Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Data Security is a Global Economic Imperative

It’s time for government and industry to define and follow a cybersecurity-first approach to protecting the precious data driving global commerce.

Data makes the world go round. It’s the grease keeping the machinery of modern global commerce moving quickly and efficiently. Without it, global supply chains would grind to a halt, stock markets would cease trading, and the simplest of consumer transactions would become untenable.

According to a 2017 McKinsey study, the volume of data flows, measured in terabits per second, has multiplied by a factor of 45 since 2005, to reach an estimated 400 terabits per second by the end of 2016. The McKinsey researchers find “the global flows of goods, services, finance, people, and data have raised world GDP by at least 10% in the past decade, adding US$8 trillion of GDP by 2015.”

An IDC White Paper, sponsored by Seagate, Data Age 2025: The Digitization of the World from Edge to Core (November 2018), defines three primary locations where digitization is happening and where digital content is created: the core (traditional and cloud datacenters), the edge (enterprise-hardened infrastructure like cell towers and branch oces), and the endpoints (PCs, smart phones, and IoT devices). The research firm calls the summation of all this data -- whether it is created, captured, or replicated -- “the Global Datasphere,” and predicts it will grow from 33 Zettabytes (ZB) in 2018 to 175 ZB by 2025.

You’d be hard-pressed to find any business or government leaders who would argue against the value of data in driving today’s global economy. When crucial data is rendered inaccessible -- as was the case in the 2017 ransomware attacks involving NotPetya and WannaCry -- the financial and human consequences are undeniable. This Wired article puts the total damages due to NotPetya at more than $10 billion, while WannaCry is estimated to have cost between $4 billion and $8 billion.

Yet, we continue to see organizations in the public and private sectors alike taking a cursory, and often misguided, approach to addressing the cybersecurity risks inherent in our digital supply chain. We see this manifesting in three key ways:

  1. Magical thinking. Organizations continue to invest in a vast array of tools in pursuit of a technical silver bullet, yet they continue getting hacked because they’re overlooking the basics of cyber hygiene. According to the 2018 Attacker’s Advantage report from Tenable Research, cybercriminals have a median seven-day window of opportunity during which they can exploit a vulnerability to attack their victims, potentially siphoning sensitive data, launching ransomware attacks and causing extensive financial damage before organizations even take the first step to determine their cyber exposure and whether they are at risk. In the case of some major headline hacks of recent years, attackers were lurking undetected in data systems for as long as two years. This tells us organizations are failing to do the most basic blocking and tackling.
  2. Asymmetrical responses. In most cases, a cyber attack -- whether by a nation-state or an individual hacker looking for financial gain -- is akin to a mouse chewing on a cable to bring down the electric grid. Sure, you can use heavy artillery to kill that mouse, but at what cost to your infrastructure? The most mature organizations use a highly strategic approach to assessing vulnerabilities. They conduct frequent vulnerability assessments with comprehensive asset coverage, as well as targeted, customized assessments for different asset groups and business units. In other words: they’re hunting the hacker mouse with sharpshooters not bombers. Yet, the 2018 Cyber Defender report from Tenable Research finds only 5% of organizations follow the most mature, “diligent” style of vulnerability assessment.
  3. Poor prioritization. Cybersecurity teams face an avalanche of alerts every day, yet current methods of assessment make it difficult to understand and, therefore, prioritize the CVEs which present the greatest business risk. The 2018 Vulnerability Intelligence report from Tenable Research reveals 15,038 new CVEs were published in 2017 in total, versus 9,837 in 2016, an increase of 53%. The count of 2018 CVEs is still underway and likely to continue for a few months. We estimate 2018 to be on track for just under 18,000 new CVEs, an increase of approximately 15% over the prior year. Almost two thirds (61%) of the CVEs enterprises are finding in their environments have a CVSSv2 severity of High (7.0-10.0). Yet, public exploits are available for only 7% of all CVEs. The reality is that, for most CVEs, a working exploit is never developed. Of those, an even smaller subset is actively weaponized and employed by threat actors. Finding and fixing the 7% is critical to improving an organization’s cyber exposure -- and still difficult to accomplish.

The 2018 Global Business Risks report from the World Economic Forum ranks cyber attacks as the No. 3 global risk in terms of likelihood, behind extreme weather events and natural disasters. However, cyber is still under-resourced in comparison to the potential scale of the threat. Indeed, the 2018 Cyber Risk Report, conducted by Ponemon Research on behalf of Tenable, reveals that 58% of more than 2,400 survey respondents lack adequate staffing to scan vulnerabilities in a timely manner. More than half (51%) say their cybersecurity teams are further hindered by a reliance on manual processes.

A recent Harvard Business Review article notes: “As the digital economy continues to develop, cybersecurity will play a critical role in international trade. Instead of considering security only a regulation issue, governments need to consider ways to avoid unnecessary confrontations, and organizations should become proactively involved to address concerns and influence policy to improve outcomes for everyone.” Along these lines, Tenable joined with other industry partners to advocate for more effective cybersecurity language in the recently announced US-Mexico-Canada trade agreement, which updates the NAFTA agreement. This language recognizes the critical importance of cybersecurity in enabling modern international trade and inhibits signatories from using cybersecurity policy to unfairly restrict trade.

We believe an even stronger approach is needed, one which starts at the board level and incorporates the business discipline of Cyber Exposure across all organizational activities. It’s time for government and industry to define a cybersecurity-first approach to protecting the precious data driving global commerce. We believe this approach requires organizational leaders to commit to a strategy that ranks cybersecurity as a top economic risk, alongside natural and manmade disasters. As stated in the World Economic Forum’s December 2018 report, Our Shared Digital Future: “Even beyond the economic implications (e.g. on intellectual property or financial stability), better security is necessary in order to protect the integrity of a wide range of societal values, such as basic rights, privacy and democratic processes.” We couldn’t agree more.

I’ll be discussing these and other cybersecurity concerns with global leaders from the public and private sectors on January 22 during the Cyber Future Dialogue 2019 conference in Davos, Switzerland. I looking forward to sharing insights and highlights from the event with you here and on social media.

Learn more:

订阅 Tenable 博客

订阅
免费试用 立即购买

选择 Tenable.io

免费试用 60 天

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。 立即注册并在 60 秒内运行第一次扫描。

立即购买 Tenable.io

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。 立即购买年度订阅。

65 资产

$2,190.00

立即购买

免费试用 立即购买

免费试用 Nessus Professional

免费试用 7 天

Nessus® 是当今市场上功能最全面的漏洞扫描器。Nessus Professional 可帮助自动化漏洞扫描流程、节省合规周期的时间,并让您调动起 IT 团队的积极性。

购买 Nessus Professional

Nessus® 是当今市场上功能最全面的漏洞扫描器。Nessus Professional 可帮助自动化漏洞扫描流程、节省合规周期的时间,并让您调动起 IT 团队的积极性。

购买多年许可证,为您节省更多

免费试用 立即购买

试用 Tenable.io Web Application Scanning

免费试用 60 天

完整享有专为现代化应用程序而设、属于 Tenable.io 平台组成部分的最新 Web 应用程序扫描功能。可安全扫描全部在线资产的漏洞,具有高度准确性,而且无需繁重的手动操作或中断关键的 Web 应用程序。 立即注册并在 60 秒内运行第一次扫描。

购买 Tenable.io Web Application Scanning

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。 立即购买年度订阅。

5 FQDN

$3,578.00

立即购买

免费试用 联系销售人员

试用 Tenable.io Container Security

免费试用 60 天

完整获得已集成至漏洞管理平台之唯一容器安全产品的功能。监控容器映像中的漏洞、恶意软件和策略违规。与持续集成和持续部署 (CI/CD) 系统进行整合,以支持 DevOps 实践、增强安全性并支持企业政策合规。

购买 Tenable.io Container Security

Tenable.io Container Security 经由与构建流程的集成,可供全面了解容器映像的安全性,包括漏洞、恶意软件和策略违规,借以无缝且安全地启用 DevOps 流程。

了解有关 Industrial Security 的详情