This is an ongoing series of guest blogs written by TAG Cyber analysts in conjunction with various members of our SPHERE team. Offering insights from the perspective of the professional industry analysts combined with a technology company focused on the goal of establishing cyber hygiene. This article comes from a fearless leader, CEO & Founder of TAG Cyber, Edward Amoroso.
For many types of criminal activity targeting businesses, the frequency of incidents improves over time. Consider, as a typical example, the number of bank robberies that occur annually in the United States. The FBI reports that in 2003, there was a total of 7465 total robberies, but that by 2020, this number had dropped to 1788. Businesses benefit when such improvements occur – and it helps to drive confidence and investment in the sector. In contrast, look at similar number for cases of cyber crimes committed against Americans. The FBI reports here that in 2020 there were almost eight hundred thousand cases of cybercrimes resulting in massive losses to Americans. Just four years earlier in 2016, the number of reported cybercrimes was just under three hundred thousand, which is less than half the 2020 number.
This type of undesirable trending for cybercrime deserves the full attention of business and government leaders in the United States – and also abroad, where the statistics are comparable. According to one report, nearly two-thirds of Canadian companies in 2020 were subjected to phishing attacks, which is particularly troublesome since this is generally the first step in advanced cyber break-ins.
The reaction across the cyber security industry to these trends has been varied. On the one hand, many companies report a shift-right, where they essentially accept that a breach will inevitably occur. Vendors selling into this truly reasonable and realistic mindset often designate their products by the post-pended acronym DR, which stands for detection and response.
While this is an appropriate response to the trends, perhaps a more hopeful solution focuses on the prevention of these incidents from occurring in the first place. This approach, usually referenced as a shift-left in focus, typically requires attention to many of the foundational aspects of how an enterprise IT infrastructure has been set-up. Shift-left solutions often include much commonsense design. Cybersecurity company, SPHERE, for example, focuses its attention on cleaning up the IT permissions, entitlements, and related foundational aspects of data security. The company offers a variety of tools that help both IT and security managers avoid sloppiness in account management and other commonly targeted aspects of an enterprise system.
This approach appears to our TAG Cyber team to have the best prospects to help reverse the trends in cyber incidents referenced above. Detecting and responding to attacks is required, but prevention is the only reasonable approach to reversing the trend by making it much harder for criminals and adversaries to succeed in their offensive threat operations.
Certainly, a balance of solutions is always best, but if your own team has yet to take the time to review posture and invest the time to straighten out, clean up, and fix weaknesses in the IT configurations and settings, then it might be a good time to start now. And based on our analysis, we view SPHERE as an excellent partner option.
