Is Cybersecurity Everyone’s Concern?

Is your business connected to the Internet for any services? Do you shop online or purchase any products or services online? Are you on Facebook, Twitter, LinkedIn or any other social networking web sites? Do you have a high-end mobile phone and use chat applications such as WhatsApp? If so, cybersecurity is an issue about which you should be concerned.

If you think that you could never be a victim of an attack originating on any of these platforms, you should think twice, because cybercriminals are keenly tracking your identities and researching your shopping behavior, watching what you do online and, ultimately, profiling the very devices through which you are connected to cyberspace. Since you are part of the bigger, interconnected network, you are a potential target of a cyberattack.

If you are thinking to yourself, “What do I possess that will interest a cybercriminal?,” think of it this way:  You are targeted, not to steal anything specific, but to possibly build in-roads to a bigger trusted network to which you belong. Once your systems and networks are compromised, it may appear that the cyberattack has originated from your organization while it was actually performed by an invisible cyberattacker from your IP addresses using your system signatures.

Even if your interconnected networks are protected through a firewall or other security measures, a persistent hacker could still closely footprint your activities, e.g., when have you scheduled your next maintenance of systems and networks, the security behavior of users, or the tools and technologies deployed in your organization. In many cases, cybercriminals operate in stealth mode for a period of time before attacking. Once they are inside a network, they quickly adapt to the network behavior, making it difficult for the existing intrusion detection system to flag them. People are the weakest link that is targeted by a cyberattacker.

Essentially, every organization in cyberspace has to rethink with whom and how they are connected in cyberspace and prepare for any threats that can appear because of these interconnections. It is possible that something is already in place; it may just need strengthening through anti-hacking measures such as user awareness, firewalls, patch management, incident response, authentication, authorization and other controls.

Read Sanjiv Agarwala’s recent Journal article:
“Quick Fixes for Improving Cyberdefenses,” ISACA Journal, volume 2, 2016.

Sanjiv Agarwala, CISA, CISM, CGEIT, BS25999/ISO 22301 LA, CISSP, ISO 27001:2013 LA, MBCI

[ISACA Journal Author Blog]