The Need for vCISOs By SMBs

The Need for vCISOs By SMBs

Cybervisors to the rescue!

For many businesses today, the severe lack of a skilled Cybersecurity workforce is becoming clearly evident on a daily basis.  Just consider some of these statistics:

  • 45% of organizations report that they do not have an adequate IT security staff in order to ensure 24 × 7 × 365 monitoring;
  • 54% of business entities claim that they do not have an adequate Cybersecurity skill set for their size;
  • 57% of entities, even claim that they do not have enough Cybersecurity workers to fully man their Security Operations Centers (SOCs).

It should be noted that the Cybersecurity workforce shortage is a global trend that is occurring not just here in the United States, but on a global basis as well.  This is illustrated in the diagram below:

Read More

Outsourcing Can Help Bridge the Cyber Security Skills Gap

The cyber security skills gap is real and growing; there simply aren’t enough cyber security employees to go around.

The cyber security skills gap is real and growing; there simply aren’t enough cyber security employees to go around.

Cyber crime is rapidly escalating, and board rooms are taking notice. KPMG’s 2017 U.S. CEO Outlook survey shows cyber security risk to be among CEOs’ top concerns, yet only 40% of them feel that their organizations are fully prepared to handle a cyber attack. This isn’t surprising in light of the very serious – and worsening – cyber security skills gap. The cyber security unemployment rate was zero in 2016, and it’s expected to remain there until 2021. Coincidentally, that’s the same year by which Cybersecurity Ventures predicts there will be 3.5 million unfilled cyber security jobs.

The cyber security skills gap is real and growing; there simply aren’t enough cyber security employees to go around.

Small and medium-sized firms are being hit the hardest by the cyber security skills gap, as the short supply of qualified talent is quickly snapped up by multinational firms that can afford to pay the high salaries and provide the “Cadillac” benefits and perks that this talent has the power to demand. The situation is expected to worsen in light of New York’s new cyber security law, which requires finance and insurance firms operating within the state to hire CISOs and “qualified cyber security personnel.”

Governments and private-sector organizations are wringing their hands over how to deal with the problem. The mayor of New York City has announced a plan to invest $30 million in in cybersecurity training, academic research, and development labs, with the goal of creating 10,000 new cyber security jobs over the next decade. IBM has launched what it’s calling a “new collar” jobs initiative to train both students and older workers in cyber security.

Outsourcing the Best Way to Immediately Bridge the Cyber Security Skills Gap

In light of the cyber security skills gap, the best option for most organizations is to outsource their cyber security functions to a reputable cyber security provider such as Lazarus Alliance. Our Cybervisors® service allows organizations of all sizes to immediately retain the services of the best and brightest subject matter experts in cyberspace law, cyber security, risk assessments and management, audit and compliance, governance and policies, and more.

In addition to getting the help you need right away, there are many other benefits to outsourcing your enterprise’s cyber security functions, including:

  • Significant cost savings. It is almost always less expensive to outsource cyber security than to hire and maintain a security team full-time in-house. Even outsourcing just part of your cyber security functions, such as compliance, could result in significant savings.
  • Allows you to focus on your business’ core competency. Most likely, you don’t hire in-house staff to handle your own legal matters or do your own taxes. You realize that law and accounting are not part of your core competency, so you outsource those functions to attorneys and accountants. (Along the same lines, you probably outsource your building security to a security firm!) Using this logic, why would your firm handle its own cyber security? Outsourcing this function to a professional frees up monetary and human resources that can be used to create, innovate, and drive your business.
  • Allows you to access a level of expertise most companies don’t have internally. Cyber security is a highly specialized field, and the skill set it requires is quite different than those in other IT areas. It’s also highly dynamic, with new technologies and threat vectors emerging daily. Our Cybervisors® focus on only one thing: cyber security. They are highly experienced in this field, they are immersed in it, and they engage in continuous education to stay abreast of the cyber threat landscape.

Initiatives like the ones New York City and IBM have launched are positive steps in the direction of bridging the cyber security skills gap, but training new cyber security professionals takes time, and organizations need help right now. Your organization can’t wait 10 years, or even six months, to get the security help it needs, at a price it can actually afford. The cyber security skills gap is here for the long-haul, and outsourcing is the best way to handle the problem right now.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

2017 Verizon Data Breach Report: Cyberespionage a Growing Threat

The 2017 Verizon Data Breach Report Reveals that Hackers Aren’t Just After Payment Cards and Identities Anymore

Cyberespionage is a growing problem, especially in the manufacturing industry, professional services, education, and the public sector, according to the 2017 Verizon Data Breach Report, which was released last week. While hackers are still after credit card numbers, employee tax data, health records, and other sensitive personal information, they’ve discovered that targeting intellectual property, company secrets, and even state secrets can be quite lucrative.

The 2017 Verizon Data Breach Report Reveals that Hackers Aren’t Just After Payment Cards and Identities Anymore

Almost as if on cue, around the same time the Verizon Data Breach Report was released, online entertainment provider Netflix fell victim to intellectual property theft. A hacker or group identifying itself as “TheDarkOverlord” demanded a ransom and threatened to publicly release episodes of the upcoming season of the Netflix original series Orange Is the New Black, which had been scheduled to be released [to paying subscribers] on June 9. Netflix refused to pay up, and TheDarkOverlord dumped 10 episodes (or at least, what appear to be 10 episodes) online. Because the hacker or group accessed the material by compromising a post-production facility utilized by several major television studios, other networks will likely be targeted in the weeks and months to come; in fact, TheDarkOverlord has already Tweeted as such:

https://twitter.com/tdohack3r/status/858893194297315328

Intellectual Property Especially Vulnerable in the Digital Age

In the digital age, companies are in possession of more intellectual property than ever before. In addition to product prototypes, patents, market research data, and sales lists, many companies develop proprietary software and mobile apps to gain a competitive edge. Casinos, for example, pour millions into the development of gaming software, and as consumers demand to watch television series and movies online, entertainment companies are investing heavily in content-delivery technologies.

The Verizon Data Breach Report notes that 90% of cyberespionage attacks are launched by “state-affiliated groups.” While most people might assume these groups are primarily targeting the public sector in search of state secrets, private-sector companies are not immune from cyber spycraft; cyberespionage is the top cyber threat facing the manufacturing industry, far eclipsing all other forms of hacking, and 90% of the data stolen consists of company secrets.

Why would state actors be interested in hacking a manufacturing company? Private-sector firms have long been targets of spycraft on the part of foreign agents who wish to steal cutting-edge technology for use in their own countries. A recent plotline on the FX spy drama The Americans, which is set during the Cold War, involved Soviet spies infiltrating an agricultural company to steal samples of a new pest-resistant wheat crop for the KGB. The Verizon report implies that not much has changed since the series’ fictional spies’ time, noting that education institutions are increasingly being targeted by state actors and theorizing that this is because “[c]olleges are centers of innovation and are building technologies” that are of great interest to foreign governments.

While intellectual property theft by disgruntled current or former employees or competitors isn’t as common, it’s costly when it happens. It’s estimated that the Houston Astros MLB team lost $1.7 million after an employee of a competing team hacked their database, stealing confidential scouting and trade information. While it’s unknown at this juncture how much Netflix stands to lose from the theft of Orange Is the New Black, industry experts are already wondering if the company will be forced to release the next season early just so they can hope to compete with the “free” version provided by TheDarkOverlord.

How Are Hackers Getting In, and How Can Companies Stop Them?

The Verizon Data Breach Report found that the typical cyberespionage attack starts like most others do: An unsuspecting employee clicks on a malware-infected file attached to a phishing email. Once the malware is installed, a cyber spy can use it to steal legitimate login credentials and get into the organization’s system, where they can remain undetected for days, weeks, even months.

The best defense against phishing emails is to implement proactive cyber security procedures to prevent employees from being phished in the first place. The Verizon report suggests installing anti-malware protection at the email gateway, keeping software and operating systems up to date, implementing network segmentation and multi-factor authentication, security awareness training for all employees, and having a system in place where employees can immediately report suspected phishing emails to security personnel.

Any company that owns, or is perceived to own, useful or valuable intellectual property or competitive information is at risk of having it stolen. Verizon’s report illustrates that it’s just as important to protect intellectual property data as it is to protect payment card, customer, and employee data.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.