October has been celebrated since 2004 as cybersecurity awareness month following the declaration by the President and Congress of the United States. Twenty years onward as we commemorate another month, a review is warranted on the progress made in addressing the cybersecurity challenge.
The level of frequency and sophistication of cyberattacks, coupled with the increased value of data on the dark web, necessitates a review by public and private sector entities on their security measures. The price that threat actors are willing to pay for stolen data underscores the financial incentives influencing cybercrime, and highlights the vulnerability of businesses, large and small.
According to the National Cyber Security Centre, cybersecurity refers to how individuals and organisations reduce the risk of cyberattacks. Its primary function is to protect the devices used including, smartphones, laptops, tablets and computers, and the services accessed by individuals from theft or damage. Cybersecurity is also about preventing unauthorised access to the large amounts of personal information often stored on these devices and online.
In IBM’s 2023 Cost of Data Breach Report the following was revealed:
- The average cost of a data breach reached an all-time high in 2023 of USD$4.45 million, representing a 2.3% increase over the 2022 cost of USD$4.35 million.
- Security AI and automation were proposed as critical investments to help reduce costs and minimise time to detect and contain breaches.
- 82% of breaches involved data stored in the cloud - public, private or multiple environments.
More startling from the report was the indication that one-third of businesses discovered a data breach through their own security staff. This underscored the need for better threat detection.
An Annexus Technologies report on Caribbean Small Business Cybersecurity revealed that the Latin American and Caribbean region suffered a combined 137 billion attempted cyberattacks between January and June 2022, with ransomware emerging as the most prevalent breach.
Based on the report, some of the most common threats confronting firms are:
Phishing Attacks: A shocking 91% of cyberattacks start with a phishing email.
Ransomware: 71% of ransomware attacks target small businesses in the LAC region.
Malware: In the Caribbean, 68% of small businesses reported experiencing malware attacks in the past year.
Insider Threats: A shocking 44% of all security incidents in the Caribbean were attributed to insider threats.
DDoS Attacks: Over 40% of businesses in the Caribbean have faced Distributed Denial of Service (DDoS) attacks, causing an average downtime of 7 hours.
Social Engineering: Social engineering attacks realised a 27% increase in the last two years.
Weak Passwords: An astounding 65% of small businesses in the Caribbean use weak passwords.
The report further proffered that the average cost of a data breach for a business in LAC in 2022 was US$2.09 million, representing a 15% increase from 2021. During the first six months of 2022, approximately 384,000 ransomware distribution attempts were detected worldwide. Of these, 52,000 targeted victims in Latin America. The Major Organised Crime and Anti-Corruption Agency reported that Jamaica estimated losses due to cybercrime in excess of USD$12 million annually. Other countries in the Caribbean also reported severe cyberbreaches crippling their supply of public services and affecting private sector entities in the financial, insurance and retail sectors.
It was further projected that 60% of companies increased the cost of their services following a data breach to offset losses.
After 20 years of commemorating cybersecurity month, it would appear that cyberattacks and security breaches are more prevalent than before.
A discussion on solutions is needed to combat cybersecurity risk, particularly since 95% of cyber security issues are reportedly traced to human risk factors.
The work done by Julien Sorano on How AI is changing the security landscape for small business proffered that Artificial Intelligence (AI) is increasing the sophistication of cyberattacks, but AI can equally help companies build advanced training methods to enable employees to detect scams and new types of risks. The report suggested that AI can act as a ‘copilot’ for junior staff who may not have the requisite cybersecurity ‘combat experience’, through a guided approach in the direction where threats occur. People and technology are intertwined in building security strategies for businesses. By investing in AI-powered solutions, organisations can assist their security teams to build capacity to mitigate cyber risk.
Whether it's implementing multi-factor authentication, encrypting sensitive data, or conducting regular security audits, businesses need to be proactive in fortifying their defenses against evolving threats.
Business Basics supports the call by Sonja Raath in her article on Cybersecurity Spending, that a whole of country approach is needed to combat cyberattacks and build cyber resilience.
There must be enabling laws and a legal framework for data protection and rules to address breaches and penalties for cybercrime.
Government support is critical and must include a strategy and resources to build national cyber resilience.
Strategic cooperation is key domestically and internationally, between governments, private companies, and educational institutions to share intelligence and strategies and create a stronger, more adaptable defense system against cyber threats.
Investment in a secure digital infrastructure acts as the first line of defense. This should include regular updates and maintenance of network security.
Awareness and education to inform citizens and train employees are required to prevent cyber incidents.
Vigilant monitoring, research and analysis of cyber events assist in detecting and responding swiftly to threats, minimising the impact of attacks and developing innovative solutions to outpace potential attackers.
