CISOs in constant battle with ‘security debt’

Cybersecurity execs reveal challenges for their organisations as part of cyber arms race with cybercriminals

Posted 19 April 2021 by Christine Horton

CISOs face a rising ‘security debt’ to secure their organisations against an increasing volume of attacks by well-armed criminals.

That it part of the findings of a new report from cybersecurity provider F-Secure in conjunction with Omnisperience.

However, CISOs and their teams report turning away increasing volume of attacks and preventing more of them from becoming breaches or compromises, says the study.

In addition to the lure of successful high-profile ransomware attacks, service and affiliate models are making threat groups more effective. The sharing of tooling and offensive knowledge makes it easier to conduct more attacks against more targets.

A huge percentage of the CISOs (96 percent) acknowledge that they face a well-organised criminal industry motivated by financial gain. Furthermore, about seven out of 10 CISOs (72 percent) say adversaries are moving faster than they are, and a similar number (69 percent) say their adversaries have improved their attack capabilities in the last 12-18 months.

“Despite pervasive ‘security debt’ and reporting a rising number of cyberattacks, CISOs say that the number of incidents, which includes a breach or unauthorised access to a system, they faced remained pretty much the same,” said Michael Greaves, F-Secure’s security advisor for Managed Detection and Response.

“This could be because CISOs have made the right investments. However, it is the incidents that haven’t been discovered which worry us most. Because of the sophisticated nature of some of these attacks, organisations may not have the technology or people to identify they are in the middle of a compromise that, for example, may result in a ransomware deployment months down the road.”

Employees vulnerable

The report also found that employees are the primary attack vector, according to 71 percent of the CISOs interviewed, as attackers take advantage of social channels to launch more sophisticated targeted attacks.

The top three threats CISOs and their teams face are phishing, ransomware and business email compromise (BEC).

Securing the mobile or remote workforce, which has exploded during the pandemic, presents a number of risks, particularly where employees and devices are separated from traditional controls that could prevent their compromise.

Most CISOs (71 percent) report that their ideas about what constitutes “good security” has evolved recently.