Cyber breaches are becoming more prevalent, affecting major companies both domestically and internationally. The consequences of a cyber breach can be devastating for both businesses and individuals. However, the question remains: who is responsible for these breaches, and how can they be prevented?
Noel Comerford, director at Deloitte, emphasizes that a cybersecurity breach can have various negative impacts on an individual or organization, including operational, financial, and reputational damage. In some extreme cases, it can even lead to the downfall of an entire organization. Dealing with a cyber incident can be time-consuming and stressful, which can also affect staff morale.
Comerford explains that cyberattacks can be politically motivated, as evidenced by recent escalations associated with the Ukraine conflict. Bad actors are typically categorized into nation states, hactivists, advanced persistent threat (APTs) groups with financial or cybercrime motivations, and insider threats. APT groups, which are well-funded and well-resourced, are currently operating in various locations such as China, Russia, the Middle East, and South America.
While financial gain is a primary motivation for many bad actors, there is an increasing level of hactivism and nation state activity aimed at disrupting services and processes for political gain.
On the rise
Dani Michaux, head of cybersecurity at KPMG, highlights the continued growth of disruptive ransomware attacks this year. Additionally, the use of generative AI to craft more sophisticated and larger-scale attacks is evolving. Emerging technologies like blockchain, biometrics, industry 4.0, hyperconnected systems, and virtual reality pose new security, privacy, and ethical challenges, raising questions about our trust in digital systems.
Michaux emphasizes the importance of considering cybersecurity, privacy, and ethics issues when exploring emerging technologies. Organizations should focus on building resilience in their operations and day-to-day business activities. Resilience should be a central topic in discussions among the board, management, and stakeholders.
Impact over intention
According to Michaux, cyber breaches have various impacts, including operational downtimes, financial losses, loss of management time, increased security measures, negative perception, and brand/reputational damage. However, there is also a human element often overlooked, such as the pressure and stress experienced by individuals involved in responding to cyberattacks. The anxiety and uncertainty about the impact on personal data can lead to fear and burnout.
Michaux emphasizes the need to consider the holistic impact of cyberattacks, not only on organizations but also on customers and society as a whole.
Protecting against attacks
Michaux stresses the importance of business leaders and cybersecurity teams developing a flexible resilience strategy ahead of time, rather than waiting for a crisis to occur. Engaging with the board and business stakeholders on the objective of resilience is crucial. Michaux recommends conducting simulations of ransomware or large-scale technology disruption attacks within the organization to identify vulnerabilities and areas for improvement.