Businesses at increased risk of cyber-attacks as cloud use increases

Research by the ICAEW has found that businesses are not doing enough to combat online threats, despite increased awareness of the risks posed by cyber security.  

The research, based on the experiences of auditors from six of the UK’s largest accounting firms, showed that businesses remain vulnerable to legal action in cases of cyber intrusion, with the increase of digitalised data not sufficiently offset by measures to bolster cyber security.

The institute’s report, Audit Insight: Cyber Security, says there is a growing gap between business and cyber attacker capabilities.  Business dependency on digital storage has increased dramatically over the past decade, whilst technologies, tools and routes available to cyber thieves have also risen.

Richard Anning, head of ICAEW’s IT faculty, said: “Businesses are more aware of cyber risks than before and are working to mitigate threats, yet they are still falling further behind the cyber attackers.  Businesses must now match their good intentions with action.”

Recent high profile cases have shown that cloud storage is one of the main issues facing data security.  Last year, the American company Target faced dire legal repercussions due a large data breach in which millions of customers’ payment details were leaked.

Cloud storage now serves as one of the main solutions for data storage as it is accessible across a range of platforms, offering affordability and convenience.

In its report, the ICAEW recommends that organisations identify business-critical data and associated risks, regardless of whether they is a legal regulatory requirement to do so.

Meanwhile, Mark Brown, executive director of cyber security and resilience at EY, who supported the research, said: “Organisations must undertake a journey from a reactive to a proactive posture, transforming themselves from easy targets for cybercriminals into more formidable adversaries.

“Organisations are not taking the basic steps, such as setting up a security operations centre or putting in place an incident response plan, and this continues to be a major cause for concern.”