accessible to smaller businesses, who have the ability to layer their security to suit business requirements.
If smaller businesses aren’t investing in prevention and just focusing on the post-attack clean up, then it will ultimately keep happening – much like a real-life attack on a business such as a burglary, where, if you didn’t get stronger locks fitted or a safe installed then the criminals would keep coming back to the easy target that they have identified. Eventually, the business will not be able to keep up and will drown.
Another issue is the way in which organisations are using their valuable resources. On average, businesses lose 41 days each year investigating non-issues – that’s a serious loss of valuable time and productivity! To improve efficiency, businesses need to use their limited resources effectively and in the right places.
Unfortunately, many businesses have learnt the hard way, by becoming aware of their lack of security expertise and of the challenges they face in stopping today’s advanced attacks only after they have fallen victim. 80% of IT managers surveyed say they wish they had a stronger team in place to properly detect, investigate and respond to security incidents, which suggests a significant shortage of cybersecurity skills.
At TSG our experts deal with cybersecurity issues day-in, day-out, and can work with your business to provide a comprehensive managed IT service, supported by our knowledge and extensive Sophos portfolio that will protect it from increasingly potential threats and will also free up your people to add value in the areas where they thrive most.
