Cyber Security Trends in the Tech Industry

The tech industry is one of the most swiftly evolving areas of business today. From wearable technology to major advancements in computing and robotics, technology is effectively changing life as we know it. We’ve done industry trend blogs on various areas such as Finance and Healthcare. This rendition on Technology provides a unique case because this sector is actually creating much of the technology that’s at risk, while other industries tend to be the consumers of the technology. Thus, the lens through which technology companies must view Cyber Security is somewhat different from other sectors.

Level Setting on Tech Companies

Let’s start by defining what a technology company is. Think hardware, software, and technology service companies who are creating a form of technology that others can purchase and utilize. Some of the biggest and most popular players in this space that may come to mind include Facebook, Microsoft, IBM and Google. These companies provide pure technology to their consumers for a price. Though common, the sector is not limited to these types of companies either. There are also technology companies that function specifically for other sectors, which can present an additional layer of challenges and considerations. For example, a technology company that specializes in healthcare software not only has to be mindful of the general technology landscape but must deliver niche functionality and protection mechanisms tailored to the heavily regulated sector.

Some of the Largest Cyber Breaches in History Targeted Tech Companies

Technology companies are at the crux of some of the most notorious breaches of all time. Here are a few examples:

• Yahoo Email: The Yahoo data breach is still on record as the largest data breach of all time. The breach is said to have occurred around 2013 and disclosed roughly four years later in 2017.The attackers were able to gain access to names, email addresses, birthdates, security questions, answers, and more for all of their user accounts – a whopping 3 billion users. Surfacing amidst an ongoing negotiation to sell the company to Verizon, the mishap resulted in an estimated 350 million dollar reduction in the company’s sale price. Several gaps in security at the company led to this devastating loss.
• eBay: Around the same time as Yahoo’s compromise, eBay was hit with a breach that resulted in the loss of about 145 million user records including sensitive data such as name, address, birthdates, and more. After compromising legitimate user login credentials, the hackers remained in the network for over 200 days exploring the companies data and marking their targets.
• Uber: A breach of Uber’s security resulted in the loss of 57 million customer records and over half a million driver records. The breach is not only noteworthy for the amount of data that was compromised, but also for the way the breach was handled once discovered. It’s alleged that the company paid the attackers $100k to delete the data and cover up the attack. Several executives separated from the company in light of the attack, and the company suffered both financial and repetitional damage.

Most Concerning Risks to Technology Companies

These breaches are a reminder that technology companies face the same cyber threats as the companies that they serve, if not more. Beyond the typical issues companies face around the cyber basics of patching, user errors, network security, and other elements – there are some key areas where threats become elevated for technology companies:

• Third-party risk: Technology providers, especially in the software space and with the growing need for integration across platforms, are offering solutions that can require connections to millions of different customers and their systems. This means that the attack surface that must be protected is much larger than companies who don’t provide an actual technology or technical service. As we’ve seen in the string of cyber security breaches resulting from third-party risks and attacks, this is a big gap that companies cannot ignore.
• Keeping customers secure: As a technology company, it’s your product that’s getting targeted and used as an attack vector to impact your customers and others. Cyber criminals are constantly looking for bugs and holes in technology and applications that they can exploit. Providing customers with easy ways to address the constant and frequent disclosure of vulnerabilities in technology becomes very important. Tech companies should not only proactively find these holes in their technology, but create the fixes quickly and get them to their consumers. Furthermore, if external parties discover vulnerabilities, whether disclosed responsibly or irresponsibly, how the company responds to the realization of such issues also makes a difference.
• Insider Threats and loss of intellectual property: To a tech product company, the most prized possession and element that makes it unique is usually the product. It’s essential to keep this kind of information out of the hands of competitors and unauthorized parties. Failing to do so can allow people to pirate, replicate, steal the secret sauce, and worse. Tech companies have a substantial need to protect intellectual property, technology product roadmaps, and more. From previous Insider Threat caused breaches, tech companies have also learned to need to be mindful of the risk of employees leaking or selling this valuable information.

What Companies Should Do to Adapt

For any company delivering technology solutions to customers, a robust cyber security program is the key. To address some of the specific threats mentioned above, emphasis should be placed around managing Insider Threats and preventing intellectual property from leaving your company. Active vulnerability management, third party risk, and visibility into what’s transpiring within the network will also help ensure tech companies reduce these inherent risks.