When news of a major data breach makes the headlines, attention naturally turns to what information has been stolen, and who has been affected. However, the impact of a breach can extend beyond the loss of data. Cyber incidents reasonably undermine the confidence that customers place in organisations, eroding trust and damaging customer loyalty. In some cases, the consequences have a significant tailwind, continuing long after systems have been secured, with customers remaining wary of how their information is being used.
This is exactly the challenge facing the Manchester Airport Group, which suffered a major data breach at the end of August. In the attack, a range of customers’ contact information was reportedly compromised, from email addresses, phone numbers, postcodes, and vehicle registrations. Now in possession of this data, attackers can launch highly targeted social engineering scams. Not only does this lead to fear and scepticism among many, but it also raises the question of how organisations can identify the threat before it develops into a major incident.
Visibility allows no room for blind spots
The key to spotting unusual behaviour, and acting on it before it becomes a national headline, starts with one thing: visibility. By maintaining a complete view of IT environments, security teams are better equipped to identify potential threats and respond proactively.
However, multiple platforms, tools and cloud providers, can quickly lead to the fragmentation of data for many organisations, creating a significant visibility challenge. This allows for blind spots that make it harder to track activity, understand where sensitive data resides, and identify who is accessing it – allowing for malicious activity to take place. Continuous monitoring and visibility are crucial to preventing this, providing warning signs that allow security teams valuable time to intervene before disaster strikes.
Behavioural analytics: knowing what ‘normal’ is
Behavioural analytics further strengthens this visibility, by ensuring organisations understand what ‘normal’ activity looks like across their IT environments. By continuously analysing behaviour, organisations can then detect anomalies that may indicate a security threat. Eg: spotting unusual file access and outbound traffic to external Ips, or detecting excessive file access. Since attackers are increasingly able to blend into everyday business activity, behavioural analytics provides an additional layer of intelligence, and helps distinguish genuine threats from day-to-day operations.
Intelligence beyond your network
Vitally, visibility should also extent beyond the organisations own systems. Dark web intelligence can help inform security teams if any sensitive information, employee credentials, or financial information is circulating the hidden underbelly of the internet. By detecting this, it allows organisations to act quickly before attackers can weaponise the exposed information; and may be the difference between a minor security incident, and a full scale major cyber-attack.
Building resilience before crisis hits
What happened to Manchester Airport Group is just one example of the growing threat businesses face in this rapidly evolving cyber landscape. This incident was not an exception; it is increasingly becoming the norm. As cyber-attacks continue to gain in pace and sophistication, organisations must accept that resilience is just as important as prevention. This means prioritising and investing in visibility, continuous monitoring, behaviour analytics, and threat intelligence; strengthening the ability to detect and recover. In doing so, organisations can not only better protect their data, but preserve the trust from customers, which is far harder to regain once lost.
Join our LinkedIn group Information Security Community!
