The fight against cybercrime
Ryan van de Coolwijk, Product Champion Cyber at iTOO Special Risks
Business models and the way we conduct business have changed. This means that the risks of potential cyber-attacks also increase with the advancement of technology.
Although various security measures are being put in place, cyber security alone is not adequate as cyber criminals are often protected by the layers of high-tech encryption and technology. It is therefore important that organisations move with the time in terms of technology and when it comes to managing cyber threats.
A fast-emerging trend
The most common incidents experienced, according to Garth de Klerk, Chief Executive Officer of The Insurance Crime Bureau (ICB) remain phishing, whaling and ransomware.
“The delivery methods are still the typical email sent, aimed at either luring an individual into clicking on a link, or impersonating a senior executive and giving instructions that could lead to financial or other losses. Social Engineering or “Human Hacking” is a fast emerging trend, where the syndicate will research key individuals, whether they are a receptionist, personal assistant, or the c-suite executive. Once enough information is gleaned on the individual via either social media or internal information then an attack is designed specific to that individual – again with the intent to cause financial or other loss,” continued de Klerk.
The lack of preparedness
The South African excerpt from the Ponemon Institute’s latest Cost of a Data Breach survey found that companies took on average 155 days to detect and a further 44 days to contain an incident. The intervening time or period to identify an incident was less than 100 days and the average breach cost was R29.8 million. When it took more than 100 days to detect, the cost rose to R34.95 million. Where a breach could be contained within 30 days the average breach cost was R28.44 million, as opposed to R36.28 million where containment took more than 30 days.
“It is clear from these numbers that the time to identify and contain an incident can have a large impact on the ultimate costs incurred,” said Ryan van de Coolwijk, Product Champion Cyber at iTOO Special Risks.
To highlight the lack of preparedness, in the latest PwC Global Economic Crime Survey, it was found that only 35% of South African companies have a cyber incident response plan in place.
Closing the gap
“How dependent are you on your systems, and for critical systems do you have recovery mechanisms in place? How long would it take to recover? Who has access to data and systems and how secure is such access? Where is data stored and are there measures implemented to safeguard such data e.g. mobile device management, encryption etc. What monitoring do you have in place, are you likely to pick up malicious activity? Do you have an incident response process etc?” concluded van de Coolwijk.
“When dealing with a cyber incident, the speed, co-ordination and effectiveness of the response process is paramount to limiting the potential costs and damages,” said van de Coolwijk.
He concludes by saying there are some high level topics for consideration including the ability to understand your IT environment, storage and processes.
In order to combat cybercrime in the industry, De Klerk says, “As a collective we need to continue to stay ahead of trends, and continuously educate/remind our employees of the risks. Simplistic awareness around the most likely methods of attack, and education as to how to avoid the more sophisticated approaches is key to reinforce in our work places. As an industry we need to look for channels to share knowledge on cyber trends, to form a combined front, with the ultimate view to mitigate the risk of falling prey to cyber.”
Editor’s Thoughts
With the top leading risks for businesses in South Africa being cyber incidents, BI and changes in legislation and regulation, the risk landscape for businesses is substantially changing. Even though it is not possible to mitigate risks, they can be managed with the right strategies in place. Please comment below, interact with us on Twitter at @fanews_online or email me your thoughts myra@fanews.co.za
