Cybersecurity checklist: Five essential tasks for multinational companies in 2017

The global security landscape is growing evermore complex. Distributed denial of service (DDoS) attacks are escalating worldwide. Internet of Things (IoT) devices are increasingly being used as network backdoors. And hackers are now beginning to exploit the domain name system (DNS) name-to-address mapping infrastructure that underlies the Internet.

While 2016 brought to light a number of massive data breaches, we have to be ready for more highly sophisticated and rapid attacks in 2017. Plus, cybercriminals may have even more opportunities in the coming year as the enterprise attack surface expands along with the number of IoT, mobile and cloud endpoints.

All of this makes it even more important that we get the fundamentals of security right. Here are the five top things I think you must do to help protect your business in 2017.

1. Invest in a security roadmap You have to understand where your risks are so that you can concentrate your security budget where it counts the most. More security is not necessarily better security! A roadmap will help you optimize your IT spending and avoid unnecessary outlay. It will also help to guide you to reduce the complexity of your security systems and improve their overall effectiveness, with the extra benefit of improved business agility.

2. Boost your monitoring capabilities The traditional way of handling exception monitoring, with engineers or analysts reacting to alarms from a variety of software tools, is no longer effective. The volume of security alerts and the complexity of threats are simply overwhelming. This is where machine learning is becoming useful as a complement to human security experts.

With machine learning, we can process countless data points and automatically generate and adapt rules to better detect and respond to threats. Few companies have the resources to do this well in-house, but a reliable managed security service will be able to handle it for you.

3. Tighten up authentication Many organizations rely on usernames and passwords to control access to their systems and applications. These are notoriously vulnerable to hacking and can easily provide attackers with a means to gain unauthorized access to the corporate network. A stronger authentication mechanism, such as multi-factor authentication, significantly helps to reduce your exposure to risk.

4. Face up to patch management A software patch fixes security vulnerabilities that could be exploited to gain unauthorized access or control of a computer system. But it can be both difficult and time-consuming to decide what patches are appropriate and then to install and test them across a complex corporate network.

How will you keep up with the huge volume of necessary patches? How will you know what has been patched, and what hasn't? How will you patch bring your own device (BYOD) devices and IoT endpoints? You need a solid patch strategy. It's not easy, but it has to be done.

5. Take responsibility for cloud security Often when multinational corporations move from the physical world to the cloud world, they assume that security is the responsibility of their cloud service provider. It's not. This is not a failing of your cloud provider.

Cloud companies focus on giving you an agile, high-performance platform; they are not security companies and they don't have the resources or expertise to fully protect your systems. You have to evaluate your exposure for yourself and determine what you need to do to provide security for your business in the cloud.

Cyber security is a necessary cost of doing business in 2017. But it is possible to be sensible and to invest your budget where it can do the most good. Above all, don't be afraid to tap into outside expertise. Most of us wouldn't think twice about seeking out an expert legal, financial, or medical advisor.

Given the business risks associated with a data breach – and the difficulty of managing security in-house even with a dedicated IT team – outsourcing is now increasingly seen as the most effective way for multinational companies in Asia Pacific to protect sensitive data and systems.