CYBERCRIMINALS NEVER STOP

Today’s effective control can become tomorrow’s data breach. As more companies adopt anti-malware to protect themselves from ransomware and other viruses, cybercriminals evolve these programs.

For example, in August 2018, a new ransomware called Ryuk infected several businesses. During the first few months, businesses paid the attackers nearly $640,000 in ransom. However, more important than its existence is that it’s not an entirely new virus. Ryuk shares code with another ransomware variant called Hermes.

People often assume that cybercriminals focus on previously unknown vulnerabilities, called cyber security attacks. In reality, a cyber security attack requires time and effort that makes it inefficient and costly. Therefore, cybercriminals tend to evolve their methodologies rather than create new ones.

COMPLIANCE REQUIREMENTS ENFORCE IT

Whether a business needs to comply with an industry-standard or governmental regulation, continuous monitoring stands as a core principle since cybercriminals continuously evolve their methodologies.

The underpinning of continuous monitoring as a compliance requirement lies in bureaucracy. While cybercriminals change their attack methods, regulations and standards need to go through long review phases that cause them to lag behind threats. As such, incorporating continuous monitoring as a requirement intends to prevent data breaches and give auditors a way to detect control deficiencies.