Closing the skills gap: how can businesses level up their cybersecurity?

For many employ­ees, the shift to home work­ing has removed the need for the dai­ly com­mute and cre­at­ed a bet­ter work/life bal­ance. But employ­ees are not the only ones to ben­e­fit from recent changes in the way peo­ple work.

Cyber attacks surged dur­ing the pan­dem­ic as hack­ers took advan­tage of increased dig­i­tal activ­i­ty, with over 5,200 data breach­es con­firmed glob­al­ly in 2021 so far – a sharp increase on the 3,950 report­ed in the whole of 2020. Giv­en that data breach­es often result in sig­nif­i­cant mon­e­tary fines and severe rep­u­ta­tion­al dam­age, no busi­ness can afford to ignore this rise in mali­cious activ­i­ty. Yet a sur­vey by Cen­suswide on behalf of IONOS Cloud, Europe’s lead­ing provider of cloud infra­struc­ture and cloud ser­vices, found that over 40% of IT deci­sion-mak­ers believe their busi­ness has a cyber­se­cu­ri­ty skills gap, with a third admit­ting this gap is putting their organ­i­sa­tion at risk of secu­ri­ty threats.

Wor­ry­ing­ly, a quar­ter of those sur­veyed also stat­ed that their organ­i­sa­tion is not adher­ing to nec­es­sary leg­is­la­tion. “These sta­tis­tics are shock­ing,” says Achim Weiss, CEO of IONOS. “They show how vul­ner­a­ble organ­i­sa­tions could be – both to cyber threats, and mon­e­tary fines.”

While the skills gap is a clear issue, many busi­ness­es do recog­nise the impor­tance of cyber­se­cu­ri­ty, with more than three-quar­ters of IT deci­sion-mak­ers from across the man­u­fac­tur­ing, health­care and insur­ance sec­tors say­ing it is either the top pri­or­i­ty (34%) for their busi­ness or with­in the top three (42%).

How­ev­er, when asked about cyber­se­cu­ri­ty risk assess­ments, there was a real dis­par­i­ty among the respons­es. Remark­ably, only a third of those sur­veyed have con­duct­ed a threat analy­sis in the past 12 months, while 12% have nev­er con­duct­ed one and don’t plan to. This demon­strates a lack of under­stand­ing regard­ing the impor­tance of pre­ven­ta­tive risk mon­i­tor­ing, which can high­light secu­ri­ty issues so they can be addressed before an inci­dent aris­es.

Fail­ing to iden­ti­fy and resolve these issues can have cat­a­stroph­ic reper­cus­sions – par­tic­u­lar­ly giv­en the num­ber of ways that data breach­es can occur today. When asked to iden­ti­fy the biggest threats to their busi­ness, respon­dents cit­ed increased DDoS attacks, phish­ing and scam attacks, employ­ees down­load­ing unap­proved apps and employ­ees stor­ing data improp­er­ly. So why aren’t busi­ness­es doing more to pro­tect them­selves from these threats?

“What’s clear from the new insights is that busi­ness­es under­stand the impor­tance of both cyber­se­cu­ri­ty and data pro­tec­tion, but miss­ing skillsets are leav­ing organ­i­sa­tions extreme­ly vul­ner­a­ble,” says Weiss. “That’s why it’s vital com­pa­nies put mea­sures in place to plug these gaps, and don’t hes­i­tate to work with exter­nal exper­tise to ensure busi­ness­es are pro­tect­ed.”

Building expertise

Despite any skills gap they might have, eight in 10 respon­dents to IONOS’s sur­vey still believe they are pre­pared to han­dle a cyber attack – large­ly due to invest­ment in more secure cloud ser­vices.

Care­ful­ly planned and con­fig­ured cloud deploy­ments pro­vide scal­able, flex­i­ble, and secure oper­a­tions for busi­ness­es. Exter­nal cloud providers, work­ing with IT teams to imple­ment a strat­e­gy that is tai­lored to spe­cif­ic busi­ness needs, also offer an extra lay­er of defence and addi­tion­al knowl­edge on ever-evolv­ing cyber threats.

It is essen­tial that senior lead­ers under­stand how cloud providers can pos­i­tive­ly impact data man­age­ment and cyber­se­cu­ri­ty. “This aware­ness allows you to have more informed and con­sid­ered con­ver­sa­tions when choos­ing exter­nal providers, allow­ing you to work with IT leads to put effec­tive, cohe­sive strate­gies in place,” says Weiss.

As well as employ­ing the right exter­nal exper­tise, senior lead­ers must also work close­ly with their teams to iden­ti­fy where cyber­se­cu­ri­ty knowl­edge gaps exist and cre­ate a plan to address them. In fact, a third of those sur­veyed said that because senior lead­er­ship had put more focus on cyber­se­cu­ri­ty, they felt more pre­pared to han­dle a cyber attack.

In addi­tion, “IT teams must feel con­fi­dent and trust that senior lead­ers will lis­ten when they raise con­cerns on how skills gaps are impact­ing the busi­ness,” says Weiss. Bian­nu­al plan­ning meet­ings can pro­vide an oppor­tu­ni­ty to review skills across the busi­ness and get this con­ver­sa­tion flow­ing. Once gaps have been suc­cess­ful­ly iden­ti­fied, staff can then be upskilled – or new team mem­bers hired – to plug them.

It’s impor­tant that senior lead­ers also show a will­ing­ness to learn new skills them­selves. “Engag­ing and tak­ing an inter­est in under­stand­ing the impact and pos­si­bil­i­ties of new tech on the busi­ness will show teams that this is a busi­ness issue you’re tak­ing seri­ous­ly,” Weiss explains.

Data protection

Strong secu­ri­ty pro­ce­dures are essen­tial for adher­ing to increas­ing­ly strict data pro­tec­tion laws. Near­ly 60% of busi­ness­es sur­veyed said they are putting more focus on adher­ing to data pro­tec­tion, com­pared to before the pan­dem­ic. How­ev­er, 13% are actu­al­ly giv­ing it less atten­tion, with almost half of these cit­ing time pres­sures and work­load as the main rea­sons why they strug­gle to ensure the busi­ness is up-to-date with the lat­est leg­is­la­tion.

Although time con­straints are under­stand­able while busi­ness­es deal with fall­out from the pan­dem­ic, few of them can afford to let data pro­tec­tion take a back­seat. Indeed, with the Infor­ma­tion Com­mis­sion­er’s Office set­ting sig­nif­i­cant mon­e­tary fines for breach­es to GDPR law, busi­ness­es must ensure they are ful­ly aware of com­pli­ance pro­ce­dures and the lat­est leg­isla­tive require­ments when han­dling per­son­al data.

“When it comes to data pro­tec­tion, action must be tak­en to bridge knowl­edge gaps,” says Weiss. “IT teams are under great pres­sure to adhere to the lat­est leg­is­la­tion, but one way to help min­imise risk when it comes to data is to work with Euro­pean-based cloud providers that adhere to GDPR – rather than those that must also work under laws such as the US CLOUD Act.”

Any suc­cess­ful solu­tion to the cyber­se­cu­ri­ty skills gap must also involve every­one in the busi­ness – not just over­stretched IT teams. As Weiss says, “While fac­tor­ing in improved soft­ware with bet­ter cyber­se­cu­ri­ty mea­sures is a sound way to pro­tect the busi­ness at a strate­gic lev­el, hav­ing open dia­logue with employ­ees across all lev­els means cyber­se­cu­ri­ty and data pro­tec­tion knowl­edge is shared and best prac­tices are front of mind at all times.”

To learn more about IONOS Cloud, vis­it: ionos.cloud/futurecio

Spon­sored by

IONOS