Modern security needs are constantly changing, so keeping an eye on emerging trends and evaluating them critically is key. As the attackers are getting better, faster, and stronger by utilizing the emerging technologies, so should the organizations.
Topics discussed included the shift towards Zero Trust architecture, ransomware’s surging menace, and the growing momentum in passwordless authentication.
Watch the full recording below, or keep reading this blog for some of the key takeaways we took from the webinar.
Cybersecurity landscape
Matt Lee believes that changing market conditions demand a heightened focus on cybersecurity: “what changed drastically is that we actually started feeling the pains of threat actors’ endeavors. But the big shift that I think took place is that people are actually trying to solve the cybersecurity problem at the SMB and mid-market level.”
Frida Kreitzer gave a quick overview of the situation on the ground for IT teams in the current threat landscape, where more than 80% of cyberattacks are made possible by human error. For her, the primary concern is: “How can we be as proactive as possible without “breaking” the company?”
Zero trust, but more security
Never trust, always verify
A Zero Trust architecture assumes that all network traffic is untrustworthy, regardless of origin. It’s become an increasingly significant area of interest for business leaders, as it minimizes risk by dividing your assets into walled-off sections.
“Zero Trust is a world where I know the device’s posture is healthy.” Matt suggests not even allowing network connections to be attempted if certain criteria aren’t reached: “If it’s got the right [security] tools, it’s using a layer for access, and it’s coming from the right IP address, then I’ll let someone try a password. Why would I even [allow an attempt] if they’re not meeting those conditions?”
Perimeter model
Matt draws a comparison between fortified castle walls and the perimeter model which has been “the mainstay of network security for decades. In both scenarios, the fortified area has a single gateway for access. But when cannons are rolled up or spies sneak through the gate, the perimeter can no longer adequately protect its inhabitants.
When new means of attack are developed, defenses must adapt. “Business email compromises and social engineering have grown extremely large,” Matt says, referring to the most common methods used by hackers to gain access. “It’s a different world now, that [requires changing] to a different policing model.”
Verify first, then trust
Matt sees Zero Trust as a shift from the attitude of trust first, then verify.
IoT security risks
Security leaders should consider more than just end users when addressing security concerns, Frida observes. With every additional device on your network, your potential attack surface expands. Internet of Things (IoT) devices can be particularly risky:
State of ransomware
Ransomware attacks have been surging in recent years. Matt observes that ransomware groups have become so efficient as to resemble legitimate businesses:
Should you pay?
Gerald poses a controversial question on the topic – should you pay the ransom?
For Matt, “It depends. For me, it’s typically a balance of the greater good. And I think that that’s where I would try to make that decision of what’s in the best interests of everyone involved: the company, the customers, the patients. So it’ll come down to the sensitivity of the data, the impact, the gravitas of it. All of those things come into the conversation. Each one is a business by business decision.”
Frida suggests that pay or not, companies won’t be guaranteed safety from other attacks in the future. “They will get blackmailed again and again… Now you’re a target. We know that you’re vulnerable.” Frida says baking security into your software in early development should be a priority, but the real challenge is staying proactive on an ongoing basis.
Avoiding complacency is a big point for Matt as well: “Just like any business risk, you’re going to have to deal with it on a continuous basis. This is a continuous improvement model.”
Security leaders should be particularly vigilant when dealing with external contractors or consultants. Frida outlines the risks: “Someone who doesn’t know policy, someone who doesn’t have a company computer, someone who doesn’t use a password manager. Someone who’s easily susceptible to social engineering.”
Frida warns smaller companies not to assume they’ll fly under the radar:
The future of authentication – passwordless
The humble password, used since the early days of the internet, represents an increasingly outdated means of authentication, compromised with growing ease by social engineering or brute force attacks. As Matt says, “Passwords can be tricked or coerced from you.” The golden term for forward-looking, security-conscious organizations is “passwordless”.
Frida Kreitzer weighs in: “Most simply, [passwordless] means you’re not having to type in a password or use a password manager for authentication. That’s very exciting – you’re skipping that portion and just going straight to MFA (Multi-factor authentication, where multiple criteria have to be reached in order for the user to be authenticated). It’s a key that’s being sent to a device – usually a phone.”
Passkeys – a simpler and safer sign-in
Passkeys, digital credentials generated by a device, are invisible to the user, and represent a big step forward for the passwordless future. By removing the need for passwords and relying on user devices or biometrics for authentication, passwordless essentially circumvents the risk of password-related attacks.
Built on public-key cryptographic algorithms, passkeys are virtually impossible to phish or hack. Matt explains: “A [passkey] is a cryptographic representation of you that’s very hard to beat – it’s really large math.”
Closing comment
Getting your cybersecurity into a resilient posture is no mean feat. Matt points out that helpful frameworks exist that can support getting the ball rolling. “Stop trying to be the smartest guy or gal in the room. CIS (Center for Internet Security) has 153 little “do this” statements… if you do each of those you’ll greatly reduce your risk and reduce overspending because you won’t duplicate efforts. Be pragmatic.”
Important to remember is not to exaggerate or overstate security concerns when communicating with stakeholders. This can cause diminishing returns, according to Frida:
As technology continues to evolve, so do the threats that emerge alongside it, shaping the cybersecurity landscape and the strategies needed to navigate it. Understanding these ever-changing trends is vital for any business aiming to build robust defense mechanisms. They can embrace security strategies like Zero Trust architectures, prepare for the relentless threat of ransomware, and explore cutting-edge authentication methods, such as passwordless systems. Through these strategic measures, organizations can enhance their digital security, preserving trust and ensuring continuity in an era marked by swift technological changes.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.
