The Digital Defense Report 2023, the organisational view
Nov 22nd, 2023 by Jesper Kråkhede
The same report, read with management´s eyes.
One theme stands out for me this year, and it fits what I have been writing about all year: resources. The report notes that a large share of organisations hit by human operated ransomware are small and medium sized, with only a few hundred employees. They are targeted not because they are valuable, but because they are easy. Small IT teams, no SOC, little time for anything beyond keeping things running.
The report also ends with a clear message: the world needs more cybersecurity professionals. There aren´t enough of us, and the gap isn´t closing fast enough.
What does that mean for an organisation? First, accept that you can´t do everything yourself. Use managed services, partners and the security built into the platforms you already pay for. Second, focus. If basic hygiene stops 99 % of attacks, make sure your limited resources go there first. Third, invest in people. Train your IT staff in security, even if they aren´t security specialists. A little knowledge in the right place goes a long way. Fourth, collaborate. Share information with others in your sector. Small municipalities and companies face the same attackers and can help each other.
Last December I spent half my birthday helping one of those small organisations. I wish they didn´t need it.
Nobody can do security alone. Nobody should have to.