Thanks to our dependence on technology, cybercrime is undeniably a threat to every single business, large or small (or in-between). And there is every reason to expect that cyberattacks are only going to increase in volume, strength and sophistication, costing businesses an estimated $6 trillion by the year 2021.
As reported by Info Security, cyberattacks are now happening at double the rate that they occurred just last year.
While we can’t predict every new attack or approach, what we can do is learn from what’s happened in just the past 12 months. Understanding today’s cybercrime trends is the smartest way to prepare for -- and prevent -- the cyber threats of the future.
So let’s review the top 5 scariest threats that businesses have faced so far in 2017.
Ransomware is a type of malware that locks the victim out of accessing files, folders or the whole system. The target of the attack either gets locked out of the entire system, or all of their files get encrypted and are therefore useless.
Either way, a decryption key is required in order to re-gain access…a key that the cybercriminals behind the attack may (or may not) provide in exchange for a ransom demand.
There are many, many different strains of ransomware, including a few that have made headlines in recent months. The WannaCry attack was ransomware, and just last week a new one named “Bad Rabbit” was discovered.
Ransomware has continued to proliferate, with no signs of slowing down. This is largely due to the evolution of “ransomware-as-a-service” which has made it easy and inexpensive for hackers to access and profit from this type of malware.
It’s just like the subscription model for cloud-based technologies that has benefited small and medium-sized businesses over the last few years by making enterprise-level technology accessible and affordable.
The difference is that in this case, it’s being used for criminal purposes. Now, instead of having to build out the infrastructure needed to stage an attack, cybercriminals can rent what they need to deploy an attack and collect ransoms.
It’s all very convenient for hackers with even modest skills, giving them easy access to the tools they need to extort money from businesses just like yours, without having to make large upfront investments or develop the malware or the supporting infrastructure on their own.
Thanks to this malware strain, cybercriminals are doing a thriving business…meaning ransomware is here to stay.
Social engineering is the art of manipulating an end-user into providing sensitive or confidential information.
It makes sense too, because if you can persuade someone to just give you the keys to their house, or to open the front door to you, that’s certainly a lot less effort than breaking in through the side window.
More often than not, these tactics involve an email, though it could also be a text message or some sort of outreach to you via social media.
The types of phishing messages are ever-changing, as they follow the news cycle, holidays or other current events.
But what they have in common is the attempt to invoke a sense of urgency. These messages prey on the recipients’ emotions, hoping that they will react quickly, setting aside logic in that need to alleviate the fear or capitalize on the excitement.
Some examples include notices that an account (be it a bank account or your Netflix account) is going to be frozen or suspended if you don’t validate your credentials within 24 hours, notice that you are due a refund or credit and you must enter your account information to claim it, notice of a shipment, notice that you have won a prize, etc.
Common themes are the need to validate your account, or a promise of money in the form of a prize, credit or refund - though there is no limit to the creativity we see when it comes to social engineering so this should in no way be considered an exhaustive list of examples.
The goal with any social engineering is to create a feeling of urgency that will entice the user to click on a malicious link, or to open an attachment that will then download malware onto that computer and potentially throughout the entire network.
And unfortunately, it’s been proven time and time again that they work, because the recipients don’t know better, or just can’t help themselves.
Whether the message taps into the person’s desire to be helpful, creates fear or excitement, or just plain old curiosity, these messages can trick even savvy users into giving up sensitive information. And they are particularly challenging for businesses because they involve that highly unpredictable element – human behavior.
What makes them even more dangerous is that well over 90% of all phishing emails are believed to deliver ransomware (according to the 2017 Verizon Data Breach Investigations Report). So an employee unknowingly clicking on a bad link or attachment can have some pretty severe consequences, particularly if your business data isn’t properly backed up.
Social engineering tactics are scary because they target the human beings who represent perhaps the weakest link in a company’s network security, and combine 2 of the 5 scariest tactics in an effort to disrupt and exploit your business.
The best defense against them will always be end-user education. When end-users are cyber aware, you will dramatically reduce the chances of someone falling for such a scam.
Mobile Devices and Internet of Things (IoT)
The modern convenience of our increasingly connected world has a huge upside for us both personally and professionally. But the flip side of these efficiency gains is that this unprecedented level of connectivity has also increased exponentially the opportunities for hackers.
At the same time, there generally seems to be a lower level of concern around the safety of mobile devices, and IoT devices. Where this becomes problematic for business is when insecure personal devices or network are used to access or transmit company data.
If you haven’t already, it may be time to develop a BYOD (bring-your-own-device) strategy or SOP for your business. This includes not just smartphones and tablets, but also things like USB drives, which can become infected with malware that is then spread throughout your network.
You should also consider adopting guidelines on using public wi-fi network, particularly for any team members who travel frequently.
One of the many benefits of being in the age of cloud-based technologies is the access to modern productivity tools that it provides to businesses of all sizes. But again, the more outside systems and servers you are connecting to, the more opportunities there are for a breach.
It only takes a single weakness to exploit a network, and more often than not, this comes in the form of unpatched or outdated technology.
The most common backdoor vulnerabilities include:
Unpatched applications or operating systems
An unpatched system is like an invitation to attack your network. Several of the recent high-profile cyber attacks were in fact the result of unpatched applications – including the Equifax data breach and the WannaCry ransomware attack.
These software vendors release security patches for a reason (because they have identified a security hole), but if you don’t take the time to push the updates, then you are ignoring known vulnerabilities.
Not following network administration best practices when it comes to privileges and user management
If all (or most) of your users have blanket access because it’s “just easier”, you have a problem. Because even if just one workstation gets infected, the malware just might be designed to spread to all the drives that the infected user’s computer has access to. If that includes full admin access, then you have a full-blown crisis on your hands.
Other opportunities are presented by user accounts that are left active, even though the employee has left the company. Not only are those risky because of the possibility of a hack that goes undetected, but they also put you at risk of an insider threat.
Best practice is to operate on the principle of least privilege when it comes to access, and you absolutely must have someone who is responsible for managing all of your users.
Using insecure passwords
It’s widely known that human beings are resistant to following password best practices. The hackers know it too. We’ve written a lot about passwords and you can read more about that here and here. But for this list, we want to specifically point out the use of null or default passwords. All devices – including wireless routers, servers, etc. – should have the default password changed and passwords for privileged users should never be left at null.
Human Error and Insider Threats
The biggest cybersecurity vulnerability you have is the people who work there. Breaches caused by employees can be intentional or unintentional, but the results are the same whether it was due to an employee who just didn’t know better, or a disgruntled team member.
Combating this truly starts when the leaders of the business accept that this internal threat exists. Only then can you begin to create the culture of cyber awareness required to protect your brand.
Education and ongoing training are a great counter to human error and those “oops” moments. Make sure that every single person in the company is cyber aware. When they are educated about the risks, it can cut down in security incidents by more than 50%.
Insider threats can also be prevented by limiting access to only those who absolutely need it, and also paying attention to your team and their behavior.
Cybersecurity is Everyone's Responsibility...And It's Our Business
As a leading IT Service Provider, we take network security - and protecting our valued customers from the scariest cyber threats of 2017 - seriously.
With more than 400 clients andover 6,500 systems under management (and growing), Corsica Techis among the largest managed ITservice providers in the country. As a Corsica Tech customer, you will benefit from our industry-leading monitoring tools, firewalls, data backups, and overall expertise in the field of technology and technology security.
Ready to learn more about how our IT services can help protect your business? Request a call from one of our expert Account Executives and we'll contact you right away to answer your questions and provide more details on how your business can benefit from our IT Managed Services Plan.
Want more great technology updates, news and other industry information delivered directly to your inbox? Subscribe to the blog and each week you'll get new useful tech news you can use!