Cisco, an Information Technology and networking firm has urged organisations to make online security a business priority to mitigate cybercrimes.
The firm gave the advice in its 10th Annual Cybersecurity Report (ACR), made available to the News Agency of Nigeria (NAN) in Lagos on Monday.
The Cisco ACR examined the latest threat intelligence gathered by Cisco security experts providing industry insights that reveal customer security trends.
The 2017 report also highlighted key findings from the 3rd Annual Cisco Security Capabilities Benchmark Study (SCBS), which examined security professionals’ perceptions of the state of security in their organisations.
It shared geopolitical trends, global developments around data localisation, and the importance of cybersecurity as a boardroom topic.
According to the report, over one-third of organisations that experience a breach in 2016 reported substantial customer revenue loss of more than 20 per cent.
”Ninety per cent of these organisations are improving threat defence technologies and processes after attacks, by separating IT and security functions by 38 per cent.
”The organisations increased security awareness training for employees by 38 per cent, and implemented risk mitigation techniques by 37 per cent,” it said.
The report said Cisco surveyed nearly 3,000 Chief Security Officers (CSOs) and security operations leaders from 13 countries in the SCBS as part of the Cisco ACR.
The global report highlighted challenges and opportunities for security teams to defend against the relentless evolution of cybercrime and the need for shifting attack modes.
It said that CSOs cited budget constraints, poor compatibility of systems, and a lack of trained talent as the biggest barriers to advancing their security postures.
The report said that leaders also reveal that their security departments were increasingly complex environments with 65 per cent of organisations using from six to more than 50 security products, increasing the potential for security effectiveness gaps.
”To exploit these gaps, criminals are leading a resurgence of “classic” attack vectors such as adware and email spam, the latter at levels not seen since 2010.
”Spam accounts for nearly two-thirds (65 per cent) of email, with eight to 10 per cent cited as malicious.
”While technology has helped, attacks become more damaging and defences become more sophisticated, the foundation of security remains as important as ever,” it said.
The report said that in 2007, it was reported that web and business applications were targets, often via social engineering, or user-introduced infractions.
It added that in 2017, hackers attacked cloud-based applications, and spam had escalated.
The 2017 ACR reported that just 56 per cent of security alerts were investigated and less than half of legitimate alerts remediated.
According to the report, defenders, while confident in their tools, battle complexity and manpower challenges, leaving gaps of time and space for attackers to utilise to their advantage.
”Cisco advises organisations to take steps to prevent, detect, and mitigate threats and minimise risk.
”These steps include making security a business priority as executive leadership must own and evangelise security and fund it as a priority.
”Organisations should measure operational discipline by reviewing security practices, patch, and control access points to network systems, applications, functions, and data.
”They should test security effectiveness by establishing clear metrics and use them to validate and improve security practices.
”Organisations should adopt an integrated defence approach by making integration and automation high on the list of assessment criteria to increase visibility, streamline interoperability, and reduce the time to detect and stop attacks,” it said.
The report said that when the above mechanisms were put in place, security teams then could focus on investigating and resolving true threats.
Reacting to impact of the report on Nigeria, Mr Olakunle Oluruntimehin, the General Manager, Cisco Nigeria, said that in Nigeria, the penetration of mobile and growth in internet usage meant that people were more vulnerable to cybercrimes.
”In 2017, cyber is business, and business is cyber and that requires a different conversation and very different outcomes.
”Relentless improvement is required and that should be measured via efficacy, cost and well managed risk.
-florence.onuegbu