Traditionally, there was a stratification of security requirements influenced by organization size.\u00a0 These requirements imposed expenses, policies, and processes \u2013 and were often a balance between efficacy and convenience.\u00a0\u00a0Governments, for example, were often prime targets.\u00a0 The government adversary is typically another nation state with deep pockets and high motivation for espionage or worse.\u00a0 Governments must assume that there will be groups of professionals targeting them and security is robust.\u00a0Some large enterprises found themselves in similar situations.\u00a0 The reward for successfully compromising a financial institution is high.\u00a0 Financial institutions recognize that they are attractive targets, so they create comprehensive security solutions as insulation from possible attacks.\u00a0\u00a0Smaller enterprises, such as the middle market, tend to fly under the radar believing themselves to be less attractive targets.\u00a0 These organizations will often deploy just enough security to ensure they are not an easy target for the casual adversary.Until recently, this has been a successful strategy.Nation state capabilities for casual adversariesThe threat landscape has gradually changed for the last ten years.\u00a0 In 2010, a significant new form of malware called \u201cStuxnet\u201d was discovered in the wild.\u00a0 Researchers determined that this malware may have been operating undetected for about five years. \u00a0Further, it used a number of previously unknown, or zero-day, exploits.Stuxnet was developed by nation-states for use against another nation-state, but there were also unintended consequences.\u00a0 The malware-infected individuals and enterprises across many countries.\u00a0Fortunately, Stuxnet did not appear to cause damage outside its intended target. Unfortunately, future attacks would not be as discerning.In 2017, two ransomware variants, WannaCry and Petya spread rapidly throughout Europe. These two attacks utilized an exploit called EternalBlue that was leaked from the NSA in the months prior. \u00a0Unlike Stuxnet, this malware caused damage to the devices it infected by encrypting and destroying data. While the EternalBlue exploit was originally carefully guarded, the publicity meant it could be weaponized for larger scale attacks.\u00a0 The implications are significant because this means even casual attackers can potentially tap the power of a nation-state.\u00a0This trend is on the rise and there is no reason to believe that things will get better.\u00a0 Whether an attack escapes the control of a nation-state or a carefully guarded zero-day exploit becomes public knowledge, sophisticated and devastating attacks will become more frequent and destructive.Organizations of all sizes can be caught in the crossfire.\u00a0 For the chief information security officer (CISO), the cost to the organization is the same, regardless of whether it originated as a target or was merely collateral damage. Organizations must accept the reality that a new caliber of attack is going to be more common.Recent events are forcing smaller enterprises to reconsider their security posture.\u00a0 Organizations of all sizes must evaluate more advanced options for mitigating zero-day attacks, identifying network anomalies, and even threat hunting to identify threats that may have already infiltrated the trusted zones of their networks.\u00a0Evolving cybersecurity strategies for smaller enterprises \u00a0Cybersecurity strategies such as threat hunting were once the exclusive domain of the high-value targets like government institutions and financial services organizations.\u00a0\u00a0 The modern threat landscape has evolved to the degree that even smaller enterprises may find themselves victim to a previously unthinkable attack.\u00a01) Develop a baseline for normal activityKnowing what normal network activity looks like today helps to more quickly identify the cause when things are going wrong tomorrow.\u00a0 For example, when accounting starts pulling information from the database server for the first time, this might raise a red flag.\u00a02) Have some defense for unknown malwareVirus scanners are a good first step, but they are easily defeated. Consider malware identification that considers file behavior in addition to signatures.3) Avoid over-reliance on endpoint defensesEndpoint defenses are a valuable part of cybersecurity, but these are generally the last resort.\u00a0 If the endpoint solution fails to identify the threat, the organization will be compromised.\u00a0 A better approach is to lean forward \u2013 seek to identify and block the threat before it hits the endpoint.4) Trust but verify the internal networkToo many organizations create strong perimeter defenses and deem the internal network trusted, and there for unprotected.\u00a0 Monitor your internal network the way you monitor your internet connection.\u00a05) The fundamentals remain importantHaving a good backup strategy would have minimized the impact of these newsworthy ransomware attacks.\u00a0 I recommend the 3-2-1 approach:\u00a0 Keep three backups, two of them on-site, one off-site.\u00a0* * *As most CISOs know, there is no guarantee against a highly motivated and targeted attack. \u00a0However, the assumptions that have driven security stratification are changing to the degree that an enterprise doesn\u2019t have to be the target to fall victim to a targeted attack enabled by nation-state capabilities.