With digitalisation penetrating all spheres of life it is not surprising that cyber security is a growing concern at every level, from the individual to the national governments, who are responsible for the safety and wellbeing of their citizens, and for stable and secure information infrastructure enabling undisturbed public life and business.

It is really disturbing that many of the benefits of information technology for business, for the citizens, and also for the governments, are coming under pressure by the threats of cyber security.

How can we defend ourselves against cybercrime? Though definitely not easy, but we simply have to organise ourselves at all levels, pay much more attention to security and thereby reduce the possibilities for those who (for whatever reason) want to penetrate into our cyberspace for malicious purposes.

What it is?

Information security is a general term for the way organisations and individuals protect their valuable assets – whether business records, personal data, intellectual property, etc. These data are stored in many ways – for example, they can be physical files, on servers and hard drives, in the Cloud or on personal devices. The ways you protect it will differ; you can’t apply the same defense mechanisms for paper records as you would with digital files. The former should be kept in a drawer and only accessible to approved personnel, whether that’s by placing the files in a locked room or by locking the drawer itself. By contrast, digital files require technological defenses, such as access controls to ensure that only approved users can view them. Information security refers to the overall practice of protecting personal data and the approaches to achieve that.

Cyber security is a specific type of information security that refers to the ways that organisations protect digital information, such as networks, programs, devices, servers and other digital assets. Cyber security is the practice of defending computers, servers, mobile devices, electronic systems, networks, and data from malicious attacks. It is also known as information technology security or electronic information security. Cyber security refers to the body of technologies, processes, and practices designed to protect networks, devices, programs, and data from attack, damage, or unauthorized access. Cyber security may also be referred to as information technology security. The term applies in a variety of contexts, from business to mobile computing, and can be divided into a few common categories.

  • Network security is the practice of securing a computer network from intruders, whether targeted attackers or opportunistic malware.
  • Application security focuses on keeping software and devices free of threats. A compromised application could provide access to the data it is designed to protect. Successful security begins in the design stage, well before a program or device is deployed.
  • Information security protects the integrity and privacy of data, both in storage and in transit.
  • Operational security includes the processes and decisions for handling and protecting data assets. The permissions users have when accessing a network and the procedures that determine how and where data may be stored or shared while they all fall under this umbrella.
  • Disaster recovery and business continuity define how an organization responds to a cyber-security incident or any other event that causes the loss of operations or data. Disaster recovery policies dictate how the organization restores its operations and information to return to the same operating capacity as before the event. Business continuity is the plan the organization falls back on while trying to operate without certain resources.
  • End-user education addresses the most unpredictable cyber-security factor: people. Anyone can accidentally introduce a virus to an otherwise secure system by failing to follow good security practices. Teaching users to delete suspicious email attachments, not plug in unidentified USB drives, and various other important lessons are vital for the security of any organization.

The threats countered by cyber-security are three-fold:

  • cybercrime includes single actors or groups targeting systems for financial gain or to cause disruption;
  • cyber-attack often involves politically motivated information gathering;
  • cyberterrorism is intended to undermine electronic systems to cause panic or fear.

Challenges to cyber security

For effective cyber security, an organization needs to coordinate its efforts throughout its entire information system. Elements of cyber encompass all of the following.

  • Network security. The process of protecting the network from unwanted users, attacks and intrusions.
  • Application security. Apps require constant updates and testing to ensure these programs are secure from attacks.
  • Endpoint security. Remote access is a necessary part of business, but can also be a weak point for data. Endpoint security is the process of protecting remote access to a company’s network.
  • Data security. Inside of networks and applications is data. Protecting company and customer information is a separate layer of security.
  • Identity management. Essentially, this is a process of understanding the access every individual has in an organization.
  • Database and infrastructure security. Everything in a network involves databases and physical equipment. Protecting these devices is equally important.
  • Cloud security. Many files are in digital environments or “the Cloud”. Protecting data in a 100% online environment presents a large amount of challenges.
  • Mobile security. Cell phones and tablets involve virtually every type of security challenge in and of themselves.
  • Disaster recovery/business continuity planning. In the event of a breach, natural disaster or other event data must be protected and business must go on. For this, you’ll need a plan.
  • End-user education. Users may be employees accessing the network or customers logging on to a company app. Educating good habits (password changes, 2-factor authentication, etc.) is an important part of cybersecurity.

The future

Worldwide, cybercrime cost businesses, government agencies, and consumers, in general, more than $1 trillion in 2020, according to the data analyzed by researchers at Atlas VPN. That is around one percent of the global GDP. While $945 billion was lost to cyber incidents, $145 billion was spent on cybersecurity. Those costs increased by more than 50 percent compared to 2018, when over $600 billion was spent to handle cybercrime. But twenty percent of organizations worldwide have no plans on how to protect against cybercrime events, according to the Atlas VPN report. That leaves a gaping hole in networks for cybercriminals to extend their attack strategies to steal even millions of dollars more.

Pandemia has accelerated organizations' digital transformation. Therefore, the ability to set up workloads in the cloud and get them through compliance and security challenges is in demand, noted Mohit Tiwari, co-founder and CEO at Symmetry Systems. "Part of the reason is that the workloads that had resisted moving to the cloud were exactly the highly regulated ones, and the forced move out of on-site data centers managed by IT staff is driving up demand for cloud-based compliance and security skills."

The world pandemic has hastened cyber intrusions. So has complacency and poor training among office workers and inadequate IT surveillance. Organizations started to train their employees and investing in automation tools to minimize the risks of cyberattacks. Extensive training and around-the-clock manual monitoring are not necessary when the right automation tools can complement the IT staff as they build up their skill set. "IT workers specializing in security need to shift their focus to supporting the new model of business many enterprises are adopting. Some enterprises are shifting their business model to focus on virtual workforce, de-emphasizing the need to secure office networks," O'Connor told TechNewsWorld. IT workers need to change their focus from traditional network security of a campus/office to application security of the work-anywhere model, he continued.

Over the next year, ransomware will continue to be the biggest threat and financial risk to enterprises, observed Joseph Carson, chief security scientist and advisory CISO at Thycotic. Most organizations should be very concerned about ransomware as the biggest cybersecurity challenge and threat, he advised. "Organizations should prioritize to invest in security solutions that help reduce the risks and also plan and test an incident response plan to help ensure the business is resilient to high-risk attacks," he told TechNewsWorld.

Cybercriminals use ransomware to target anyone, any company, and any government including hospitals and transportation industries at a time when they are under extreme pressure, Carson added. "It is a big concern because practitioners need tools they can depend on for detection and defense. By crippling or repurposing the very tools meant to thwart these attempts, the adversaries stand to gain a complete upper hand in the ongoing battle to combat cyber threats," Hoffman told TechNewsWorld.

The trust factor is an internal battle of sorts between security vendors and the corporations hiring them for cyber protection. That trust must be constantly reassessed, suggested Tim Wade, technical director of the CTO Team at Vectra AI. "Strategically, security practitioners must continue to pivot away from preventative-based security architecture into resilience-based security architecture," Wade told TechNewsWorld.

Cybersecurity higher education

One of the often unspoken ways of safeguarding against cybersecurity assaults is through education. This approach goes beyond teaching company workers to be better aware of safe computing ideals. Rather, recruiting the next crop of computer specialists to pursue a degree in cybersecurity. Cybersecurity prospers because so many professionals come from different backgrounds and skillsets, noted Heather Paunet, senior vice president at Untangle. "Groups who are traditionally marginalized in other industries, when pivoting or starting a career in cybersecurity, can benefit from multiple industry-leading organizations offering certification programs," she told TechNewsWorld.

Moreover, the emerging field of cybersecurity is a very viable career path, noted Michael Kaczmarek, vice president of product management at Neustar. Industry reports show that the number of unfilled cybersecurity jobs is expected to grow by 35 percent.

Closing thoughts

While digitalisation contributes enormously to rising productivity in all sectors of business, as well as in public administration, cybersecurity has become a major concern everywhere. This implies a different security culture, additional ITC skills to be taught by many employees, and managers.

With criminal motives people who actually commit cyber-attacks may cause serious economic damage, and even influence inter-governmental relationships – as indicating the US and UK governments – implying that this could be a new form of warfare to be introduced by Russia.

Because of the threat to online safety and national security, cyber security specialists are needed on a large scale to help combat everything from terror attacks to financial disasters. Let us also mention The European Union Agency for Cybersecurity, ENISA has placed Capacity Building as a strategic objective on its new strategy. In this content, ENISA is committed to support and strengthen the enhancement of cybersecurity skills and competence across at all levels, from the non-experts to the highly skilled professionals. In particular, ENISA continues to raise citizens’ awareness of cybersecurity and potential cyber threats (e.g. phishing attacks, botnets, financial & banking frauds, data fraud), providing guidance on good practices to promote safer online behaviour (e.g. cyber-hygiene and cyber-literacy). Furthermore, aligning its actions with the EU’s Digital Education Action Plan, ENISA is promoting and analysing cybersecurity education, in order to tackle the cybersecurity professional shortfall, which represents an issue for both economic development and national security.

Cybersecurity has been adopted as one of the priorities for the Council of the EU for the Slovenian Presidency having started on 1st July 2021.

(Article prepared by prof. dr. Ajda Fošner and prof. dr. Boris Cizelj).

Sources used and further reading

Cezary Banasiński, Marcin Rojszczak, Cybersecurity of consumer products against the background of the EU model of cyberspace protection, Journal of Cybersecurity, Volume 7, Issue 1, 2021.
Ioannis Agrafiotis, Jason R C Nurse, Michael Goldsmith, Sadie Creese, David Upton, A taxonomy of cyber-harms: Defining the impacts of cyber-attacks and understanding how they propagate, Journal of Cybersecurity, Volume 4, Issue 1, 2018.
Wang, Y., Wu, W., Zhang, C. et al. From proof-of- concept to exploitable. Cybersecur Volume 2, Issue 12 2019.
Al-rimy, B.A.S., Maarof, M.A.,Shaid, S.Z.M, Ransomware threat success factors, taxonomy, and countermeasures: A survey and research directions, (Review), Computers and Security, Volume 74, May 2018, 144-166.
E. Halibozek, G.L. Kovacich. (2017). The Manager's Handbook for Corporate Security: Establishing and Managing a Successful Assets Protection Program, 2nd Edition, Kindle Edition.
P. Stenning (2017). Corporate security in the 21st century: Theory and practice in international perspective. Review - Policing and Society: An International Journal of Research and Policy. 27(2).
R. K. Lipperta,K. W. and Rhys Stecklea. (2013). Multiplicities of corporate security: Identifying emerging types, trends and issues. Security Journal. 26(3), 206–221.
Čaleta, D., Radović, V. (2015). Comprehensive approach as "sine qua non" for critical infrastructure protection]. Proceedings of the NATO Advanced Research Workshop on Managing Terrorism Threats to Critical Infrastructure. Challenges for South Eastern Europe.
J. De Groot, What is Cyber Security? Definition, Best Practices & More, 5 October 2020.
L. Irwin, What’s the difference between information security and cyber security?, 10 December 2020.
What is Cyber Security?
The Future Of Cybersecurity.
What Is the Future of Cybersecurity?
The Future of Cybersecurity in 2021 and Beyond.
Cybersecurity in Higher Education: Problems and Solutions.