Key Findings & Highlights:

Issues currently affecting cybersecurity can include:

• Cyberattacks have become increasingly complex and easier to perform, state-built tools such as EternalBlue, and tools such as Autosploit allow an attacker to perform sophisticated attacks far easier than before
• With an increasing number of exploits that are discovered, vendors are releasing a large number of updates and patches
• Organizations have to consider how to set and monitor employees as the human factor in cybersecurity becomes increasingly important. This is especially important as IT security literacy remains fairly low with email phishing attacks remaining fairly common. These attacks are now more targeted at members of organizations that have the most access, i.e., exec-level, legal, F&A, and HR departments
• Year on year the public consciousness has been besieged by more news of cybersecurity not only affecting commercial organizations but also directly affecting the political environment, as such the amount of reparations demanded for infringements have increased and it is not uncommon for C-level exec’s to resign after a large cyber attack
• Organizations now have more complex IT solutions through digital transformation, IoT, and the cloud; more data is collected, and organizations have less direct control over infrastructure and systems
• Cybersecurity talent is becoming increasingly difficult to hire, with organizations noting that skills shortages are directly affecting organizations’ abilities to defend themselves. As the security landscape is constantly evolving, organizations need to perform their own (or subscribe to) advanced security research that is focused on both the wider security market and on targeted cybersecurity updates, e.g., industry-related attacks
• To increase the defenses of organizations, in the last few years there has been an increase in new regulations that organizations are required to meet. While these regulations can help organizations keep their IT infrastructure and data secure, regulation has lagged behind the proliferation of newer IT solutions such as IoT.

Lessons that organizations for cybersecurity attacks include:

• Recent cyberattacks demonstrate how org’s should look to reduce vulnerabilities
• Best practice, e.g., patching or following cyber alerts, reduces the number of attacks
• Existing attack vectors are becoming easier to exploit, and new attack vectors are being discovered
• Attackers and defenders are focusing on the psychology of cyber attacks
• New technologies will drastically change how we manage cybersecurity.