A Weekend in Incident Response #35: The Most Common Cyber security Threats Today

Companies across different industries around the globe, along with government institutions, cite cyber attacks as one of the biggest security threats to their existence. As a matter of fact, in a recent Forbes survey of over 700 companies from 79 countries, 88 percent of respondents said that they are “extremely concerned” or “concerned” by the risk of getting attacked by hackers.

This fact is a clear indication that organizations have to ramp up efforts for enhancing their cyber resilience, but to do that successfully and in the most effective manner, they need to have a clear understanding of where the biggest cyber threats come from nowadays so that they can shape their cyber defenses accordingly. We take a look at the most common cybersecurity threats today, ranging from internal threats, cyber criminals looking for financial gains, and nation states.

Internal Threats

When talking about cyber security, some of the first things that usually come to mind are freelance hackers and state-sponsored attacks between hostile nations. But, many cyber security incidents actually come from within organizations, or to be more specific, from their own employees.

Pretty much all experts agree that employees are some of the weakest links in the cyber defense of every organization, in part due to low cyber security awareness, and sometimes due to criminal intent.

Employees often put their companies at risk of getting hacked without meaning to, by opening phishing emails or sharing confidential files through insecure channels, which is why organizations should make sure their staff knows the basics of cyber security and how to avoid the common cyber scams and protect data.

Connected Devices

With so many devices connected to the Internet nowadays, including video cameras, smart phones, tablets, sensors, POS terminals, medical devices, printers, scanners, among others, organizations are at an increased risk of falling victim of a data breach. The Internet of Things is a real and ever-increasing cyber threat to businesses and institutions, deteriorating their vulnerability to cyber attacks by adding more endpoints that hackers can use to gain access to networks, and by making it easier for hackers to spread malicious software throughout networks at a faster rate.

The Internet of Things is one of the factors that make DDoS attacks more possible and more easily conducted, and these types of attacks can have a significant and long-lasting impact on organizations, both in terms of financial losses and reputation damage.

Nation-State Attacks

Private entities and government institutions that are part of the critical infrastructure in their countries are under a constant threat of different types of attacks by hostile nations. As the number of channels and methods that stand at the disposal of hackers aiming to gain access to computer networks grows, organizations in the public and private sector are facing a growing risk of cyber attacks sponsored by nation-states that might have an interest in damaging the critical infrastructure of other countries, hurting their economies, obtaining top-secret information, or getting the upper hand in diplomatic disputes.

Most commonly, nation-state-sponsored cyber attacks use malware, such as ransomware and spyware, to access computer networks of organizations, as a means of gaining control over certain aspects of the critical infrastructure of another country.

No matter what types of attacks are common today, the number and level of sophistication of cyber threats to organizations are certainly going to grow in the future, which is why they have to constantly update and adjust their cyber defenses accordingly.

A Weekend in Incident Response #33: Security Awareness Training Can Help Protect Organizations Against Ransomware Attacks

With all the damage done by the WannaCry and the Petya (also known as GoldenEye) ransomware attacks over the course of the last two months in mind, it is safe to assume that organizations that are a potential target of cyber criminals should move to enhance resilience to these types of attacks. There are various actions that businesses and government institutions can take to escape unscathed from this global ransomware epidemics.

Aside from using sophisticated tools that are designed to detect and remove ransomware, employees themselves are an important piece of the puzzle when it comes to defending against targeted cyber-attacks. Raising employee awareness on cybersecurity can go a long way towards improving the ability of organizations to avoid damages caused by cyber incidents because the staff is often cited as one of the weakest links in cyber defenses.

Employees, the First Line of Defense Against Ransomware

One of the reasons why organizations need to raise cybersecurity awareness within their staff is that ransomware usually finds a way into IT systems through phishing emails opened by an employee. The main risk is a result of the fact that most employees are not very well-versed in distinguishing between legitimate emails and fake ones that aim to install malicious software onto their computers, which is done in one of two ways. One way is to include a call-to-action prompting recipients to download an attachment that contains a malware. Once that file is installed onto the computer, the malware basically disables the computer, preventing the user from accessing it, or from opening certain essential files.

The other way involves emails providing a URL that recipients are supposed to click, with the URL being created in such a manner that resembles a popular and well-known website. That way, recipients do not suspect that there is something wrong with the website they are prompted to visit by the email message, but once they click the malicious URL and go to that website, malware is instantly installed onto their computer.

After a piece of malware is installed on a computer, it has the ability to spread across other computers that it is connected to, thus infecting and blocking access to the entire network.

Tackle Social Engineering Through Education

Organizations can reduce the risk of getting hit by a ransomware attack by educating employees about the methods utilized in these scams, which involve a great deal of social engineering, taking advantage of certain psychological weaknesses. By making employees more aware of the most common ransomware schemes, as well as the fact that they have one of the key roles in the cyber defense of their organization, chances of preventing attacks can be greatly increased.

Cyber security professionals need to train all employees on how to detect ransomware scams, by pointing out to them that they need to pay extra attention to details when receiving emails from an unknown sender or containing suspicious content. The most important details that employees should pay attention to include the display name of emails, the salutation, and whether an email contains an attachment that they are not expecting.

Employee education is paramount when it comes to defending against ransomware attacks, and organizations need to invest more time and resources into this increasingly important aspect of cybersecurity.