Cyber threats are growing virally, necessitating a new approach in combating them by the corporate world, who even today regard antivirus programs and firewalls as a baseline for their security efforts.
Corporates need to adapt to the changing battlefield, and insulate both their virtual and real world operations from emerging threats on the horizon, which are far more serious than ever.
Fighting Fire with Fire
There is no worse chink in the armor though than complacence. The cyber security domain is no different.
In survey after survey conducted in the US, by organizations ranging from PWC to Frost and Sullivan, IT executives when asked about the adequacy of their cyber security, responded overwhelmingly that they were prepared for the worst.
Yet, empirical data shows that last year alone an alarming 82 percent of 460 companies audited in a study had an externally originating security breach. As Brook Zimmatore, CEO of cyber security firm Massive states, "We have had multiple wake up calls where global firms have been breached and the extent of losses has been the talk of international media." It doesn't stop with individual companies. "Some of these breaches have affected national and global markets", adds Zimmatore, based on his experience of working in the US and UK markets in particular.
The most notable aspect of the evolving cyber threat is that it comes not from individuals or small groups but increasingly from organized crime--the so-called cyber cartels, and from countries in the form of cyber espionage.
This has led to new types of cyber-security firms emerging who offer corporates the tools to defend 24 x7 against the cyber attacks being plotted against them.
Threat Assessment and Prevention
If Zimmatore could wish for one major change in the way corporates approach cyber security today, he would ask them to move away from the traditional reactive approach to threats and instead focus on being proactive and predicting the threat.
He says, "Almost all breaches are calculated workarounds through the location of vulnerabilities and soft spots in the digital infrastructure. By monitoring known cyber criminal locations and chatter we can gather actionable attack intelligence to be one step ahead of cyber crime."
Other companies echo the same sentiment when talking about their "threat prevention" approach driven by "actionable intelligence". These terms may seem to come right out of a military glossary but cyber warfare is a reality that corporates must now be ready to practise apart from the marketplace battles that currently have their mindshare.
Red Alert
When it comes to cyber espionage, especially those practised by foreign governments or their sponsored proxies, we are treading in even more dangerous waters. Political sensitivities, trade ties, and strategic interests all enter the big picture.
Cyber security firm, Mandiant, acquired recently by FireEye, documented that 141 US firms ranging from aerospace majors to energy companies had been targeted by China's cyber espionage infrastructure since 2006.
In the cyber security world such advanced attacks are referred to as Advanced Persistent Threats (APT). They are characterized by highly sophisticated attacks, sustained over time--somewhat obvious given the high value targets they are after.
Other analysts estimate that the cost of such cyber espionage costs the US economy anywhere from $25 to $100 billion annually.
There are repercussions for the accused country as well. Huawei had a much publicized pullout from the US market amidst unproven allegations from US lawmakers that it had colluded with Chinese state agencies in conducting cyber espionage on American soil.
Even tech-savvy companies, who at least in theory should be better prepared, find themselves on the wrong end of cyber espionage attacks--in the widely chronicled Operation Aurora APT, Google became a victim of an attack spread through the exploitation of a zero-day vulnerability in Microsoft's Internet Explorer.
With corporate and government interests intersecting on the issue of cyber espionage, the White House has enlisted the Department of Commerce to work with the defense and intelligence communities to lay down a roadmap to prevent the loss of the country's trade secrets. China and Russia feature as prominent practitioners of cyber espionage in the report.
Since corporates cannot firewall themselves from two of the largest emerging markets, cyber security firms are going to be working overtime to ensure that there's no funny business.