While 2021 will go down in history for many reasons, one of them is undoubtedly the escalation in the volume and scale of cybersecurity threats.

We’ve seen major events this year, including Microsoft Exchange, Kaseya, the Colonial Pipeline attack, which shut down fuel supplies to the US East Coast, and now the Log4j breach.

Along with this, there have been reports of significant surges in the sheer volume of attacks hitting UK businesses – 14.6 in the first six months of the year, with the number of attacks in Scotland doubling compared to the same period of 2020.

There is little doubt that cybersecurity is not something businesses can ignore. All organisations, large and small, need to ensure robust security to protect themselves from the plethora of threat actors looking to exploit any vulnerability to access vital data or money.

Throughout 2021, we had the opportunity to speak to numerous cybersecurity experts as part of our Leader Insights series. They shared their thoughts on the evolving landscape and provided advice on how groups can stay protected.

TJ Gonen, Head of Cloud Security Strategy at Check Point Software

The last few years have seen the cloud proving itself as a viable business tool, maturing and showing it can handle vast amounts of data while providing a fast, reliable service.

But as more organisations move their operations to the cloud, this presents new security challenges.

All this, Gonen said in his interview with DIGIT, is driving Check Point Software to ramp up investment in its cloud security arm due to the progress of cloud adoption during the pandemic.

He warned that with the cloud moving and changing so rapidly, failure to adapt could see organisations getting left behind.

“These businesses are going to lose. Larger organisations that three or four years ago said ‘we are going to be slow with cloud adoption because of security concerns,’ today one of the reasons they change is because they know that they’re going to be losing a significant competitive advantage if they do not adopt cloud,” he said.

“It’s not even a choice. You have to because your competitor went there and they can move way faster than you with your rigid, non-agile traditional computing infrastructure.”

Jude McCorry, Chief Executive at the Scottish Business Resilience Centre

As a rule, people don’t like to think about bad things happening, especially to them. This can drive organisations to underestimate the threat and likelihood of a cyberattack.

However, it is extremely rare that burying one’s head in the sand is the best strategy. Being proactive and implementing strategies to protect organisations, staff, and customers, McCorry told us, is the best plan.

“There has to be a healthy paranoia to prevent a disaster unfolding,” she said.

In an environment where major cyberattacks can disrupt essential services, ensuring resilience is vital. The attack on the Scottish Environment Protection Agency (SEPA) proves two things – Scotland is not immune to such attacks, and given that SEPA is still recovering from the attack, the consequences can be long lasting.

“This is the kind of thing that keeps me – and others who care – up at night worrying because if a major cyber-attack were to happen, we’d likely be part of the cadre of people to help deal with this,” McCorry says.

“Our biggest fear is obviously our NHS or parts of it being attacked and knocked out, or our critical infrastructure as well. Over the last year, the pandemic has really changed things in that sense.

“We now view certain industry areas or services as being even more vital than before, and that includes vaccine research and rollout.”

Lisa Ventura, CEO at the UK Cyber Security Association

In many regards, cybersecurity is an arms race. Cybercriminals are constantly evolving, using new tools and techniques to break into systems. As such, cybersecurity experts have to evolve with them, staying one step ahead.

Ventura warned that organisations have to act now and be proactive in protecting themselves from cybersecurity threats.

The temptation, however, can be to focus on using tech as a solution. The best line of defence is, ultimately, people – ensuring they are well-trained and aware of threats and weak spots.

“Good security only works when it is well embedded as a culture within an organisation, and that starts from the top,” she says.

“Even with the average cost of a breach reaching an eye-watering £3 million, many organisations still struggle with getting cybersecurity on the boardroom agenda,” Ventura says.

“This in turn leads to critical levels of under-investment in cybersecurity, which leaves organisations wide open to a cyberattack.”

Hatem Oueslati, CEO at IoTerop

The Internet of Things (IoT) is not a new concept, but in the last few years it has come into its own. Smart devices, gathering and sharing data, and even making autonomous decisions are everywhere – watches, fridges, doorbells, smart assistants, even children’s toys, to name a few.

The technology hasn’t even reached its full potential. Experts talk of smart cities, where vast data feeds allow more accurate and targeted decisions to be made concerning traffic, pollution, maintenance, etc.

“[IoT] will change the way our overall industries work because it will impact things like the way that we get electricity, or how gas will reach our houses, or how streetlights are going to be managed and be better for the environment,” Oueslati said.

But these also present security concerns. Many devices are afterthoughts with weak security, representing vulnerabilities to be exploited by cybercriminals.

“You need an end to end security approach. We talk about critical use cases impacting citizens; managing your water; managing your gas; managing your electricity consumption, and we can’t afford to let vulnerabilities jeopardise these things.”