Insights

The acceleration of digital transformation, ever-expanding volumes of big data, and the proliferation of the Internet of Things (IoT) are just some of the factors dramatically changing the way we live, work, and do business. With this comes more opportunities for cyber criminals to cash in organisational vulnerabilities, with remote work alone having increased the average cost of a data breach by $137,000.

It comes as no surprise then that 55% of business executives plan to increase their budgets for cybersecurity in 2021. But with cyber attack numbers and sophistication on the rise, investing in traditional endpoint defences is futile. In other words, it’s no longer good enough to sit back and wait for an attack, and then try to recover from it using a confusing array of manual tools.

Fortunately, through new technology we can now access better defence solutions such as the critical tool of intelligence. From understanding what adversaries are likely to do, to gaining valuable insight into our own defences, gathering this intelligence helps us become better informed and better prepared to anticipate and stop breaches before they happen. But how does this work in the real world, and why should we be shifting from a reactive to proactive approach to security?

The pitfalls of reactive cyber security

Reactionary defences are designed to detect and alert your security team as soon as a threat probes your perimeter, minimising impact to your organisation. However, with the advancement of attacker sophistication, cyber criminals are now capable of disguising their attacks to confuse detections. In 2019, 93.6% of malware observed was polymorphic, meaning it has the ability to constantly change its code to evade detection. This enables them to fly low under the radar and bypass defences.

A further potential pitfall with this strategy comes in the shape of alert fatigue. This can be the result of overwhelming numbers of alerts that turn out to be false positives. Since many organisations lack internal monitoring capabilities, once breached they are unable to detect an attacker’s movements within the perimeter. Attackers are then able to operate undetected for long periods of time, wreaking mayhem that leads to significant and often hefty financial damage.

Another challenge stems from the fact that many data breaches are a result of insider threats. Whether through accidental actions or malicious intent, insider threats are difficult to detect and have increased over the last 12 months for 68% of businesses . And since reactive organisations act only once the damage is done, risk is increased which can amplify the negative effects of breach.

Stay prepared and minimise cost, risk, and organisational damage

When it comes to cybersecurity, a constant state of readiness is crucial. Organisations who embrace this attitude stand a much better chance of minimising cost, damage, and risk, compared to those who have no plan and instead respond to threats reactively. By taking a proactive approach to cybersecurity, your organisation can stay one step ahead of attackers and regulatory requirements. To do so your people must stay prepared and aware of a solid action plan that offers structure to avoid confusion, enabling you to illuminate the element of surprise which can result in a fumbled response.

The end goal for proactive security is to be able to confidently detect threats much earlier in the kill chain. This type of defence involves active threat hunting within your organisation, searching for activities and signs that are indicative of an attack. From here, corrective action is taken to mitigate any detected breaches. Active threat hunting can involve human security analysts as well as automated detection and response capabilities that are fine-tuned through predictive defence analytics, Machine Learning (ML), and Artificial Intelligence (AI) algorithms. For businesses who leveraged security automation solutions in 2020, this resulted in $3.58 million average breach costs savings and a 74-day reduction in breach lifecycle .

A further key benefit of proactive security is that your organisation gains the viability to detect, investigate, analyse, and track any suspicious activity that has breached your perimeter. By acquiring knowledge of external threats early it is possible to more accurately anticipate what might happen – and establish a more effective defence. It also enables you to understand and manage your network’s attack surface through the eyes of an attacker.

How to execute an effective proactive defence strategy

With all the benefits that come with a proactive approach to cyber security, effective execution of a strategy requires experienced specialists who are knowledgeable when it comes to attack techniques. Such experts also need to be equipped with sophisticated analytics tools, so that your security team can perform deep inspection of any suspicious behaviour detected within your networks. However, unless you already have in-house security experts who possess the advanced threat hunting skills necessary to mount a proactive defence, this could be a challenge.

Chorus offers expert support and deep cyber security expertise, with the ability to combine a proactive approach to identify and access management, could app and security, threat detection and prevention, and information protection. As Microsoft security partners, our IT security consultancy services help organisations adopt and benefit from advanced Microsoft security solutions such as Azure Active Directory, Cloud App Security, Azure Sentinel and the full suite of Microsoft 365 Defender products.

Whether you need to protect your organisation against compromised credentials, secure and manage a growing number of endpoints, or ensure your business is compliant, we offer end-to-end cyber security services that cover:

• Cyber security assessments & strategy
• Ongoing managed security support
• Endpoint detection and response
• Mobile device management
• Identity & Access management
• Data protection & GDPR
• Cyber Essentials & ISO27001 certification

To discover more about the advantages of taking a proactive approach to cyber security, join our webinar What does a Next-Gen CSOC look like? on June 23rd at 2pm. We’ll be discussing the shift from reactive to proactive security operations and share our best practice guidance for a modern Zero Trust cyber security strategy.