Risk IQās Evil Internet MinuteĀ infographic tells you the bad things happeningĀ every minuteĀ on the Internet:
- 5 successful ransomware attacks
- 9 phishing attacks
- 1,274 new malware variants
- 5,518 records compromised
Any data you look at shows that the scale of āInternet evilā increases every year. The economic impact of cyber crime now exceeds $1.1 million per minute. This is a major corporate risk, irrespective of organisational size, and cyber insurance is an inadequate response ā insurers will not pay out where you have been negligent.
TheĀ EUās GDPRĀ (General Data Protection Regulation) makes the tests for negligence pretty clear: absence of accountability, insufficient corporate governance and countermeasures that do not adequately respond to the frequency and virulence of todayās attacks.
In an environment where four potentially vulnerable web components are discovered every minute, an annual penetration test is only slightly better than not bothering at all. We run penetration tests about once a month; you should be doing them at least quarterly. However, even if you do this, you need to recognise that purely technical responses have limited benefits. Staff are the weakest of your links, particularly as phishing and ransomware attacks get smarter every day. And your supply chain may increasingly be your attackersā fastest route into what passes for your secure environment.Ā Staff awareness training only every year or two would be desperately short-sighted.
Weāre going to see more and more organisations reporting data breaches ā itās now an offence to not report one, and you can be punished with significant fines. The costs donāt stop there. After you report a breach, and undergo investigation, fines and reputational damage, you still have to spend the money to get secure. It therefore probably works out less expensive in the long run to make comprehensive cyber security investmentsĀ beforeĀ you are breached (assuming that you havenāt already been breached, and you just donāt know it yet).
