Topics discussed included the shift towards Zero Trust architecture, ransomware’s surging menace, and the growing momentum in passwordless authentication.

Watch the full recording below, or keep reading this blog for some of the key takeaways we took from the webinar.

Cybersecurity landscape

Matt Lee believes that changing market conditions demand a heightened focus on cybersecurity: “what changed drastically is that we actually started feeling the pains of threat actors’ endeavors. But the big shift that I think took place is that people are actually trying to solve the cybersecurity problem at the SMB and mid-market level.”

Frida Kreitzer gave a quick overview of the situation on the ground for IT teams in the current threat landscape, where more than 80% of cyberattacks are made possible by human error. For her, the primary concern is: “How can we be as proactive as possible without “breaking” the company?”

Zero trust, but more security

Never trust, always verify

A Zero Trust architecture assumes that all network traffic is untrustworthy, regardless of origin. It’s become an increasingly significant area of interest for business leaders, as it minimizes risk by dividing your assets into walled-off sections.

“Zero Trust is a world where I know the device’s posture is healthy.” Matt suggests not even allowing network connections to be attempted if certain criteria aren’t reached: “If it’s got the right [security] tools, it’s using a layer for access, and it’s coming from the right IP address, then I’ll let someone try a password. Why would I even [allow an attempt] if they’re not meeting those conditions?”

Perimeter model

Matt draws a comparison between fortified castle walls and the perimeter model which has been “the mainstay of network security for decades. In both scenarios, the fortified area has a single gateway for access. But when cannons are rolled up or spies sneak through the gate, the perimeter can no longer adequately protect its inhabitants.

When new means of attack are developed, defenses must adapt. “Business email compromises and social engineering have grown extremely large,” Matt says, referring to the most common methods used by hackers to gain access. “It’s a different world now, that [requires changing] to a different policing model.”

Verify first, then trust

Matt sees Zero Trust as a shift from the attitude of trust first, then verify.

IoT security risks

Security leaders should consider more than just end users when addressing security concerns, Frida observes. With every additional device on your network, your potential attack surface expands. Internet of Things (IoT) devices can be particularly risky:

State of ransomware

Ransomware attacks have been surging in recent years. Matt observes that ransomware groups have become so efficient as to resemble legitimate businesses:

Should you pay?

Gerald poses a controversial question on the topic – should you pay the ransom?

For Matt, “It depends. For me, it’s typically a balance of the greater good. And I think that that’s where I would try to make that decision of what’s in the best interests of everyone involved: the company, the customers, the patients. So it’ll come down to the sensitivity of the data, the impact, the gravitas of it. All of those things come into the conversation. Each one is a business by business decision.”

Frida suggests that pay or not, companies won’t be guaranteed safety from other attacks in the future. “They will get blackmailed again and again… Now you’re a target. We know that you’re vulnerable.” Frida says baking security into your software in early development should be a priority, but the real challenge is staying proactive on an ongoing basis.

Avoiding complacency is a big point for Matt as well: “Just like any business risk, you’re going to have to deal with it on a continuous basis. This is a continuous improvement model.”

Security leaders should be particularly vigilant when dealing with external contractors or consultants. Frida outlines the risks: “Someone who doesn’t know policy, someone who doesn’t have a company computer, someone who doesn’t use a password manager. Someone who’s easily susceptible to social engineering.”

Frida warns smaller companies not to assume they’ll fly under the radar:

The future of authentication – passwordless

The humble password, used since the early days of the internet, represents an increasingly outdated means of authentication, compromised with growing ease by social engineering or brute force attacks. As Matt says, “Passwords can be tricked or coerced from you.” The golden term for forward-looking, security-conscious organizations is “passwordless”.

Frida Kreitzer weighs in: “Most simply, [passwordless] means you’re not having to type in a password or use a password manager for authentication. That’s very exciting – you’re skipping that portion and just going straight to MFA (Multi-factor authentication, where multiple criteria have to be reached in order for the user to be authenticated). It’s a key that’s being sent to a device – usually a phone.”

Passkeys – a simpler and safer sign-in

Passkeys, digital credentials generated by a device, are invisible to the user, and represent a big step forward for the passwordless future. By removing the need for passwords and relying on user devices or biometrics for authentication, passwordless essentially circumvents the risk of password-related attacks.

Built on public-key cryptographic algorithms, passkeys are virtually impossible to phish or hack. Matt explains: “A [passkey] is a cryptographic representation of you that’s very hard to beat – it’s really large math.”

Closing comment

Getting your cybersecurity into a resilient posture is no mean feat. Matt points out that helpful frameworks exist that can support getting the ball rolling. “Stop trying to be the smartest guy or gal in the room. CIS (Center for Internet Security) has 153 little “do this” statements… if you do each of those you’ll greatly reduce your risk and reduce overspending because you won’t duplicate efforts. Be pragmatic.”

Important to remember is not to exaggerate or overstate security concerns when communicating with stakeholders. This can cause diminishing returns, according to Frida: