Anti-virus 'shark nets' won't protect us from cybercriminals, look inside to regain control of your data

1. A lack of control over the environment – in a vast natural ocean environment, these safety nets, also known as shark nets, have been known to fail. Whether through breakage, gaps that are too large, or anchor points coming loose
2. Inability to account for the unknown – scientists estimate that there are over a million species of animals living in the sea, we may be aware of a specific danger but there are many others that lurk beneath the surface
3. Continued reliance on human vigilance – a large surface area is difficult to patrol continuously, which means that gaps and lapses in monitoring can easily be overlooked

The waters of cybercrime are vast and murky

This analogy is one that I frequently think of when speaking about the imminent next phase of cybersecurity defenses. In today’s digital world, having to deal with a tremendous attack surface and unknown cyberthreats are two prominent challenges.

At the cloud level, visibility over your infrastructure decreases astronomically. Today, organisations use thousands of instances of cloud services, which is near-impossible for the human mind or even your IT department to keep track of at all times.

See also: Keys to achieving human-centred automation testing

In August 2022, FortiGuard Labs reported that it had seen over 10,666 ransomware variants compared with 5,400 in the previous six-month period – representing a 100% growth. There are simply too many variables beyond your control, which means that your IT experts and software-based defenses are fighting a battle against unseen foes, at all times.

Outside of the hardware level, organisations are playing in an ever-expanding open space where they will be hard-pressed to protect themselves from all angles. In fact, between Q1 2021 to Q1 2022, Asia Pacific ranked as the third-highest region globally to be targeted by ransomware, according to cybersecurity firm Group-IB, after North America and Europe.

The question then is how do we take control of the environment to protect our most important assets?

See also: Human element still important for effective mass communication

Your house, your rules

Back to the beach analogy. If I had to choose between the safety net-protected beach and a swimming pool, I’d go for the latter. Why? Because I would know exactly what’s in the water with me, and presumably would have control over that environment.

The same applies when devising a plan to keep cybercriminals away from your valuable data. In this case, the software is the ocean and hardware is the pool.

Usage of the cloud is already highly prevalent and has undeniable business benefits. In fact, expenditure on cloud infrastructure and services in the APAC region grew by over 38 per cent in 2020 to US$26.4 billion, according to a study by IDC. Cloud computing was a lifesaver in the early days of the pandemic, as organisations shifted to remote working arrangements – and adoption will only continue to grow. This is why the idea is not to abandon the use of such a useful innovation, but rather to learn how to build a comprehensive defence posture.

Specifically, your mission-critical assets such as employee and customer data, and company financial records, are absolutely essential to protect. Rather than allowing such information to float freely in the ocean of the cloud, you might already be storing the data with physical options such as physical servers or local storage devices.

Hardware-based security is also set apart by the fact that it is an extremely niche and specialised area, far more than software development. The US Bureau of Labor Statistics states that there are around 4.3 million software engineers in the US, compared to only 73,600 hardware engineers. This means that it takes a lot more than a casual hacker to launch an attack against your hardware.

While this is an important step in reducing your attack surface and defending against less sophisticated hackers, it unfortunately does not mean that you are safe yet – as the multiple incidents of data breaches in the past year alone have shown. Without an intelligent and fast-acting perimeter defence for hardware storage, hackers will still walk freely into your data vault, wreak havoc, and profit off your misfortune.

To stay ahead of the latest tech trends, click here for DigitalEdge Section

Control and sentry your perimeter

So how can organisations create an impenetrable perimeter that keeps potential intruders out?

To protect data stored at the hardware level, you must create a controlled environment, with limited access points, and continuous monitoring of actions made directly to the device.

This is where the application of Artificial Intelligence (AI) and Machine Learning (ML) comes in to detect potential intrusions intuitively. Unlike the multitude of access patterns that AI-embedded software-based defenses must deal with, at the hardware level this can be simplified to just the read and write patterns.

This translates to far greater accuracy, response times, and success rates in detecting threats. Trimming the threat identification algorithms down to read and write patterns will also greatly eliminate the possibility of false positives, thereby removing the need for human intervention.

Joining forces to thwart cybercriminals

The immediate goal is to be able to continue benefiting from the countless digital applications that have elevated modern business operations, while protecting ourselves better from cybercrime.

Embracing the idea of a necessary alliance between hardware and software-based defenses is vital and is the next generation of cybersecurity defences. To make that transition, a mindset shift across the industry is the first step. We cannot let the sheer volume of cyber incidents become a mere statistic for us as business leaders, it must serve as a wake-up call that jolts us into action.

Lenovo Singapore is an example of a corporation that operates ahead-of-the-times and looks beyond existing cybersecurity standards. The leading computing company introduced a range of hardware-based cybersecurity laptops in 2021. Such willingness to explore new avenues in creating a holistic cybersecurity posture is an important first step, and business leaders should adopt similar innovation and safety-led mindsets to rethink frameworks when building their organisation’s IT infrastructure.

As guardians of each organisation, leaders must adopt this updated cybersecurity approach and advocate for a more holistic cybersecurity stack that comprises the seven layers of cybersecurity architecture identified in the OSI Model. Work with cybersecurity advisors, hardware solutions providers, educate your teams, and start integrating multi-layered hardware solutions into your infrastructure.

Camellia Chan is the founder and CEO of Flexxon