Although not a complete picture, as data can be hard to come by and validate, researchers over at Bromium have estimated cybercrime to reach an unbelievable cost of about $1.5 trillion dollars. Take the numbers with a grain of salt, but the breakdown does give some understanding of the growing problem we face. Even if it were a tenth of this amount, it is enough to bring in flocks of burgeoning criminals to explore how they can get a piece of this pie. For organized criminals, it is worthy of doubling efforts to push this number further, making other illicit avenues of revenue pale in comparison.
For cybersecurity professionals, realize the sheer weight and momentum we must undermine. Attackers are not going away, not sitting idly by, and not giving up regardless of the controls you institute. We must be smarter and act in coordination against the tidal wave that will continue to roll-in. This is a long-game scenario. Dig in.
Tactics are fine for daily activities, but they don't win such wars. Strategic thinking is necessary.
The immense financial rewards as a motivator to cyber criminals is just another piece of the bigger picture that requires bigger thinking. As for me, I am contemplating writing up a series of blogs or potentially even a longer periodical to discuss the strategic challenges and avenues which hold the best promise. A few colleagues have asked for a book on the subject. Over my career, spanning the better part of three decades, I have spent an inordinate amount of time thinking in these terms and have witnessed how almost every business, organization, sector, and government still needs real help to organize in a way so their cybersecurity program is structured to be 'sustainable'. That is, to be effective over the long term, while not overly costly, or burdensome for customers. It is a fine balance that must be flexible to align with ever changing attacks and growing threats.
Creating fixed-fortifications is, as General Patton once said, is a monument to man's stupidity. Adaptability with insights to how adversaries will maneuver in the future, is key. "Know your enemy and know yourself" (Sun Tsu) is the mantra for the next decade and beyond for securing our digital world.
Matthew Rosenquist is an industry-recognized pragmatic, passionate, and innovative strategic security expert with 28 years of experience. He thrives in challenging cybersecurity environments and in the face of ever shifting threats. A leader in identifying opportunities, driving industry change, and building mature security organizations, Matthew delivers capabilities for sustainable security postures. He has experience in protecting billions of dollars of corporate assets, consulting across industry verticals, understanding current and emerging risks, communicating opportunities, forging internal cooperation and executive buy-in, and developing practical strategies. Matthew is a trusted advisor, security expert, and evangelist for academia, businesses, and governments around the world. A public advocate for best-practices, and communicating the risks and opportunities emerging in cybersecurity. He delivers engaging keynotes, speeches, interviews, and consulting sessions at conferences and to audiences around the globe. He has attracted a large social following of security peers, is an active member on advisory boards, and quoted in news, magazines, and books. Matthew is a recognized industry expert, speaker, and leader who enjoys the pursuit of achieving optimal cybersecurity. Matthew Rosenquist is experienced in building world class teams and capabilities, managing security operations, evangelizing best-practices to the market, developing security products, and improving corporate security services.