Written by Justin Giardina, Chief Technology Officer at 11:11 Systems

The news last month of yet another cyberattack on MGM Resorts, initiating a system shutdown and disrupting its operations, is yet another in a very long list of attacks that we have witnessed in the past couple of years.  Having the right preventive and defensive cybersecurity measures in place for such attacks is a given, and it is what most organisations focus on. But it is also about understanding how the organisation will recover from an incident and how they can limit the extent of an attack.

Today, being impacted by a cyberattack is almost inevitable. The global average cost of a data breach in 2023 was USD 4.45 million, a 15% increase over 3 years, according to IBM. Therefore, companies also need to think about how they can proactively recover, how quickly they can recover, and the cost of recovery to the business.

For MGM the priority now will be to stabilise infrastructure, while they find the best copy of their data and restore it so they can continue to drive business operations, bringing systems back online as quickly and securely as possible.

Here at 11:11 Systems, we know that recovering from a data-compromising cyberattack requires planning, investment, capabilities, procedures, and more. We also understand how important it is for organisations to recognise the difference between traditional disaster recovery, in response to incidents such as wildfires, earthquakes, and extreme weather conditions, and compromised data recovery in the event of a cybersecurity incident.

We’re keen to help educate the market in understanding their own capabilities to get back to business-as-usual post an attack. An interruption to operations caused by a cyberattack can cost businesses an enormous amount, financially and reputationally, so this type of intelligence is vital.  Below are some essential elements organisations should think about in order to proactively protect their infrastructure:

 

1. Understanding the Insider Threat

Employees are often the first line of defence against cyberattacks. But without proper training, they can also be the weakest link. While external threats are more dramatic and grab the biggest cyberattack headlines, insider threats—whether malicious or the result of negligence—can be more costly and dangerous. According to Verizon’s 2023 Data Breach Investigations Report (DBIR), 74% of all breaches involve the human element.

Comprehensive employee training goes beyond mere awareness. It involves regular phishing simulations, workshops on identifying social engineering tactics, and creating a culture where cybersecurity is everyone’s responsibility. By transforming the team into a human firewall, you not only protect the organisation but also empower employees to be part of the solution.

 

2. Segmenting the network

A network is more than just a collection of connected devices; it’s the backbone that facilitates the organisation’s operations. Protecting the network is as important as securing the physical boundaries of the organisation.

Technologies like firewalls, intrusion detection systems (IDSs), intrusion prevention systems (IPSs), and network access controls are essential. But it doesn’t stop there. Network segmentation enables organisations to create barriers within the network, limiting the spread of threats. By securing the perimeter of each segment, this ensures that even if one part is compromised, others remain intact.

 

3. Continuous scanning and monitoring

Software flaws and misconfigurations are like unlocked doors waiting to be exploited. It’s imperative that the organisation continuously scans for these vulnerabilities and promptly patches them. Industry professionals still talk about the 2017 Equifax breach that exposed 143 million records, all because of an unpatched vulnerability.

Closing these doors requires a proactive approach, where security teams are not just reacting to threats but actively seeking and addressing potential weaknesses. After all, an exposed vulnerability is an open invitation to attackers.

 

4. Knowing when to revoke access

Access controls are the gatekeepers to the organisation’s most valuable assets. This means implementing complex passwords, deploying multifactor authentication (MFA), and limiting access to sensitive data are all imperatives.

But access control is also about knowing when to revoke access. For example, immediately disabling former employees’ credentials is crucial as often insider threat cases involve a disgruntled ex-employee.

Employees don’t necessarily have to be disgruntled to be a threat to the business, though. Yahoo, for instance, recently sued a former senior research scientist for stealing valuable trade secrets minutes after being offered a job by a competitor. By acting as vigilant gatekeepers, you can ensure that only authorised individuals can access vital information.

 

5. Shielding the frontline

Endpoint protection is about securing the devices that interact directly with users and data. These endpoints, such as laptops and servers, are often the frontline in the fight against cyberthreats.

Tools like endpoint detection and response (EDR), antivirus software, disk encryption, and application whitelisting are crucial. By shielding the frontline, organisations not only prevent attacks but also gain insights into potential threats, allowing for more informed decision-making.

 

6. Safeguarding data requires a multifaceted approach

Data is the lifeblood of the modern organisation. It fuels growth, innovation, and customer satisfaction. Safeguarding this data requires a multifaceted approach.

Classifying sensitive data, implementing robust controls around high-risk information, encrypting both data at rest and in transit, and regular backups are crucial. By treating data as a valuable asset, the organisation will improve the chances of this data remaining secure, accessible, and compliant with regulatory requirements.

 

7. Regularly tested incident response plan

No defence is unbreachable. Even with the best security measures, some attacks will inevitably succeed. That’s why it is important to have a well-maintained and regularly tested incident response plan.

This plan should detail roles, responsibilities, and processes for detection, containment, eradication, and recovery, including updated business continuity (BC) and disaster recovery (DR) plans.

This includes being prepared to restore impacted systems and data quickly. Organisations should maintain recent backups of critical assets, including immutable backups, to ensure they can rapidly restore when needed. Furthermore, these backup processes should be regularly tested to ensure they’re up to date and align with any changes in the production environment.

 

8. Treat security as a continuous journey

Security is not a one-time effort; it’s a continuous journey. Periodic third-party audits and vulnerability assessments provide an external perspective on security posture and help identify gaps, risks, and opportunities to address any shortcomings.

The ISO/IEC 27001 standard, adopted by organisations worldwide, emphasises the importance of regular audits and continuous improvement. Embracing this culture ensures that security measures evolve with the changing threat landscape to provide robust protection against current and future threats.

 

9. Change the narrative

The MGM cyberattack is an all too familiar story that we have heard countless times before over the years.

In today’s world of heightened attacks, organisations need a multi-disciplinary, layered approach involving ongoing diligence, training, and investment, if they are going to be ready to minimise business interruption from a cyber event as well as proactively prevent the company from becoming the next cyberattack headline.

 

Written by Simon Church, Chairman, Xalient  

As we are in the midst of Cybersecurity Awareness Month, and in the lead-up to our own Secure Connected Future Summit which we are hosting in November, I feel that a lot of the focus when it comes to cybersecurity still tends to be on prevention tactics. However, I would argue that it is not just about having the right defensive cybersecurity tools in place, but it is also about understanding how the organisation will recover from an incident – how quickly and at what cost to the business.  The focus should also be on having a robust cyber risk management strategy in place.  Here I outline five key tips for organisations to consider when devising their cyber risk and resiliency plans.

 

1. Dry-run your recovery plan

Today, being impacted by a cybersecurity incident is unfortunately almost inevitable, and therefore companies also need to consider whether they can recover, how long recovery will take, whether employees can continue to work, what applications and data they will recover first, and the cost of recovery to the business.

In particular, I would urge organisations to make sure they dry-run their recovery plan, so that in the event of an attack they know they are prepared and understand the process and who is doing what.  And I’m not just talking about technology here, but people and processes.  For example, what communications about the attack will they share with employees, customers, and other stakeholders? What do they want employees to do? What do they want senior executives and the board to do?  All too often I see organisations assume that because they have the technology in place, it will magically and seamlessly recover their systems, but they neglect the fine detail around communications and reassurance. So, it is important to not only have a plan but to dry-run that plan again and again and again.

 

2. Focus on employee security awareness training 

One of the biggest risks to an organisation is the human risk, in fact (depending on the sources you refer to) 75-90% of all cyber incidents are human initiated.  So, it is very important to focus on having employee security awareness training in play.

Today employees operate in a blended environment, moving seamlessly between work applications and personal apps. Whereas previously they have been prevented from sharing company data outside the network perimeter, in our world of social media we often overshare, which leads to a lot of freely available open-source data, or OSINT.

Cybercriminals use OSINT for social engineering purposes. They gather personal information through social profiles and use this to customise phishing attacks.  The most recent MGM breach, for example, was a result of a social engineering attack on an employee who inadvertently gave hackers access to MGM’s systems.

Investing heavily in training to enable employees to make smarter security decisions will help them manage the ongoing problem of social engineering and clever phishing attacks. Performance should also be regularly measured to see how employees are implementing training in the real world, and there must be KPIs around this, that are ideally discussed at senior management or Board level. It is likely that the MGM attack could have been averted if the employee had been more aware and better trained.

 

3. Implementing data-driven metrics

This is where data-driven metrics are utilised to better monitor and manage the environment and to short-cut some of those labour-intensive tasks.   What I’m talking about here is understanding what vulnerabilities to prioritise, what incidents to contain, what are acceptable incident response times. Having visibility and context to prioritise the vulnerabilities that need to be scanned and patched. Without it, security teams are flying blind and attempting to triage thousands of possible threats, while they determine the organisation’s exposure.

Additionally, as many breaches utilise a vulnerability or flaw in operating systems’ code, the patching cadence and criticality needs to be agreed and assessed on a regular basis, so that the organisation prioritises patches based on risk to the business. To put this into context, last year there were approximately 20,000 new patches created by software vendors; this year that figure is expected to increase to 22,000. This means that the largest organisations have a backlog of over 100,000 patches to deploy, which is an almost impossible task without clear risk prioritisation.

 

4. Managing third-party cyber risk

And to add to the CISO’s challenges, managing their third parties and any extended ecosystem cyber risk is also critical. It is very difficult from an outside view to determine which third party has strong cyber controls and which ones are already, or likely to be, compromised. Standard risk assessment processes tend to be point in time, involving questionnaires and audits. For cybersecurity, this is a flawed approach that usually leads to risk tolerance or acceptance. Rather than just categorising third parties as high or low risk, organisations should focus on the nature of the relationship and their adherence to the same security policies and practices implemented by the organisation. Do they control sensitive data or have they got access to critical systems?

 

5. The importance of dynamic risk-based policies 

And finally, identity has now become a key security control for access policies and places additional emphasis on the user and device authentication process.  Not only does this require constant validation of identities and associated permissions, but this must now also be combined with the behaviour of that identity (be it human or a device) in the wider environment. In other words, it needs to be dynamic so that it can adjust and change as required.

From a security technology perspective, adoption of technologies such as Secure Web Gateways and Zero Trust Network Access as part of a wider SASE implementation can help to consolidate the security platforms needed to enforce the company’s security and risk policies, while also reducing the administrative overhead for security teams.

 

Cybercrime is predicted to be worth $10.5 trillion dollars by the end of the year. If it were a country, it would equate to the third-largest country in the world, in terms of GDP, so it is clearly big business.  Having robust security controls, a solid risk management plan, and dynamic risk policies, as well as a tried and tested recovery plan, won’t totally remove the threat of a cyberattack, but it will certainly reduce not only the probability of a breach but also the impact to the business.