The cost-of-living crisis is set to impose a cybersecurity dilemma on many companies.
In the face of an unstable economy, many firms are likely to see cost-reduction initiatives where expenses are streamlined. Normally, that will extend to IT and Security budgets. However, the question that should be asked: how can we reduce the cost, without lowering our guard against the evolving threats?
Whenever there’s an opportunity, cyber criminals will exploit it. We’ve witnessed delivery and shipping companies brand phishing and smishing campaigns during 2020 lockdown, as well as targeted attacks against health institutes during the pandemic. Therefore, with Europe now facing a ‘Cost-of-Living Crisis’, we must be sure that threat actors will exploit it, too.
According to “Check Point’s Brand Phishing Report” for Q4 2022, phishing campaigns that use prize money to bait victims are on the rise. In fact, 20% of all brand phishing attempts were related to Yahoo, specifically “Yahoo Awards” where victims received phishing emails informing them that they won prize money, as scammers try to gather their personal and bank details. The fact that “Yahoo Awards” campaign took the first place, replacing DHL, proves that cyber criminals have now shifted their focus to exploit the economic situations of their targets.
We’ve also witnessed a spike in phishing emails encouraging people to apply for fake cost-of-living payments that mimic genuine government support packages. Fake texts and emails sent under the guise of the UK’s Department for Work and Pensions have been prevalent since September, and similar phishing attempts are expected to continue this year.
The insider threat could increase
This is all clear evidence that cyber criminals are indeed working to exploit the cost-of-living crisis. However, it’s not just external attacks that companies need to combat. Equally, the current economic environment is likely to exacerbate threats from malicious insiders.
Critically, research shows that the volume of insider threat incidents have risen 44% over the past two years, with costs per incident up more than a third to $15.38 million. And there’s now every chance that this very real threat may grow.
Unquestionably, Cyber criminals will attempt to tap into the financial hardships of individuals by attempting to lure employees to provide them with the credentials or valuable information they need to breach a business.
With many companies looking to streamline their expenses to combat the increase in costs – this is a reality that could unfortunately lead to an increasing number of redundancies. However, such delicate situations must be managed carefully, limiting the potential that disgruntled employees or ex-employees attempt to find ways to hit back.
Indeed, there’s already evidence that employees are exfiltrating sensitive information when they are made redundant, or even accepting payments from hacker groups in return for planting malware.
Optimise your security spend and focus on outcomes
With the increasing insider risk, evolving threats, and the need for cost reductions, companies should adopt a practical strategy to optimise their spend while bolstering their security posture. Here, we outline four steps to achieve this:
- Evaluate cost-effective services that can deliver improved security outcomes, without the expensive costs that would be required to reach the same level of security maturity in-house. A good example is Managed Detection and Response (MDR) services which offer turnkey threat detection and response through modern, remotely delivered SOC capabilities and technologies.
- Explore managed security service providers (MSSPs) that can easily remove single-person dependencies, especially for teams that need to work around the clock. Usually, a 24/7 managed service will be more cost effective than providing the same function in-house. At the same time, MSSPs enjoy economies of scale and will therefore be constantly investing in improving their offering, ensuring enterprises leveraging such services will be better protected from evolving threats.
- Move to modern technologies can help to achieve better security outcomes compared with older technologies, while at the same time consolidating multiple solutions into one platform, lowering the total cost of ownership.
- Support remote work as part of the organisation’s strategy. Solutions that enable and secure remote work will help the business levy a portion of the increased living cost of their employees, while applying more efficient controls to secure access and prevent data exfiltration. Security Service Edge (SSE) products are a good example, safeguarding against advanced threats and securing access to web, cloud, and on-premises resources, all in one powerful package.
Now, more than ever before, striking the right balance to achieve a comprehensive yet cost-effective security setup is critical.
For those looking to reduce the burdens on pressurised security professionals, while simultaneously optimising security spend and bolstering the overall security posture, MSSP and MDR solutions are an attractive option worth exploring.
Ahmed Aburahal, Technical Product Manager, Integrity360
