Microsoft commissioned Frost & Sullivan to conduct a study on cybersecurity threats in Asia Pacific and the Philippines which aims to provide business and IT decision makers with insights on the economic cost of cybersecurity breaches in the region and identify the gaps in organizations' cybersecurity strategies.
The study, "Understanding the Cybersecurity Threat Landscape in Asia Pacific: Securing the Modern Enterprise in a Digital World" involved a survey of 1,300 business and IT decision makers ranging from mid-sized organizations with 250 to 499 employees to large-sized organizations with more than 500 employees.
The study revealed that:
- a large-sized organization in the Philippines can possible incur an economic loss of US$7.5 million which is more than 200 times the average economic loss for a mid-sized organization
- cybersecurity attacks have led to job losses in 7 out of 10 organizations over the last year
- cybersecurity concerns delay digital transformation plans
- organizations are increasingly leveraging artificial intelligence to enhance their cybersecurity strategy
Frost & Sullivan has created an economic loss model based on the macro-economic data and insights shared by the survey respondents to calculate the cost of cybercrime. The three kinds of losses which could be incurred due to cybersecurity breach are:
- Direct: Financial losses associated with a cybersecurity incident which includes loss of productivity, fines, remediation cost, etc.
- Indirect: Opportunity cost to organization such as customer churn due to reputation loss; and
- Induced: The impact of cyber breach to the broader ecosystem and economy such as the decrease in consumer and enterprise spending.
Cybersecurity incidents in the Philippines are undermining the organizations' ability to capture future opportunities in today's digital economy with 57% of the respondents stating that their enterprise has put off digital transformation efforts due to the fear of cyber risks.
Key Cyber Threats and Gaps in the Philippines Organizations' Cybersecurity Strategies
High profile cyber attacks like ransomware have been garnering a lot of attention from enterprises but for the organizations in the Philippines that have encountered cybersecurity incidents, data exfiltration and data corruption are the biggest concern as they have the highest impact with the slowest recovery time.
Aside from the external threats, the study revealed key gaps in organizations' cybersecurity approach.
- Security an afterthought: Only 44% of organizations consider cybersecurity before the start of a digital transformation project. Majority of respondents either think about cybersecurity only after they start on the project or do not consider it at all. This limits their ability to conceptualize a deliver a "secure-by-design" project, potentially leading to unsecured products going out in the market;
- Creating a complex environment: Negating the popular belief that deploying a large portfolio of cybersecurity solutions will render stronger protection, the survey revealed that 17% of respondents with more than 50 cybersecurity solutions could recover from cyber attacks longer compared with 38% of respondents having fewer than 10 cybersecurity solutions that can recover within an hour.
- Lacking cybersecurity strategy: While more organizations are considering digital transformation to gain competitive advantage, the survey has shown that 46% see cybersecurity strategy only as a means to safeguard the organization against cyber attacks rather than a strategic business enabler.
Artificial Intelligence (AI) is the Next Frontier in Cybersecurity Defense
 |
| Speakers (L-R) Mr. Hans Bayaborda, Managing Director Microsoft Philippines; Ms. Mary Jo Schrade, Assistant General Counsel Microsoft Asia Digital Crimes Unit; Mr. Angel Averia Jr. President Philippine Computer Emergency Response Team; Atty. Raul Cortez Corporate, External, and Legal Affairs (CELA) Lead Microsoft Philippines |
Cyber threats are constantly evolving and attack surface is rapidly expanding. AI is becoming a potent opponent against cyber attacks as it can detect and act on threat vectors based on data insights. The study revealed that 79% of the organizations in the Philippines have either adopted or are looking to adopt an AI approach towards boosting cybersecurity.
The ability of AI to rapidly analyze and respond to unprecedented quantities of data is becoming indispensable in a world where cyber attacks' frequency, scale and sophistication continue to increase. An AI driven cybersecurity architecture will be more intelligent and more equipped with predictive abilities to allow organizations to fix and strengthen their security posture before problems emerge. It will also grant companies with the capabilities to accomplish tasks such as identifying cyber attacks, removal of persistent threats and fixing bugs faster than any human could thus making it an increasingly vital element of any organizations' cybersecurity strategy.
Recommendations for securing the modern enterprise in a digital world
Artificial Intelligence is only one of the many aspects that organizations need to incorporate or adhere to in order to maintain a robust cybersecurity posture. For a cybersecurity practice to be successful, organizations need to consider People, Process and Technology, and how each of these contributes to the overall security posture of the organization.
In order to help the organizations better withstand and respond to cyber attacks and malware infections, here are the five cybersecurity best practices recommendations:
- Cybersecurity as a Digital Transformation Enable: Disconnect between cybersecurity practices and digital transformation effort creates a lot of frustration for the employees. Cybersecurity is a requirement for digital transformation to guide and keep the company safe through its journey. Digital transformation presents an opportunity for cybersecurity practices to abandon aging practices to embrace new methods of addressing today's risks
- Invest to Strengthen Security Fundamentals: Over 90% of cyber incidents can be averted by maintaining the most basic best practices. Maintaining strong passwords, conditional use of multi-factor authentication against suspicious aunthentications, keeping device operating systems, software and anti-malware protection up-to-date and genuine can rapidly raise the bar against cyber attacks.
- Maximize Skills and Tools with Integrated Best of Suite Tools: The best tools are useless in the hands of the amateur. Reduce the number of tools and the complexity of your security operations to allow your operators to hone their proficiency with the available tools. Prioritizing best-of-suite tools is a great way to maximize your risk coverage without the risk of introducing too many tools and complexity to the environment.
- Continuous Assessment, Review, and Compliance: The organization should be in a continuous state of compliance. Assessments and reviews should be conducted regularly to test for potential gaps that may occur as the organization is rapidly transforming and address these gaps. The board should keep tab not only on compliance to the industry regulations but also on how the organization is progressing against security best practices; and
- Leverage AI and Automation to Increase Capabilities and Capacity: With the security capabilities in short supply, organizations need to look at automation and AI to improve their security operations. Current advancements in AI are promising not only in raising detection level that would otherwise be missed but also in reasoning over how various data signals should be interpreted.
To better undestand the cyber threats happening globally and in Asia Pacific, download the Microsoft Security Intelligence Report Volume 23 at