Time for Asian businesses to ramp up their cyber security defences

WE do not have to look far to see how technology has become so integrated in our lives. The mobile phone, for example, has become a window to the world through social media and the Internet. It has also been used widely for banking and e-commerce around the world, including the Asia-Pacific (APAC), where a number of countries are considered mobile-first. Indeed, mobile technologies have created endless possibilities with new apps being developed every day.

With these capabilities, security has become more crucial than ever. Cyberspace is a rapidly moving realm where new innovations abound. It is also where cyberthreats lie. The same cyber security risk extends to businesses, where a small oversight can change the fate of a company overnight. Every time users log in on their desktop or mobile phones, they expose themselves to a certain degree of risk.

Despite the proliferation of new digital services in APAC, only a few countries in the region have implemented national cyber security strategies; and many struggle to keep up with the evolving threats and regulations.

CYBERSECURITY IN APAC

According to a new survey of over 500 industry professionals from key APAC markets including Singapore, not knowing how to cope with the evolving cyber security landscape is what stops companies from growing their existing capabilities. This is ironic, since the lack of information and knowledge means that companies are risking their highly confidential data to potential threats.

Forty-seven per cent of respondents revealed that their biggest cyber security challenge is the lack of awareness among employees. This was closely followed by risks from third-party service providers (36 per cent) and migration to Cloud (31 per cent). This trend is seen across markets and industries, regardless of the number of employees. It demonstrates a need for intervention in the area of awareness across the region since the issue is not unique to a specific country.

It is easy to see why decision-makers are hesitant to grow their cyber security capabilities or make long-term plans. The rapidly changing landscape that calls for an unstoppable evolution of cyber security solutions can seem daunting, even tiring to keep up with. On the upside, many companies see the need to continue investing in this area, as seen through the growing cyber security budgets in recent years. However, organisations need go to beyond pumping in cash if they want to effectively address the issue.

Alongside financial investment, knowledge and expertise are vital assets in combating cyberthreats. The nature of cyberspace is that it never stops evolving, and the only solution to ensuring that data is protected is to take a preventative mindset towards cyber security rather than simply reacting to oncoming threats. Often, stopping the impact of data breaches is too late, especially after the damage is done.

The reality is that organisations across the region still take a reactive approach to cyber security, with over half of them favouring a "detect and respond" stance. Most companies still rely on basic defences such as antivirus solutions and firewalls (at 69 per cent and 67 per cent respectively). This is especially predominant in the health care, education and government sectors. At the other end of the spectrum, two-factor authentication, anti-ransomware and biometrics have low levels of adoption.

There is much work to be done to convince companies to become more proactive in the fight against cyberthreats. Fifty per cent of the organisations surveyed conduct a yearly review of cyber security policies and standard operation procedures, while only 39 per cent do it more than once a year. To effectively detect and help mitigate cyberattacks, employees should be trained more than once a year. This is due to the nature of the industry that is constantly evolving. Up-to-date training also keep employees on their feet as it forces them to revisit what they have learned and equips them with additional information on the latest traps to avoid.

That said, threat management is an advanced discipline that often requires people with the experience, knowledge and skills to make sense of complex information that may come from multiple interconnected sources. Alongside dedicating trained employees within an organisation, a centralised security platform can help ensure that companies stay away from unwanted cyber breaches, and have processes streamlined to avoid fatal mistakes. Ultimately, the combination of dedicating people with advanced knowledge in cyber security and the availability of smart tools that help prevent cyberthreats will enable companies to focus on the core business.

CREATING A SAFE PATH

Equipping a company with the right tools and educating employees on data security may seem like a daunting task, and as the survey revealed, organisations across the region seem to be overwhelmed by the plethora of cyber security solutions available in the market. But before we even choose which solutions to deploy, we need to evaluate our mindset towards cyber security. With the multitude of cyberthreats that we have heard about in the past couple of years, it seems that organisations have already given up and accepted that threats will indeed persist. While this is true, it does not mean that we should wait until we become a subject of a breach. Prevention is still important, and should never be neglected by organisations - especially those providing critical services such as financial institutions, hospitals, utility providers and even the government.