How US Businesses Are Building Resilience to Cyber Threats

The recent use of Ivanti's VPN solutions' security holes to do harm shows how dangerous it is for businesses to get software from these companies. Things aren't getting better either. Cybersecurity Ventures, a research company, says that software supply chain attacks will cost businesses around the world $60 billion a year by 2027, up from $46 billion now. By next year, 45% of businesses around the world,

according to Gartner, will have been attacked in the software supply chain

Because bad people can hit a lot of targets at once with these kinds of attacks, businesses have to deal with them all the time. It's hard to find and even harder to fix weaknesses in the supply chain. They won't go away any time soon because software development is so complicated and businesses in every industry are becoming more digital all the time. We are entering the age of both strikes and defenses powered by AI at the same time. Both are drastically changing and speeding up the risk landscape.Pure "defense" tactics aren't enough because risk is rising faster than ever. Bad people only need to find one way in, even if your company has a security stack or one that is run by a "super-agent" that is a single point of failure. Once they find that one weak spot, they can use that one company to attack an entire market.Cyber ResilienceBecause of these problems, businesses need to have a cyber resilience plan that includes more than just finding threats and fixing them. What do we really mean by this, though?It is important to have cyber resilience so that your digital operations can protect themselves against cyberattacks that target your software supply chain or weak spots in your digital environment. Cyber resilience combines strong protection with persistence to handle unexpected problems, restore systems immediately to healthy and useful states, and get your business back to normal operations as soon as possible.Keep these three steps in mind as you implement new ideas, especially those that use AI and consolidation, to accept and improve cyber resilience.

A bigger IT footprint, faster usage of the cloud

and new hybrid work models have made things a lot more complicated. Less visibility comes with more complexity, and more risk comes with less visibility. Researchers from PwC in 2022 asked business, technology, and security leaders what they thought about the "concerning" cyber and privacy risks that come from having too much technology, data, and other operating complexity.CISOs hear over and over again that they need to do regular patching to lower risks. It's getting harder to keep apps up to date, though. Based on different firmware, drivers, and updates, a normal business may have hundreds of different ways that Windows is set up. A single agent might be in charge of a huge number of units or settings. There are also 50 business apps and 12 security apps, and each one has its own plan for patches and updates.

For protecting corporate data, it's important to keep an eye on all corporate devices, apps, and networks. This is especially important since many endpoints are used outside of companies' protected networks. As an example, any device that isn't linked to a company domain is said to be a security stack's weak spot. IT teams can't stop a breach until it's too late because of these "dark devices" that hide important information.What you can't see can't be fixed, secured, or kept up. This has always been true.Focus on business continuity and disaster recovery (BCDR) and plan for failure.Good cyber resilience is more than just being able to spot and stop threats. It means being ready for what might happen next with your business, employees, partners, and clients. Traditional movements done at a table don't go far enough in this way. They help figure out how to find, shut down, and fix a problem in order to protect against hacks. But they might not help you figure out how to get everyone back online if most of your employees work from home or in different places.

To get your business back online, a modern tabletop exercise needs to include a full business recovery cycle

This will lower the risk of infection while you give everyone in the company access to people and systems again. How can a device that is infected be fixed and brought back to life if it is not linked to the internet? What can you do to keep your networks safe when your VPN is down because of a security hole? Companies must have a way to keep working devices and systems that aren't working so that customers and workers can still do their jobs and interact.

Automate enforcement and monitoring of compliance AI and automation have changed the way businesses stay compliant in IT systems that are complicated and with a mix of workers. As many compliance-related tasks as possible should be automated by the IT and security teams. Strong security rules won't work unless you can keep an eye on compliance all the time and set up automatic updates and fixes to apply those rules across a large area. Automation speeds up reaction and recovery times after attacks and breaches, so your business can get back online more quickly. Automated remediation processes help find and fix all infected devices, apps, systems, and networks, and they also help get rid of bad players.