Cybersecurity Risks in 2023

Cybersecurity has long been the purview of IT departments, but it is increasingly outsourced to third-party vendors. Those consultants and experts now play an outsized role in protecting the world’s most powerful companies. As such, procurement professionals must be knowledgeable about the current threat landscape to ensure their organizations have the resources necessary to stay secure from cybersecurity risks.

In this blog post, we will explore the different types of cyber threats that organizations need to be aware of in 2023 and how procurement departments to help protect against them.

Phishing Scams

Phishing scams continue to be one of the most pernicious types of cyberattacks assailing companies around the world. They are a popular attack vector for cybercriminals because they are low-cost to execute and have almost limitless chances to succeed—all it takes is for one employee to make a mistake, and an entire network can become compromised.

Cybercriminals can send out thousands of emails at a time, each masquerading as a legitimate email from within the company. Email databases and screening services have improved the automated identification of phishing scams, but this is by no means guaranteed.

According to DarkReading, large companies with robust IT operations spend an average of $1.1 million per year to mitigate phishing attacks. Recovering from an attack can cost several million dollars.

Inevitably, some phishing emails will get through. When they do, employees in the middle of their workday may make the mistake of providing sensitive information to outsiders, opening malicious links, or inadvertently downloading malware.

A combined approach of education, training, and technical expertise is required to combat phishing. Schedule regular training sessions with employees to help them identify phishing emails and initiate a zero-trust policy when it comes to downloads and information sharing.

Ransomware Attacks

Phishing attempts can also be a vector for ransomware attacks.

Ransomware attacks target companies by infecting their systems with malware, usually through malicious attachments or links in emails. Once the ransomware finds its way into a company's system, it encrypts all the data stored there and then a demand for payment is made in return for the encryption key that will unlock the data.

If companies do not pay up, the cybercriminals may threaten to release the stolen data on public forums, sell it to other malicious actors, or destroy it. Many companies that are victimized by ransomware attacks end up paying to maintain business continuity because it is less expensive than attempting to unlock the system.

As such, the best way to deal with ransomware attacks is to avoid them in the first place.

Companies need to have effective antivirus and backup systems in place to protect against such attacks. Regular back-ups (even daily) can enable the company to restore its data without having to pay off the attackers, making the attack virtually meaningless.

This, combined with training, can significantly reduce the risk of a ransomware attack.

Data Breaches

Data breaches don’t have to occur when malware or a virus infects a system or when a hacker manages to bypass security protocols. Often, data breaches occur simply because of employee negligence or because of poor password management and enforcement.

Companies can protect themselves against data breaches by having strong cybersecurity policies and procedures in place. These policies should include the following:

  • Regular security audits to identify any potential vulnerabilities
  • Best-practice use of authentication protocols
  • Regular patching and updating of systems
  • Minimization of privileged access
  • Awareness training for employees
  • Monitoring of system activities for suspicious activity
  • Encryption of data at rest and in transit, and
  • Robust backup solutions so that stolen data can be restored promptly.

Additionally, companies should investigate solutions such as web application firewalls and intrusion detection systems to further bolster their defenses. Procurement can help by identifying potential cybersecurity partners to help the company enact changes, train employees, and implement new cybersecurity systems.

Insider Attacks

Insider attacks are data breaches that occur when an individual with access to a company's network has malicious intent. Although they are relatively rare, these types of attacks can be extremely damaging because the insider typically has access to confidential information and knows how the system works, making it easier for them to exploit any vulnerabilities.

Insider attacks often stem from disgruntled employees who are seeking revenge or financial gain. They may also involve the theft of trade secrets or other confidential information.

Companies can protect themselves against such threats by closely monitoring user activities, establishing clear access control policies, conducting regular security audits, and implementing proper encryption protocols for all data transfers.

Procurement can help by obtaining monitoring software to ensure every activity on the network is logged accordingly. Regular meetings with employees, as well as employee sentiment monitoring, can help identify risks.

Don’t Miss ProcureCon IT Sourcing

Cybersecurity will continue to be a top priority among decision-makers, and procurement has an important role to play in protecting company networks and data. To learn more about what cybersecurity threats to expect in the coming years, don’t miss the ProcureCon IT Sourcing event happening from June 26th-27th at the Marriott Copley Place in Boston.

Return to Blog