More than Half of Cyber Threats Not Addressed by Firms in Thailand

Companies in Thailand do not address more than half of the legitimate cyber threat alerts they receive, according to Cisco 2018 Asia Pacific Security Capabilities Benchmark Study, released today.

Among those surveyed, 74 percent say they receive more than 5000 alerts each day. With the number of cyber threats increasing rapidly, the real challenge lies in what comes after the alert is received, and how many are actually investigated.

The study shows that on average just 37 percent of the alerts received are investigated. Of those investigated, on average, 32 percent turn out to be legitimate, of which only 37 percent are acted upon and corrected. This suggests that more work is needed to help companies and security professionals in Thailand to tackle the rapidly evolving cyber threat landscape.

The results of the study highlight the scale of the challenge faced by the companies, with 95 percent respondents saying their organization has suffered a breach in the past year.

Cyberattacks are also having significant financial impact on companies. Among those who suffered an attack in the past year, 74 percent say it cost them US$500,000 or more, while 8 percent say the cost was US$5 million or more. This includes costs from lost revenue, loss of customers, and out of pocket expenses etc.

“Companies need to have the people, processes and technologies in place to identify, block and address cyber threats. Regulators need to help design policies and laws that deter malicious actors from launching such attacks in the country. Finally, we need help from educational institutions to develop local capabilities when it comes to cybersecurity talent,” said Vatusn Thirapatarapong, Managing Director for Thailand and Indochina at Cisco.

Cyber threats are starting to evolve from just targeting IT infrastructure to attacking operational infrastructure, intensifying the challenge for companies. According to the survey, 36 percent of respondents say they have already seen cyberattacks on their operational infrastructure, while 56 percent said they expect similar attacks to take place on them within the next one year.

Given the growing scale of cyber threats, respondents say they expect scrutiny of their security policies to increase over the next one year from all stakeholders, especially their customers who are keen to ensure their data is protected. Among those surveyed, 76 percent say they expect increased scrutiny from customers. Privacy concerns are also delaying sales for the companies, with 77 percent of respondents saying such concerns are adding time to the sales cycle.

It is estimated that an almost instant detection of a cyber security breach within a large enterprise costs the business US$433,000 If detection is delayed by more than a week, this figure triples to an average US$1,204,000.

Based on the findings of the survey, the study has made a series of recommendations that will provide companies with more actionable visibility into the threat landscape, reduce their exposure and improve their security posture. The report states that companies should consider:

• Adopting next-generation end point process monitoring tools
• Accessing timely, accurate threat intelligence data and processes that allow for data to be incorporated into security monitoring and eventing
• Implementing first line–of-defence tools that can scale, like cloud security platforms
• Employing network segmentation to help reduce outbreak exposures
• Reviewing and practicing security response procedures regularly