Too much spent on shiny kit, not enough on detecting and responding to breaches…:
[…] According to ESI ThoughtLab, there is evidence that, while companies are certainly investing in cybersecurity, without proper ROI analysis, their investments may be a bit misaligned or misplaced. Take, for example, investment in risk prevention. The largest chunk of cybersecurity investments (26.5 percent) is going to protection, rather than response and recovery initiatives. The latter two, Celi explained, contribute to a company’s resiliency, to react quickly and efficiently when a breach does occur.
“You have to put more effort into not just predicting a risk — you can’t predict a Black Swan event, but you have to have resilience built in,” he said.
It’s part of the broader understanding that, while companies may throw money at preventing a cyberattack, such an event is next to inevitable. In a conversation with Kevin Mitnick, a notorious U.S. hacker, Celi said Mitnick simplified the current cybersecurity situation.
“Lou, there’s always a way in,” Mitnick told Celi.
The point he was trying to make, Celi elaborated, is that businesses must invest in their agility to respond after they’ve been breached, and not only in their ability to prevent the breach in the first place.