Cybersecurity is a long-term business necessity just as important as any organization’s finances or legal practices. However, some companies appear to be stuck with what to do when it comes to cybersecurity.
One thing is for certain — the state of cybersecurity in the economy is getting worse (think T-Mobile, SolarWinds, Colonial Pipeline and other attacks).
A CompTIA study of 400 business and technology leaders across the United States found that in 2020, 82% of employees felt satisfied with their company’s approach to cybersecurity. In 2021, that number dropped to 70%.
With everything happening in the world, practices that were once considered good enough might not be cutting it anymore.
CompTIA’s 2021 state of cybersecurity report calls for a new mindset, “with IT taking on strategic significance and cloud computing undoing the traditional notion of a secure perimeter.”
The emerging new mindset is all on zero trust — the idea that all networks are inherently insecure requiring verification at every step.
Related: What is Zero Trust and How Do You Implement It?
The report indicates that a shift to a zero-trust policy is likely to be a more expensive than other approaches. Among companies in CompTIA’s cybersecurity report pursuing a zero-trust architecture, 75% have found that more investment is required for zero trust than for their previous cybersecurity initiatives.
Organizations must mover their entire infrastructure to a Zero Trust model in order for it to be successful.” They cannot take what they have done in the past, and forklift it over to the new architecture — taking an existing infrastructure and porting it over,” said Jeff Pollard, vice president and principal analyst with Forrester Research on DarkReading.com, “There is just so much technical debt in the old environment.”
The processes to implement cybersecurity policy are the next step. Security monitoring (49%), workforce assessments and education (41%) and threat intelligence (41%) are among the processes most often used today, according to the CompTIA cybersecurity report.
While most companies focus their monitoring on traditional cyber threats such as viruses and malware, there is interest in improving knowledge around phishing, ransomware, firmware hacking, IP spoofing and other new types of attacks.
Leave a Reply