printer friendly version

Cybersecurity in 2020: lessons for tomorrow

The rollercoaster that was 2020 didn’t leave us entirely bruised and battered. As you’ve undoubtedly heard several times by now, it’s been quite a boost for technology adoption. Less mentioned, though, is that the year also brought a renewed emphasis and appreciation for cybersecurity. I think that is what we’ll remember most about 2020’s technology ripples.

There is a visible jump in awareness around online security, precisely because of remote working. People are using their personal devices to access corporate networks. This situation was once called BYOD (bring your own device), a trend that flatlined due to security issues. But as COVID-19 responses demanded change, user devices entered the fray again and criminals pounced.

We know this because the bad guys didn’t bring anything new to the table. They instead amplified known attacks and weapons: familiar tactics such as phishing and known types of ransomware were very effective. No matter what research you look at, such attacks rose by double and triple digits. To add salt to the wounds, they exploited our distress and panic around the pandemic. For example, some employees were duped by fake emails offering information around inter-company COVID-19 tests. One click and their systems were infected.

As I mentioned, none of these tactics is particularly new or innovative. Instead, they show how far we’ve still got to travel to secure our businesses. But to my earlier point, people are now much more aware. With that in mind, here are a few points from 2020 that we can apply in the coming year.

User awareness is key: You can have the best security in the world, but one wrong click can undo it all. Countermeasures are more sophisticated, but we cannot ever try to leave people out of the equation. Even some basic behavioural testing and collaborative instruction – not shaming failure – should be regular occurrences at companies.

Decentralisation is here to stay: Security parameters have been fading away as offices become more decentralised. This trend reached a new peak with remote working during the pandemic. Security is no longer a boundary – and will never be again – especially as we adopt the cloud. Thus, all security strategies must embody decentralisation.

Know your cloud security responsibilities: Companies now realise that cloud security is not something they can leave with the cloud provider. Even though those providers use scale and deep levels of experience to create very secure environments, they can only cover so much. The data and applications put on top – not to mention user behaviours – are the customer’s problem.

The board and exco must be on board: Cybercrime is a significant and growing risk. Boards and leadership groups are more involved with this reality, a trend that’s been growing for a few years. But 2020 made that message clear: don’t delegate your security concerns to the IT guys. Learn, strategise and audit as you would any core part of your business.

Time of a security fabric: Cybercrime is clandestine by nature and you often need more than one indicator that something is afoot. You also need to respond quickly. This has brought about the security fabric concept: using several security technologies that work in concert to detect and stop intrusions, often incorporating artificial intelligence and automation. It is this integration, often linked to behavioural detection, that stays ahead of cybercriminals.

Security playbooks are in: Let’s say a phishing email duped someone, but the security system catches that mistake and remedies it. Then it applies its findings to a playbook, which other systems reference. So, very quickly, a phishing attack is identified and informed across the estate, so all email accounts start blocking that approach. These playbooks will become a very effective way to build security resilience.

MSSPs are the new frontline: Security is expensive, resource demanding and elaborate. This applies to IT systems, which is why managed services have become a popular choice. Such services focus on maintaining core systems within an organisation, similar to outsourcing, but much more in-depth and embedded with a business’ vital components. Managed security is the same concept, delivered by managed security service providers (MSSPs). Companies are contracting MSSPs more and vendors such as Fortinet are developing many new tools and platforms for MSSPs.

There are more such points I can discuss. As 2021 gets under way, there will be more opportunities to chat about cybersecurity. 2020 was a watershed year. We’ve seen just how greedy and persistent online bad guys can be. Attitudes have changed, and security innovation has caught up. If we take some of last year’s lessons to heart, this year will be safer for us and tougher on the criminals.

Share this article:

Further reading: