cybersecurity debt

(Source – Shutterstock)

Organizations face cybersecurity debt for not prioritizing cybersecurity

When organizations accelerate their digital transformation due to the pandemic two years ago, many did not prioritize cybersecurity. In fact, organizations were focused mostly on ensuring business continuity and avoiding any disruptions to productivity.

As the pandemic continued, investments in tech became long-term, with the focus on providing seamless and agile working operations. Companies adopted newer technologies to remain relevant. However, there was one problem, cybersecurity remained an afterthought.

True enough, the last two years have seen a huge increase in cyberattacks targeting organizations without proper cybersecurity protection. Most of the cyberattacks targeted remote working employees, who were working using unsecured devices and networks.

Supporting this is a global report released by CyberArk that showed cybersecurity taking a back seat in the last year in favor of accelerating other business initiatives. In Singapore, a whopping 82% of senior security professionals have even agreed to this.

The CyberArk 2022 Identity Security Threat Landscape Report identified how the rise of human and machine identities, often running into the hundreds of thousands per organization, has driven a buildup of identity-related cybersecurity “debt”, exposing organizations to greater cybersecurity risk.

The report which represented the findings of 1,750 IT security decision-makers, highlighted their experiences over the past year in supporting their organizations’ expanding digital initiatives. Respondents were based in the US, UK, France, Germany, Japan, Italy, Spain, Brazil, Mexico, Israel, Singapore, and Australia.

According to the report, secular trends of digital transformation, cloud migration, and attacker innovation are expanding the attack surface. The report delves into the prevalence and type of cyber threats facing security teams and areas where they see elevated risk.

Interestingly, credential access was the number one area of risk for respondents (at 43%), followed by defense evasion (41%), persistence (33%), privilege escalation (32%), and execution (31%). Almost 80% of local organizations surveyed have also experienced ransomware attacks in the past year, two each on average.

78% of local respondents indicated that their organization is susceptible to carefully crafted attacks such as a tailored phishing email to an individual with high levels of access while 69% have done nothing to secure their software supply chain post the SolarWinds attack and most (70%) admit a compromise of a software supplier would mean an attack on their organization could not be stopped.

The cybersecurity debt

For Teck Wee Lim, Head of ASEAN at CyberArk, even as warnings of cyber threats such as ransomware and supply chain perpetuate the news, the research has shown that cybersecurity is not a top focus for many organizations.

“As Singapore eases its Covid-19 restrictions and resumes more economic and social activities, organizations here need to further enhance their cyber resiliency by adopting proactive cybersecurity strategies such as Identity Security controls based on Zero Trust principles to ensure that both human and machine identities are protected,” commented Lim.

Given the increased use of technology, a poor cybersecurity framework could lead to increased risks for the organization. Security professionals agree that recent organization-wide digital initiatives have come at a price. This price is Cybersecurity Debt, whereby security programs and tools have grown but not kept pace with what organizations have put in place to drive operations and support growth. This debt has arisen through not properly managing and securing access to sensitive data and assets, and a lack of Identity Security controls is driving up risk and creating consequences.

“The past few years have seen spending on digital transformation projects skyrocket to meet the demands of changed customer and workforce requirements.  The combination of an expanding attack surface, rising numbers of identities, and behind-the-curve investment in cybersecurity – what we call Cybersecurity Debt – is exposing organizations to even greater risk, which is already elevated by ransomware threats and vulnerabilities across the software supply chain. This threat environment requires a security-first approach to protecting identities, one capable of outpacing attacker innovation,” explained Udi Mokady, founder, chairman, and CEO, CyberArk.

The debt is compounded by the recent rise in geopolitical tensions, which have already had a direct impact on critical infrastructure, highlighting the need for heightened awareness of the physical consequences of cyberattacks. This is why 82% agree that their organization prioritized maintaining business operations over ensuring robust cyber security in the last 12 months.

As such, to deal with this, businesses need to push for more transparency. Organizations should also introduce strategies to manage sensitive access, especially for their remote and hybrid workers. This includes prioritizing identity security controls to enforce zero trust principles. With zero trust, businesses can have the added visibility needed in securing their organization, especially in workload security, identity security tools, and data security.