Add to favorites Analysis: The bad guys may have won the battle, but they haven’t won the war…yet.
The National Crime Agency has today issued a call to arms after revealing that the UK is outgunned and outpaced by cyber criminals. Not only are the bad guys winning the cyber arms race, their success is costing the UK billions of pounds each year.
Sadly, however, this is becoming normal daily discourse in the cyber security market – threats are evolving, businesses are failing to wake up to the risks and the board are not taking security as seriously as they should be.
Eluding to the fact that today’s NCA assessment is one of many, Wieland Alge, VP & GM EMEA at Barracuda Networks, said:
"We see multiple cyber crime assessments of this kind carried out across Europe – all of which show the same patterns – and yet companies are still not taking the necessary actions to protect themselves and their customers. Many companies are still ignorant to the fact that everyone has become a target. An astonishing number are still surprised that they have been attacked at all. The simple truth is that the digital transformation of crime is outpacing the digital transformation of companies and also the transformation of cyber defence."
According to ONS figures cited in the NCA assessment, there were 2.46 million cyber incidents last year alone, and it’s easy to see why. Many businesses are failing to realise and protect against cyber risks, while at the same time hackers are becoming enterprises in their own right and have an R&D department which is putting business defences to shame. In addition to this, businesses are simply failing to get the right people on board, as Luke Brown, VP and GM EMEA, India and LatAm at Digital Guardian explained:
"It’s no surprise that the NCA warns that criminals are winning the cyber arms race: the IT security industry simply doesn’t have the troops to fight back. For many years, the industry has faced a recruitment drought and individuals who meet the required training standards are hard to come by and highly sought after.
"In fact, the unemployment rate amongst information security professionals is effectively zero. The issue is that businesses can’t simply deploy security technologies and expect to be protected from every kind of attack, they need to work with security experts. The UK government’s plan to open a new National Cyber Security Centre is certainly a step in the right direction, but without more widespread investment to train more cyber security recruits, this war will continue to rage on."
As the good guys continue to lose battle after battle, many in the industry are calling for a new tactic to be deployed. Instead of sitting back, waiting for the threat, waiting for the hacker to strike – business are now being urged to take the offensive.
Stephen Love, Security Practise Lead – EMEA, Insight said: "In the fight against cybercrime, it’s time we stepped up our game. Highlighted by the NCA saying the technical capabilities of criminal gangs are outpacing the UK’s ability to deal with their threat, as an industry, we need to now take the fight to the criminals.
"While we currently face an uphill battle against criminals operating in a deep and sophisticated dark market, by working together, we stand a fighting chance. Through sharing information across industries, we will soon find ourselves one step ahead in finding cybercriminals and stopping them before they can act."
Love mentions data sharing, and it is this collaborative approach which will be key in the cyber war moving forward. This call for collaboration has attracted a number of big name supporters, not least the NCA themselves with director Jamie Saunders saying that a "collaborative approach" would be needed to succeed.
Earlier in the week KPMG and BT released a joint report which at its core focused on working together to disrupt digital crime. Both companies present collaboration as a way forward in the fight against cyber crime, highlighting that businesses often face similar threats and have a common interest in making it more difficult for hackers to operate. These shared common interests align with the goals of government and law enforcement. If these three groups join forces and share intel and resources then, as Sir Michael Rake, BT Group Chairman, says: "we can turn the fight back on the criminal attackers."
Collaboration would also allow business, government and law enforcement to stand toe-to-toe with hackers and match the agility of criminal gangs. And when it comes to collaboration, industry can look to hackers for inspiration – as they are currently some of the best collaborators in business today.
David Kennerley, Director of Threat Research at Webroot, said: "The dark web makes it far too easy for criminals to collaborate, sharing tools and techniques, which means the NCA – and UK businesses – are fighting cybercrime on a global scale. But there’s something to learn from the cyber criminals here – cross country collaboration and information sharing is essential to succeed."
Mirroring the hackers’ global operations, the response to the criminal threat also has to be global. Global collaboration in the industry has proved to work before – KPMG and BT point to the December 2015 Interpol operation which took down numerous call centres with the help from law enforcement from 23 countries – but speed, regulation, legacy systems and a skills gap are causing too many obstacles for the good guys to gain an advantage.
"There are many organisations that work with businesses to promote information sharing, such as CiSP, but we need to be much faster." Kennerley said.
"Threat intelligence needs to be shared almost instantly, instead of over the course of days and weeks. To keep up with the high volume of new threats facing businesses real-time updates to software is imperative. Only by using smart threat intelligence will organisations receive the collective intelligence based detection, protection and alerting systems needed to combat the ever-more professional cyber criminals of today."
Speed is just one factor and, unfortunately, there is no silver bullet which will win this cyber war for the good guys. Businesses need to understand the hacker – the business model of Hackers Incorporated. With this understanding of the enemy, businesses can start to build defence strategies and start to fight back. However, that fight back can only be effective if the skills gap is addressed and the right recruits join the ranks. There is also regulation and legacy system halting progress – but although these are all challenges, progress can begin to start.
Bringing cyber crime up to the board level can pull all these cyber issues and challenges into view, while collaboration can bolster the cyber arsenal and allow access to skills, intelligence and resources. Calling the industry to join ranks, Rob Norris, Director of Enterprise & Cyber Security in EMEIA at Fujitsu, said:
"While we currently face an uphill battle against criminals operating in a deep and sophisticated dark market, by working together, we stand a fighting chance. Through sharing information across industries, we will soon find ourselves one step ahead in finding cybercriminals and stopping them before they can act."
