Is it just me or has 2023 been the year of the data breach? Maybe they are just larger or more widely reported. Just seems like there have been a fuck-ton of them this past year.
While true, I’m not convinced that fully explains it. Having been in IT nearly 2 decades I feel like the second piece is cybersecurity budgets getting slashed. A lot of them have been super-basic shit like someone clicking on a malicious link.
Oh for sure, didnt mean to imply it was the only reason.
Spearphishing high-value targets, or even just phishing a company’s email roster are very very common practices because they yield significant results.
Theres also the “insurance approach” to cybersecurity, where its cheaper to run PR for a little while and/or take out insurance policies against cyber attacks such as ransomware. The latter is a key factor as to why many companies dont mind paying the ransom at all.
I don’t think the problem is “we” securing things (we being cybersecurity professionals). I think the problem is companies seeing that it’s cheaper to take the PR hit, pay the ransom, pay for cybersecurity insurance, etc than it is to pay for a properly secured network.
Cybersecurity is hard (citation needed) and costs a lot of money (citation needed). If a company figures it’s cheaper to have a breach and deal with the fallout than it is to properly secure shit I can promise you what will happen.
Profit > Security. These companies don’t care so long as the consequences don’t affect profit significantly enough. Infosec is always an afterthought, if considered at all.
Is it just me or has 2023 been the year of the data breach? Maybe they are just larger or more widely reported. Just seems like there have been a fuck-ton of them this past year.
Hackers-for-hire on the darkweb is big business these days
While true, I’m not convinced that fully explains it. Having been in IT nearly 2 decades I feel like the second piece is cybersecurity budgets getting slashed. A lot of them have been super-basic shit like someone clicking on a malicious link.
Yeah, some youtube videos that cover basics and hiring a firm after a breech is pretty standard it feels.
Oh for sure, didnt mean to imply it was the only reason.
Spearphishing high-value targets, or even just phishing a company’s email roster are very very common practices because they yield significant results.
Theres also the “insurance approach” to cybersecurity, where its cheaper to run PR for a little while and/or take out insurance policies against cyber attacks such as ransomware. The latter is a key factor as to why many companies dont mind paying the ransom at all.
I bet 2024 will have more. More stuff is online and we don’t seem to be getting any better at securing it.
I don’t think the problem is “we” securing things (we being cybersecurity professionals). I think the problem is companies seeing that it’s cheaper to take the PR hit, pay the ransom, pay for cybersecurity insurance, etc than it is to pay for a properly secured network.
Cybersecurity is hard (citation needed) and costs a lot of money (citation needed). If a company figures it’s cheaper to have a breach and deal with the fallout than it is to properly secure shit I can promise you what will happen.
As always, follow the $$$.
Profit > Security. These companies don’t care so long as the consequences don’t affect profit significantly enough. Infosec is always an afterthought, if considered at all.