The 3 most common cybersecurity challenges faced by companies in Asia

Asia Pacific is the new “ground zero” for cybercrime.

Organisations in the region experienced 1,835 attacks per week in the first quarter of 2023, in contrast with the global average of 1,248 attacks per week. Last year, Asia Pacific had the most cybercrime activity for the second year running, accounting for 31% of attacks globally.

As digitalisation continues to sweep the region, cybercriminals will increasingly target Asia.

An IBM study reports that the cost of a data breach in Southeast Asia this year averages over US$3 million per incident – a 6% uptick from 2022 and a number that’s expected to continue rising.

When the stakes are this high, it’s important that organizsations understand the best approaches to mitigating and managing cybersecurity vulnerabilities. According to Ragaru, it boils down to three issues.

1. Human error and social engineering

One of the most common vulnerabilities is, in Ragaru’s words, “the thing between the screen and the chair.”

Human error is inevitable. Employees can mistakenly send confidential information to the wrong people or set weak passwords that can easily be guessed by bad actors.

Social engineering is more nefarious. This is when external attackers convince people to hand over private information and credentials, most commonly through malware, ransomware, and phishing attacks. In Singapore, for example, roughly US$10 million was lost due to phishing scams involving OCBC Bank in 2022.

One solution is to educate employees on social engineering and basic cybersecurity techniques. This is why whenever Hackuity builds a security program for new clients, it always starts with educating stakeholders on how to address vulnerabilities.

Ragaru also brings up another approach: least privilege access control, or limiting account privileges only as users need them to help IT teams spot anomalous activity more quickly.

“If everyone has access, it’s difficult for IT teams to monitor who is accessing what and who has a right to what information,” he explains.

2. A lack of cybersecurity talent

While minimizing human error is a company-wide effort, more work needs to be done to boost cybersecurity expertise as a whole across the region. A lack of trained cybersecurity professionals in many parts of Asia means companies are often unprepared for countering advanced threats.

According to research by ISC2, Asia Pacific recorded a 15.6% increase in cybersecurity professionals in 2022. However, the region is still lacking an estimated 2.2 million trained employees in the sector.

It’s this gap that puts organizations at risk. According to Ragaru, when even IT personnel underestimate how aggressive and stealthy cyberattacks can be, “this can contribute to a very important kind of vulnerability like not updating programs, software, and patches.”

As a result, company servers and systems are at risk. In the case of attacks, many IT teams are unable to respond appropriately, from detecting and containing attacks to enforcing data restoration, offsite backups, or system reconstitution. This results in large costs to business operations.

Organisations should invest in regular training and certification of their IT teams and cybersecurity employees, Regaru advises.

“You need experts who can prevent and respond to cyberattacks, who are aware of the threats out there,” he points out.

3. Too many tools

Fragmented cybersecurity, or the use of many different tools and services, might sound like a good idea – multiple layers of protection, right? According to a report by Oracle and KPMG, 78% of organisations globally use more than 50 cybersecurity products in their operations.

But this hardly translates to stronger security. In Ragaru’s view, throwing patchwork solutions together creates more risk than good, making it difficult for IT teams to identify and prioritise more serious threats through the “noise.”

“The consequence is a huge volume of vulnerabilities that are collated, overlapped, and described in different ways and different models from different tools,” he explains.

It’s the primary reason why he launched Hackuity, which serves around 50 clients in Europe and Asia such as Bolttech, Thales, BNP Paribas, and Danone.

The platform aggregates data from clients’ existing cybersecurity tools, such as vulnerability scanners and penetration testing, into a “single pane of glass,” creating a unified dashboard where they can see the cybersecurity health of the organisation at a glance.

Instead of having to manually check alerts across different platforms, Hackuity’s clients can access the information via this dashboard, reducing time spent on identifying vulnerabilities and avoiding the risk of having overlapping or contradictory information.

The platform automatically prioritizes the threats detected according to a company’s needs and requirements, helping automate the remediation process through the same tools companies already use, such as market-leading scanners and patch management services.

This is critical as companies need to be able to prioritize fixing intolerable vulnerabilities that can cause significant damage to their operations.

“For example, if you are a financial company, you have some assets that are more important than others, so vulnerabilities linked to those important assets will be your primary priority from any incoming dangerous ransomware,” Ragaru explains.

Innovation needed to tackle Asia’s cybersecurity crunch

As Asia’s digital economy continues to grow, so will its cyber threat landscape. Firms must develop a better understanding of the risks they face and make concerted efforts around education, processes, and technologies to stay ahead of bad actors.

Ragaru envisions that emerging technologies will play a central role in combating cyberthreats in the region.