Pivotal moments in recent cyber-security history, like the NotPetya ransomware attack in 2017, have changed the world of threat management. Causing $10 billion in acknowledged damages and global disruption, this example demonstrates how complex cyber-attacks have become – and how sophisticated cyber-threat management needs to be.

The threat management process is traditionally made up of a sequence of activities that include threat identification, tracking and mitigation, and its success is measured by speed and accuracy. Gone are the days of airtight perimeter security, but increasing data volumes, new technologies and trends – like remote working –drive the need for an enhanced approach.

In this article, we will explore the true importance of cyber-threat management in today’s world, how it works and some of the key challenges that organisations must be aware of to stay competitive. We will also delve into the best practices that will aid detection and mitigation and the solutions that will help to prepare your cyber-security for the inevitable.

A 2022 survey from the UK Government into cyber-security breaches revealed that 39% of UK businesses have identified a cyber-attack in the last 12 months. Looking at organisations reporting a material outcome, such as loss of money or data, gives an estimated cost of £4,200 for all businesses. This rises to £19,400 for medium and large businesses.

The unprecedented frequency, variety and cost of attacks revealed by the survey underlines the importance of threat management for organisations today. Those that deploy strong threat management practices will still be unable to guarantee the mitigation of all attacks, but organisations that neglect it position themselves to face existential threats.

Organisations need to achieve their goals and progress while simultaneously navigating the challenging threat landscape we have depicted – and cyber-security frameworks hold the key. These frameworks combine best practices and industry standards to support organisations to implement effective threat management, helping to drive an understanding of cyber-security risks.

In addition to providing an essential understanding of cyber-security risks, these frameworks have also been designed to offer technical guidance when it is needed most. Example frameworks factor in threat identification, protection, detection, response and even recovery, helping organisations to implement appropriate governance, continuous monitoring and cyber-resilience.

With a dynamic threat management system in place that is backed by a cyber-security framework, organisations can strategically apply automation and artificial intelligence (AI) technologies to boost their capabilities. This enables security teams to achieve a level of visibility that human analysis cannot, saving skilled professionals vital time that can be spent addressing threats directly.

Visibility is one of the main challenges faced by security teams conducting cyber-threat management, with massive volumes of data to analyse generated by thousands of individual endpoints. But there are a set of other challenges to consider.

A lack of talent and expertise within cyber-security is a major threat management challenge for organisations as the skills gap continues to widen. While AI and automation can help process masses of data and win back precious time for existing staff, technology is unable to take the place of skilled infosec experts who can carry out an incident response. Managed threat detection and response solutions provide support to businesses who don’t have the expertise internally to monitor and rapidly respond to cyber-threats.

Analysing alerts is a critical success factor in threat management, but sometimes real and dangerous threats get lost amid a mass of incidents generated by a complex network. As autonomous solutions signal potential threats, human operators are forced to waste time by checking them individually. This challenge can be solved using an effective cyber-security framework.

The separation of teams within an organisation poses further limitations to the success of your threat management efforts. This is primarily due to teams that fail to coordinate effectively, which often leads to specialists duplicating efforts and subsequently wasting time and resources. Creating and implementing a comprehensive response plan can alleviate this problem, resulting in a more streamlined response in the event of an attack or breach.

The pervasive nature of today’s threat landscape means that if your organisation has vulnerabilities in new or existing applications, cyber-criminals will locate them. Whether you are a global enterprise or a small to medium business, one of the primary best practices is to build security into your applications from the ground up. Now that perimeter security is no longer a valid approach, security must now be woven into all aspects of the organisation at the design phase.

Another important best practice for a modern threat management strategy is to address all auditing and compliance requirements. In the post-GDPR era, data breaches can result in significant fines if compliance has not been achieved, worsening the impact of a cyber-attack. To prevent this, dashboards should be used to support security analysts and to create visibility with auditors, and compliance reporting should be conducted thoroughly.

The rise of remote working and the seamless use of various devices has emphasised the need to constantly validate network and system resource integrity. This includes managing your applications, vulnerability and patch details, infrastructure, systems and deployed devices. In combination with this effort, Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) alerting should be aggregated to enhance incident management and to filter out false positives.

While detection is often focused on heavily when it comes to threat management, containment is an equally critical part of the process. Once a threat has been identified and confirmed, network segment isolation and IP blocking may be necessary. Enforcement update automation has an important role to play in responding to threats, ensuring that all necessary updates are made to prevent data exfiltration.

Cyber-attacks are now hitting businesses every 45 seconds – and the growing use of devices, digital tools and cloud technology is only accelerating this rate. Organisations need to embrace digital transformation to stay competitive, but dynamic security is also critical.

BT is enabling customers to achieve simplicity with a single view of their security, enabling them to innovate while protecting customer data and costs. Whether you need to accelerate threat detection and response, secure your network, cloud services, data, end-users or devices, BT is uniquely positioned to help you consolidate your security. By eliminating fragmentation and adopting a tailored approach to security, you can achieve a modern threat-management strategy fit for the future.