The True Cost of Cutting (Cybersecurity) Cost
8 minute read
If you are an extreme perfectionist who cannot tolerate even the slightest speck of dust on your computer monitor or can spot the difference between single and double spacing between words, you surely remember the first time you held Apple's 2012 3rd-Generation iPad with its revolutionary Retina Display!
Suddenly, everything seems clearer, more vivid, and vibrant. Best of all, you didn’t feel an ounce of guilt for spending extra because the superior experience in sight, sound, and performance was incomparable to cheaper tablets. (You’ll understand this when you’ve experienced both Apple and non-Apple tablets side by side.)
Next, let’s talk about headsets. Have you ever hastily bought unbranded earphones from a budget store because you forgot yours at home? If you have had a long conference call on these earphones, it's like listening to someone talking through a tin can connected to a string. It's as if the earphone makers were inspired by the scratchy, barely audible sounds of a walkie-talkie with a dying battery. At the end of the day, all you want is to get home to your QuietComfort Bose Earbuds to restore your sanity - the performance difference is like night and day. And yes, you would have happily paid literally 100x times more for those Bose Earbuds.
"What Are You Trying To Get At?"
Now, we hope that you have grasped the essence of the comparison we are making here, i.e., when we don't make the mistake of choosing cheap alternatives in our personal lives, why should businesses do the same when it comes to cybersecurity solutions?
While this may make us sound like a naggy granny, cybersecurity is no longer a "good to have" item like the Herman Miller chair in your company but a NECESSITY for business continuity.
Cymulate's "2022 State of Cybersecurity Effectiveness" report, released on March 28, 2023, revealed data from 1 million pen-tests showing a dramatic increase in data-exfiltration risk for companies. The risk score surged from an average of 30 in the previous year to an alarming 44 out of 100 in 2022 (with 100 representing the most perilous posture).
Post-Pandemic Penny-Pinching
Worryingly, some companies are tempted to skimp on security to save a few bucks. Big mistake! In this article, we'll expose the dangers of el-cheapo cybersecurity measures and explain why investing in top-notch protection is the smartest move for your business's long-term success.
While it's understandable that as a C-Level Executive, you are always looking for ways to cut costs, especially so during this current financial challenge, cybersecurity is not an area where compromises should be made. We are not saying that you should spend millions of dollars on security solutions, but it's essential to find a reputable and reliable option that provides an adequate and comfortable level of protection.
Quality-Cost Tango: A Crucial Decision for Executives
You should know that You Get What You Pay For when it comes to cybersecurity. Cheap solutions may seem like a good deal, but there's always a reason why they are el-cheapo. More often than not, it is almost guaranteed that bargain-priced alternatives typically lack the multifaceted and robust advanced features that are extremely essential for comprehensive cybersecurity defense.
Cheaping out on security is a risky game - you might as well be bringing a knife to a gunfight. Given the prevalence of data breaches in today’s digital world, skipping adequate cybersecurity measures is simply not worth the risk. The consequences of a breach can range from the catastrophic - think important data or customer information being wiped out - to the embarrassing - think PR nightmares and public scrutiny. At the end of the day, don't skimp on cybersecurity solutions. It's the only way to ensure your sensitive data is truly safe and secure.
There must be a reason why reputable analyst firms like Gartner and Forrester often champion paid solutions over free ones. If all cybersecurity solutions were cut from the same cloth, these analysts would simply recommend choosing the cheapest option available. However, their research and ratings highlight the importance of investing in reliable, comprehensive solutions that provide the protection businesses need.
To be clear, we are not discouraging the use of open-source technology, which is often perceived as free and cost-effective. Open-source technology can be a viable option if your organization has the internal expertise and resources to build and manage such solutions effectively.
Your Takeaways For Today
Cyber-Safe or Cyber Sorry: Non-Negotiable Aspects of Cybersecurity
If cost is one of the major showstoppers and you are not sure which part of your company you should and must start protecting, here are certain aspects that should never be compromised.
Emails
WHY: Email is one of the most common vectors for cyberattacks. Some of the most common hacks are Business Email Compromise (BEC) and Email Account Compromise (EAC). In the former (BEC), attackers usually use identity deception (e.g., lookalike email domains) to trick victims into making payments to fraudulent accounts. The latter (EAC) is where attackers carry out social engineering via password spray, phishing, malware, etc., to compromise victims' email accounts. In our experience, we have seen countless BEC and EAC incidents involving almost every level within the company, from CEO to CISO, CFO, and accounts clerks.
WHAT SHOULD YOU DO: Deploy an AI-powered Enterprise Email Protection Solution. Many of these solutions prevent malicious attacks from reaching your inbox and include crucial features like malware protection, data leak prevention, and phishing detection. Look for tools compatible with your platforms, whether O365, Google Workspace, or others like Slack, Dropbox, and OneDrive.
EndPoints
WHY: Are you still using traditional endpoint protection systems (AntiVirus) that rely on signature-based detection? If so, then it's time to upgrade because you're sitting on a time ticking bomb waiting to explode into a data breach any day. Traditional antivirus solutions can only recognize known vulnerabilities, leaving your endpoints open to modern unknown threats. These legacy signature-based AVs cannot detect Zero-day Threats, leaving your endpoints exposed. In addition, modern malware can change its code to avoid signature-based detection. Polymorphic and metamorphic malware use various techniques to evade detection, making them difficult to identify using traditional methods. So if you are using traditional antivirus, then it's like a constant Whack-a-mole or a Tom & Jerry chasing game, and you are bound to lose.
WHAT SHOULD YOU DO: Make sure ALL Endpoints in your organization are protected with signature-less Endpoint Detect & Response (EDR) solutions. These EDR solutions are usually AI (Artificial Intelligence) & ML (Machine Learning) powered - that means its PROTECTION mode is always ON, and no Internet Connection is required for protection. True AI-powered endpoints are signature-less.
Many of these AI-Powered EDR solutions offer comprehensive detection based on the MITRE Framework. The MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) Framework helps people understand how cybercriminals can attack computer systems and networks. It provides a set of "tactics" and "techniques" that these criminals use to get around the defenses that organizations put in place to protect themselves. Many of these modern EDR solutions have employed this framework.
CREDENTIALS
WHY: Ah! The age-old problem of coming up with passwords: it's an issue we all have to face, especially in corporate settings where sharing sensitive information is often necessary. Unfortunately, these details are often shared through unsecured methods like texting - a major security risk! To make things easier, people tend to rely on easily-remembered passwords, such as their or their partner's birthdates, initials, and so on. While it's understandable that nobody wants to forget a password, this complacency also opens the doors to multiple password-related attacks, from brute force and phishing to keylogging and man-in-the-middle attacks. Not to mention, of course, the dreaded dictionary attack. So, if you want to be a responsible guardian of your data, it's best to come up with something a little more secure than your DOB.
WHAT SHOULD YOU DO: Enforce the compulsory usage of Password Managers for each and every employee of your company. Password manager tools typically offer encryption and the ability to control access permissions, ensuring that only authorized individuals can access the shared credentials. These tools usually generate high-strength, complex, random passwords, and with password managers, you never have to remember passwords again. Make sure the password manager you select works on all your devices, from PCs to mobile devices.
Another aspect of credential management that you should consider implementing would be the Credential-less Authentication method. This method requires the user to provide evidence such as a fingerprint, proximity badge, or hardware token code to gain access. This should be used in conjunction with your Multifactor Authentication and Single-Sign-On solutions.
Remember, when it comes to cybersecurity, every product has a price, and the price you pay could mean the difference between safeguarding your business or suffering a devastating breach. The common thread in the above three aspects (Email, Endpoint and Credentials) of your business is the human factor; i.e., every single employee in your company uses it, and to err is human…
About AKATI Sekurity
AKATI Sekurity is a Managed Security Service Provider (MSSP) and consulting firm specializing in cybersecurity and digital forensics. With our extensive experience and capabilities in security consulting, business applications, and training, we are able to customize our services to suit the needs of each client. Basically, we simplify their need for security and efficiency in daily business processes. At AKATI Sekurity, our vision is to be the premier trusted security advisor to organizations across the globe, hence creating value for our customers, shareholders, and communities.
For inquiries: hello@akati.com