The UK boasts one of the strongest technology sectors in the world, attracting world-class talent, rapidly growing and enjoying an ecosystem valued at $585 billion, up by more than 120% since 2017. Venture Capital investment in the UK is the third highest in the world, reaching a record-breaking $15 billion in 2020, despite the double whammy of Brexit and Covid-19.
All of which makes it disturbing that many companies within the sector admit they are poorly prepared to prevent, repel or deal with the consequences of a cyberattack.
More than two-thirds (69%) of UK technology and IT companies have suffered a cyberattack during the last 12 months, according to research conducted by Ponemon Institute. It’s a cause for concern when the country’s most technologically advanced organizations are among the least well-prepared to cope with cyber-crime.
These attacks have caused real damage, with the longer term repercussions – and potential costs of data thefts that might be incurred through GDPR fines, as well as private claims – as yet unknown. One-third (32%) of cyberattacks have had an estimated financial impact of over £175,000 per attack, according to respondents to the Ponemon survey.
One year ago, it was understandable that in the initial weeks and months following the imposition of lockdown conditions, the focus for leaders following the shift to remote work was on business continuity – on keeping the wheels in motion while the established workplace was inaccessible. Yet weaknesses that might have been expected to be entirely mitigated in the immediate months following the first lockdown are still commonplace one year on, and show little signs of slowing.
But the past year has also exposed deeper underlying issues for IT and technology firms. The main weaknesses can be broken down into three areas.
1. Investment gap
The events of 2020 stretched IT budgets to the limit. The need to provision equipment and applications for remote working entirely absorbed planned spending on IT for many companies, leaving little left for much else, such as enhanced protection to cover the increased risks associated with remote access and the enforced adoption of bring-your-own-device policies for many organizations. Half of the UK tech sector (49%) say they are now without the sufficient financial resources to successfully prevent cyberattacks. And the likelihood of being able to invest significantly more into cybersecurity measures this year doesn’t look hopeful either.
2. IT staff capacity gap
A second, related issue is the ongoing skills gap around specially trained cybersecurity personnel. Perhaps it’s surprising, given the technology-focused nature of the sector, but a clear majority of UK tech firms (61%) say that they are currently without the necessary in-house expertise to prevent cyberattacks or deal with the consequences. Security specialists are in extremely high demand, causing many firms to outsource contractors and other third-parties to assist them. But taking this critical function ‘out of house’ poses the risk of it becoming ‘out of mind’ for business leaders.
3. Governance gap
A general lack of governance and policies around remote working and the related security factors it entails has also contributed to the adverse cybersecurity fallout for the sector. Many organizations have no policies around remote working, password policies or common security practices. While this may have been more forgivable 12 months ago, for the same policies to still be missing a year later, despite the knowledge that cyberattacks are on the rise, is of major concern.
However, remote working is not intrinsically insecure, even if circumstances dictate that employees need to use their own devices to connect to network resources. A series of quick and inexpensive measures can be deployed easily and ramp up a company’s security posture in a matter of days.
Ramping up security
Identity-based attacks – typically, stolen, re-used or guessed login details – have become the most common vector of attack over recent years: these currently account for four out of five breaches according to the WEF.
Many of the legacy ideas around passwords have become outdated. Not least among these is the idea that people will be able to remember the passwords they need to operate on a day-to-day basis. Typical professional workers now need to be able to produce around 85 passwords or more, between their work and home accounts.
Nobody can personally remember so many passwords. As a result, a common response from less security-conscious employees, that while regrettable is also understandable, is repeated passwords or similar groups of passwords based around dictionary words, family names and dates. These are easily guessed at by hackers, with access to millions of regularly used passwords and email addresses floating around hacker-focused forums and groups.
That’s why we need technologies to help us. An enterprise-grade password management platform protects against the organization’s primary attack vectors. Good solutions generate unique, robust login credentials using technology that makes use of world-class encryption, zero-knowledge security architecture and a zero-trust framework.
