What organizations can do to protect themselves

Phishing, along with its variants like spear phishing and BEC scams, continues to reign as the primary root cause for all cyberattacks. Unpatched software is another top root cause. If organizations focus on these two aspects and design defenses around them, they will be in much better shape to defend against the bulk of cyberattacks. Here are some security best practices that can help:

Develop a security culture for employees: Train employees regularly via real-world examples, phishing simulations, classroom training and tabletop exercises. Repeated security awareness training will help them build muscle memory so that they can identify suspicious activity and report it to security teams.
Perform software patching regularly: Have a process in place that ensures all system software is up-to-date at all times.
Deploy multi-factor authentication: MFA is known to block almost all account compromise attacks. In case your credentials are hacked, leaked or purchased from the dark web, MFA can play a critical role in preventing further intrusions.

Use a defense-in-depth approach: Defense-in-depth is a kind of layered security approach that includes a combination of three main things: user awareness (coaching users about password hygiene and phishing tactics); policies and procedures (documenting do's and don'ts, best practices and incident response procedures); and technical controls (timely patching of software, managing privilege access, performing account hygiene, endpoint detection and response software, firewalls, intrusion detection systems, and other technologies).

As we look for the best ways to position our cybersecurity strategy, it's important to remember that while tactics can evolve, root causes will always remain the same. If security teams learn to focus on addressing the root causes and not get distracted by the symptoms — ransomware is a symptom, how ransomware got in is a root cause — attackers will have no choice but to move on to the next target.

Special Reports /

Cyberthreats 2022: What we know so far

Related Stories

Recommended For You