Cyber security M&A intensifies as attacks increase

BY Fraser Tennant

Cyber attacks continue to be one of the most dangerous threats to businesses in all industries, with their number and complexity growing rapidly, according to a new report by Hampleton Partners.

In addition to this rapid increase, global digitalisation, new regulations, high-profile incidents and new technologies have led to an increasing number of cyber security acquisitions over the past two years, with deal volume well above those typically seen for enterprise software or IT services.

Setting the tone for an uptick in deal volume  and continuously strong valuations was the cyber security sector’s largest ever deal: Broadcom’s landmark acquisition of Symantec for $10.7bn in August 2019.

In its ‘M&A market report 2H 2019: Cybersecurity’, Hampleton Partners cites three key trends impacting the race to secure cyber security vendors: (i) an exponential increase in the number of devices connected to enterprise Internet of Things (IoT) networks, providing potential entry points for cyber attackers; (ii) growing volumes of personal data that needs to be secured; and (iii) mounting regulatory and financial penalties for cyber insecurity.

“The number of cyber attacks, as well as their complexity, is growing rapidly,” said Axel Brill, a director at Hampleton Partners. “Cyber security vendors will have to move quickly to keep ahead of malware and hackers.

“Cyber attacks are some of the most dangerous threats for businesses across all sectors and industries, demanding management time and increased investment in technologies like artificial intelligence (AI) to protect against vulnerabilities,” he continued. “There is no doubt that AI-focused cyber security vendors will be the most sought-after future M&A targets in this sector.”

The report also notes that cyber security transaction volume rose by 15 percent in the second-half of 2019 compared to 2H 2017. Valuations have also remained healthy, significantly above those seen in the wider enterprise software space.

Report: M&A market report 2H 2019: Cybersecurity

Bridging the cyber skills gap

BY Richard Summerfield

The current cyber security workforce must grow by 145 percent if the industry is to close the skills gap and better defend organisations worldwide, according to the 2019 (ISC)² Cybersecurity Workforce Study.

The report, which was designed to estimate the total current number of cyber security professionals in the US and 10 other major global economies, suggests that while most cyber security and IT professionals in the market are largely satisfied with their career and remain optimistic about their future in the industry, there is a substantial gap between the number of cyber security professionals working in the field and the number needed to keep organisations safe.

Understandably, the gap is not the same across all markets. In the US, for example, the current cyber security workforce estimate is 804,700 and the shortage of skilled professionals is 498,480, requiring an increase of 62 percent to better defend US organisations. The study is based on online survey data from 3237 individuals responsible for security or cyber security throughout North America, Europe, Latin America and Asia-Pacific.

“We’ve been evolving our research approach for 15 years to get to this point today, where we can confidently estimate the current workforce and better understand what it will take as an industry to add enough professionals to protect our critical assets,” said Wesley Simpson, chief operating officer at (ISC)². “Perhaps more importantly, the study provides actionable insights and strategies for building and growing strong cybersecurity teams. Knowing where we stand and the delta that needs to be filled is a powerful step along the pathway to overcoming our industry’s staffing challenges.”

According to the report, 65 percent of organisations suffer from a shortage of cyber security staff and a lack of skilled or experienced cyber security personnel is the top job concern among respondents.

If organisations are to close the skills gap, they must not only look to train and develop existing employees, but also attempt to recruit individuals from outside the industry.

Report: 2019 (ISC)² Cybersecurity Workforce Study

No silver lining?

BY Richard Summerfield

There has been a lot of talk around the potential of cloud computing. The cloud is often heralded as the future of many organisations as it will fundamentally alter business strategies. Yet, maintaining security in the cloud is a challenging and contentious issue.

Indeed, many security professionals consider their existing tools to be inadequate for securing critical cloud data, even as their organisations invest heavily and with increasing speed in cloud applications, according to a new report from ESG.

The report, ‘Retooling CyberSecurity Programs for the Cloud-First Era’, based on surveys with responses ranging from approximately 392-600 senior IT decision makers and cyber security professionals, suggests that there is a security gap in cloud computing which is both wide and dangerous.

Though cloud-first strategies are becoming more common, 81 percent of respondents said their on-premises data security practices are more advanced than those intended to secure cloud-based data. Furthermore, 50 percent of respondents say that their organisation has lost cloud-resident data.

Ninety percent of respondents are concerned about not having visibility into misconfigured cloud services, server workloads, network security or privileged accounts. Eighty-three percent of respondents also stated they had concerns about the misuse of privileged accounts by insiders. Thirty-five percent say that the use of multiple cyber security controls has increased complexity and 66 percent say IT is more complex than it was two years ago.

Forty-three percent of respondents cited maintaining consistency across the disparate infrastructures of hybrid, multi-cloud environments where cloud-native apps are deployed as the biggest challenge in securing cloud-native apps, and 43 percent of respondents said that DevSecOps automation is the highest cloud security priority to address many of these concerns.

“The cloud is no longer merely a backup target – it’s now the center of computing gravity for many businesses,” said Doug Cahill, ESG’s Cybersecurity Group Director and Senior Analyst. “Cloud-first strategies are becoming more common, and yet security capabilities are lagging behind cloud adoption. The gap between the degree to which cloud services and cloud-native technologies have and will continue to be consumed and organizational readiness to secure that usage requires a retooling of cybersecurity programs to keep pace with the speed of the cloud era.”

Report: Retooling CyberSecurity Programs for the Cloud-First Era

Cloud container vulnerabilities increase – report

BY Richard Summerfield

Adoption of cloud technology has increased considerably in recent years, however vulnerabilities in cloud containers have also increased, according to a new report from Skybox Security.

Skybox’s ‘2019 Vulnerability and Threat Trends Report: Mid-Year Update’ notes that vulnerabilities in cloud containers have increased by 46 percent compared to the same period in 2018, and by 240 percent compared to 2017,. However, less than 1 percent of newly published vulnerabilities were exploited in the wild, with 9 percent having any functioning exploit developed at all.

Over the last two years, the total number of new vulnerabilities has outpaced any other previous year. However, the number of vulnerability reports in the first half of 2019 declined by 13 percent compared to the same period last year. Still, the current figures are historically high, and it seems annual totals of around 15,000 new common vulnerabilities and exposures (CVEs) will be the new norm.

“More than 7000 new vulnerabilities were discovered in the first half of 2019 — that’s still significantly more than figures we’d see for an entire year pre-2017. So, organisations are likely still going to be drowning in the vulnerability flood for some time,” said Ron Davidson, chief technology officer and vice president of research and development at Skybox. “Roughly a tenth of these have an exploit available and just one percent are exploited in the wild. That’s why it’s so critical to weave in threat intelligence into prioritization methods, and of course consider which vulnerable assets are exposed and unprotected by security controls.”

To better protect themselves against attack, the report suggests that companies “assess occurrences against the latest threat intelligence, as well as the relationship of vulnerable assets to the security controls that could protect them. This way, action will be focused on the small subset of vulnerabilities posing a critical risk to your business.”

Organisations should ensure that they have reliable coverage to assess and prioritise vulnerabilities in public and private clouds and operational technology systems to truly understand the risks they face.

The report also noted that cryptocurrency ransomware, botnets, and backdoors appear to have substituted cryptocurrency mining malware as a tool of choice for cyber criminals. The use of these methods increased by 10 percent, 8 percent and 18 percent respectively.

Report: 2019 Vulnerability and Threat Trends Report: Mid-Year Update

British Airways faces record GDPR fine

BY Richard Summerfield

British Airways is to be fined £183.39m by the UK’s Information Commissioner’s Office (ICO) for data protection breaches.

The fine, as set forth by the ICO, will be the largest penalty handed down since the implementation of the European Union’s (EU’s) General Data Protection Regulation (GDPR). The regulator said the company will have a chance to contest the proposed fine, which is roughly 1.5 percent of airline’s annual revenue of £11.6bn worldwide in 2018, well below the maximum rate of 4 percent that can be applied under the GDPR.

According to the ICO, weak security on the airline’s website allowed users to be diverted away to a fraudulent page, starting in June 2018. The ICO’s investigation found that the incident involved customer details including login, payment card, name, address and travel booking information of around 500,000 users had been harvested.

“People’s personal data is just that – personal,” said Information Commissioner Elizabeth Denham. “When an organisation fails to protect it from loss, damage or theft it is more than an inconvenience. That’s why the law is clear – when you are entrusted with personal data you must look after it. Those that don’t will face scrutiny from my office to check they have taken appropriate steps to protect fundamental privacy rights.”

British Airways, which has subsequently improved its security protocols, has said it will fight the ruling. The airline can appeal against the findings and scale of the fine before a final decision by the ICO. “We are surprised and disappointed in this initial finding from the ICO,” said Alex Cruz, the chair and chief executive of British Airways. “British Airways responded quickly to a criminal act to steal customers’ data. We have found no evidence of fraud/fraudulent activity on accounts linked to the theft. We apologise to our customers for any inconvenience this event caused.”

The ICO noted: “British Airways has cooperated with the ICO investigation and has made improvements to its security arrangements since these events came to light. The company will now have opportunity to make representations to the ICO as to the proposed findings and sanction.”

News: British Airways faces record 183.4 million pounds fine over data theft