More than 40% of executives polled by Deloitte believe remote Internet access to corporate systems, embedded malware in computers, applications and devices, and little visibility into the security protocols of suppliers and business units are the greatest cyber risks today. The executives were polled recently during the Deloitte Webcast, “Combating Cyber-Threats from the Underground Economy: A View from the Front Lines.”

“Cyber attacks today are not only about identity theft, but about stealing information behind companies’ firewalls,” says Mark White, principal, Deloitte Consulting LLP and the Webcast moderator. “An entire underground economy has been built for the purpose of stealing, packaging, and reselling electronic information. Never before in history has the threat landscape been as deeply penetrated or more rapidly evolving. Never before have nations, corporations or individuals been more electronically exploited.”

Richard Baich, a principal in Deloitte & Touche LLP’s Security & Privacy practice and a webcast presenter, notes that security programs need to be strengthened as it has become increasingly evident that criminals with advanced cyber skills continuously invent new and insidious ways to perpetrate criminal acts. “The cyber crime landscape has evolved into a set of highly specialized criminal products and services that are able to target specific organisations, regions, and customer profiles by using a sophisticated set of malware exploits and anonymisation systems, which routinely evade present-day security controls,” says Baich.

Baich also states that cyber criminals are now able to target specific individuals within an organisation, such as a payroll clerk, and misuse that role to steal information for direct monetary gain. Nation-states are also able to recruit and leverage cyber criminal resources to target organisations or other nations for the purposes of espionage, monetary gain, or to gain military advantage.

“This leaves executives asking what they can do to quickly identify and contain malware and then protect their data. This is after they already spent a good deal of money on traditional protection programs,” says Baich. “Companies should consider establishing cyber threat intelligence programs as well as leveraging existing technology and architecture investments to help detect and prevent these problems.”

“Data is more valuable than money. Once money is spent it is gone. Data can be reused and can give you the ability to access online banking applications, use credit cards and penetrate firewalls over and over. A famous bank robber from the 1900s was asked why he robbed banks. He said ‘because that is where the money is.’ Cyber criminals today go to where the data is, because it allows them to access money. Executives need to develop cyber programs to stay ahead of criminals and stop old cat and mouse games,” adds Baich.

Other polling results include:

    * Only 2.8% of the participants indicated they did not need a type of cyber threat intelligence or detection program.
    * 62.2% of respondents did not know how their organisation understands what data is leaving the company’s network, though 14.1% did confirm that their organisations were using a data loss prevention solution.
    * 41.4% reported that they did not know how their organisations found compromised devices inside of their network.
    * More than a quarter (27.4%) indicated their organisations rely on some type of antivirus and intrusion detection system.