The Cyber Crime Business Model
By: Hubbert Smith, Founder & CEO, i4 Ops
Spoiler alert! (But is it?) Cyber crime relies on credentialed access to data, and it is by design that credentialed logins bypass network security.?
Unfortunately, recent news of breaches have shown that the hack is coming from the inside. Let’s take the semi-recent AT&T instance as an example. This breach had nothing to do with traditional cybersecurity measures. The root cause was a stale demo account followed by the bypass of credentialed logins. Given the rate of this type of breach, the average expense of malicious insider attacks averaged $4.99 million in 2024, according to a recent IBM report.??
The cybercrime business process is ever-evolving. And scarily, cyber criminals are both greedy and lazy. The now prevalent practice is stealing data and selling it and no company is safe.
Here is just one example of the process:?
A data sample is posted on the dark web and bitcoin is accepted for the entire data set, then:
- Personal payment is sold to fraudsters - Emails and profiles are sold for questionable use - Business-sensitive data is sold to competitors of any sort - Supply chain data is sold to freight-theft criminals
And third-parties become frequent targets.
The easiest way to steal data is by accessing credentialed logins and through the use of info-stealing malware. Credentialed logins bypass network security by design. It’s easy to see that - relying upon the ‘traditional’ [read: old] strategy simply cannot keep companies and their data protected.
While we don’t wish it on any leader, the exposure should be worrisome.?
More to come on this topic. Afterall, data breaches continue to happen daily…