Key Challenges for Cybersecurity

Cybersecurity challenges are increasing at a rapid pace and attacks are becoming much more professional as IT systems are becoming increasingly complex and are opening up to customers, suppliers, and partners. Advancing digitalization not only offers economic advantages, but also opens up new risks that are being exploited intensively by hackers.

Consequently, cyber resilience is currently a hot topic of conversation. Cyber resilience refers to the ability of an organization or system to protect itself from cyberattacks, respond to such attacks, and recover from the effects of these attacks.

The most important threats are listed here, divided into external and internal challenges:

Internal challenges:

• Skills shortage: This has been a challenge for some years and is expected to continue for the foreseeable future. Intelligent sourcing can help.

• Complex environments and operations: An evergreen issue in IT. Every business leader and IT and cybersecurity manager must be aware that additional complexity also entails additional effort (personnel, skills, tools, security infrastructure) and therefore additional budget.

• The sheer volume of attacks: It can be a challenge for organizations to distinguish between dangerous attacks and more benign background noise. It is, therefore, important to have an SOC that is scalable and largely automated, and able to distinguish between important and less important incidents, relieving the burden on SOC experts.

• Poor data management: Data management is a wide-ranging task, both in terms of compliance with GDPR and similar requirements, as well as access rights, encryption, and classification.

• Budget constraints: Cybersecurity budgets in most companies are growing annually, but in many companies, the volume of tasks that need to be addressed is growing even faster. New threat patterns require new security solutions, the salaries of security experts are rising significantly above the average salary of employees, advancing digitalization requires appropriate security measures, and new compliance regulations must be observed.

• Inadequate pre- and post-attack procedures: Patch management and breach and attack simulations are essential before an attack strikes. Following an attack, forensics, patching, and establishing why security measures have failed to prevent attacks are essential.

• Staff awareness: In addition to all available technical measures, which are definitely essential, the individual user is still the most important cybersecurity resource. Many attacks start with the users via phishing. Users who recognize these dangers and do not open every attachment or click on every link can protect themselves and the entire company.

External challenges:

• Malware: Malware in the form of viruses or worms is one of the oldest cybersecurity challenges. Ransomware is a much more recent threat. The first line of defense against malware is user awareness, as phishing, e-mail attachments, malicious websites, and malicious “tools” are the highest risks. It is also essential to update operation systems, browsers, and any software on the endpoints as well as to keep the security software and its definitions up to date. The second line of defense includes technical solutions such as EDR/XDR, anti-malware software, etc.

• Phishing: Phishing and spear phishing is often the first and most important step in an attack. A few years ago, phishing e-mails were usually easy to identify because of poor spelling, outdated logos, etc. However, with GenAI, many (spear) phishing e-mails are almost impossible to identify visually.

• Denial-of-service attacks: Denial-of-service attacks are a classic form of cyberattacks.

• Software supply chain attacks: Supply chain attacks are cyberattacks that are not carried out directly on companies, but indirectly via the supply chain. These attacks may involve IT service providers or freelancers, as well as software suppliers.

• Challenges resulting in bad application security and implementation: Challenges such as SQL injection or man-in-the-middle attacks should be properly understood and can be easily addressed by suitable software development tactics and good implementation practices. Unfortunately, this topic still needs to be addressed!

Recommendations for providers

• In addition to managed services, many user companies need support with specific tasks such as preparing for audits or introducing new solutions. Precise offers help to significantly shorten the sales cycle in this area.
• Complete outsourcing is not particularly popular among large companies, which prefer support for clearly defined sectors.
• Threats can be extremely dynamic, and attacks are becoming increasingly professional. As a result, there will be increasing demand for appropriate support in defending against potential threats.
• SOC services will become a virtual must-have as a result of NIS2. Service providers should put together appropriate standard offers for medium-sized customers.
• Security must become an integral part of all services offered. Customers are increasingly asking for this, so service providers who can ensure this have a clear advantage.