Emile Abu Saleh*
The past year witnessed a significant development in cybersecurity. As the frequency of cyber attacks such as ransomware continues to harm various institutions across the world, supply chains have also been subjected to many attacks by cyber hackers. Who have redoubled their efforts in developing their attacks to target networks and hack third-party, cloud, and privileged identities to steal data.
In light of this development, information security professionals around the world are increasingly concerned about what will happen in the future. In this regard; Proofpoint’s 2023 Chief Information Security Officers (CISOs) report revealed that most chief information security officers (CISOs) felt heightened concerns about cybersecurity as they did early in the COVID-19 pandemic. Statistics indicate that 75% of UAE information security chiefs surveyed say they will be vulnerable to serious cyber attacks in the next 12 months, compared to only 44% in the previous year. While 57% felt that they were not prepared to deal with a targeted cyber attack.
People risk is among the main areas of concern for CISOs. According to this year’s report; 59% of CISOs in the UAE report that human error is their organization’s biggest cyber weakness, 59% compared to 50% in 2022. Despite this, more than half (56%) of CISOs in the country believe that employees understand the importance of their role in Enterprise protection, compared to 51% in 2022 and 69% in 2021.
And today; Email and cloud applications are the primary attack vectors for ransomware, business email compromise, phishing, and other threats — which target employees rather than infrastructure.
Email fraud (BEC) attacks are a growing problem in the UAE, with 66% of organizations in the country reporting an attempted cyber attack through email fraud in the past year. There are several types of attacks: CEO fraud where hackers pose as CEOs or executives of a company; They typically send an email to someone within the finance department, requesting that funds be transferred to an account controlled by hackers – even an account hack where an employee’s email account is hacked and used to request payments to vendors. Email attacks highlight the problem of people risk, and hackers will target employees using socially coordinated email with the aim of stealing money from an organization.
The impact of the pandemic is still ongoing; Many Middle Eastern institutions were exposed to new risks during the past year. With hybrid work being the norm, employees were working outside the traditional security boundaries of their organization, using personal devices to access company networks, and moving from one place to another. Hackers have exploited this shift to compromise customer systems, steal confidential data, or install ransomware to launch a wave of phishing or email attacks.
The impact of the pandemic extended even further; The rate of job turnover has increased at higher rates than it was previously, making it difficult for organizations to protect data, and leading to data loss due to internal procedures. 47% of CISOs in the UAE reported that they had experienced a material loss of sensitive data in the past 12 months, and among them, 75% agreed that employees leaving the organization contributed to this loss.
Organizations in the Middle East must adopt a comprehensive approach to cybersecurity to meet the ever-changing landscape – an approach that includes people, processes and technology.
In order to avoid employee risks, employee awareness must be enhanced across the organization in all its departments, as an essential part of any organization’s cybersecurity strategy. This can help create sustainable behavior that shifts people from one goal to another as a strong line of defense. By building a people-centric approach to compliance and security and strengthening data protection against external sources of risk, organizations can accelerate their response to risky behavior.
This includes training users to recognize and report suspicious emails, as well as imparting the knowledge and skills needed to protect the organization from threats that can be activated by humans. For example, warning users when a message is sent from an external sender, or from a newly registered domain, can help them make more guided decisions when dealing with unconfirmed emails.
It is worth noting that a proactive approach to preventing insider threats is vital to monitoring collaboration tools to detect warning signs and stop fraud before it happens.
To ensure business sustainability, companies must be able to successfully recover from a cybersecurity event. The time it takes for a company to recover from service impacts revenue. Additionally, downtime can impact future revenue growth and hurt the brand. Therefore, having multi-layered defenses is crucial to ensuring that organizations in the UAE are well-protected against threats targeting individuals as a primary periphery.
* Senior Director for the Middle East, Turkey and Africa Region at Proof Point
2023-10-08 17:15:19
#Cyber #challenges #constant #preparedness #Khaleej #newspaper
