Don't Let Them Get Away With It!

As Cybercrime becomes more and more prevalent, businesses must take cybersecurity seriously

Cybersecurity is still a major issue for businesses, large or small, irrespective of the business sector. News reports hit the headlines almost daily, telling us of Ransomware attacks against Healthcare, Financial Services, and Utilities. Industrial Espionage on a global scale, extracting Intellectual Property and Scams perpetrated against the general public, relieving them of their Life savings. How come, when there are so many controls, countermeasures, and no shortage of experts available to either advise or help a business avoid Cybercrime, that these attacks persist? Is it something inherent in the nature of Cybercrime that makes it so successful?

The answer lies, I believe, in the fact that Cybercrime has evolved and morphed from a harm-free activity to one with varying degrees of malicious intent and devastating consequences. Cybercriminals find new ways to either get to your data or steal your hard-earned cash, adapting their techniques to suit the crime. What's more, they are getting better at it. Even leaning on Artificial Intelligence and Machine Learning to speed up the process and figure out who you are and how they can get to your information with these new tools.

?

Unverified Trust?

Perhaps more worrying is how willing the public has become to share their precious personal data with anybody who asks for it, even though awareness of the pitfalls is at an all-time high. We are aware of the risks involved, but it's as though we suspend commonsense, too eager to trust. People need to be vigilant, careful, and suspicious about what they share on the internet. We know the dangers of talking to strangers in the physical world, so why doesn't this translate to the virtual? Online, it would be best if you exercised the same caution. After all, you can't see them; you don't know them; they are strangers. The UK's cybersecurity agency, NCSC, has launched a campaign to dissuade people from handing over their credentials to hackers during phishing attacks.

Cybersecurity

The problem is a long list of interconnected issues, and many people often confuse the term cybersecurity with hacking. Cybersecurity is much more than just preventing unauthorised access to your computer or email. It's about the broader issues of cyber risk and how it relates to your digital footprint and, of course, the CIA (no, not the Government Agency) Confidentiality, Integrity, and Availability (CIA Triad)

Protections

There are many ways that a business can take preemptive measures to protect itself from Cybercrime. In addition, there are also measures that they should be taking to mitigate the damage of attacks:

• ?Patching and updating software regularly
• Ensuring the use of strong passwords, passphrases, 2FA, and MFA
• Use full message encryption when sending sensitive emails and attachments
• User education about how phishing works and what to do about it when they receive a suspicious email
• Training employees on how to report suspicious activity to qualified staff
• Secure browsing practices where all websites are suitably encrypted and even isolated
• Least privilege and Zero Trust Access management processes
• Adequate Firewall protection, NGFW where possible, or for Cloud operations use Security Groups and other defence protections, some native to the Cloud Service Provider
• Using regular backups to safeguard valuable data, their files, emails, and more
• Regular monitoring and alerting of systems for signs of breaches

There are many more ways that businesses can protect themselves from Cybercrime, such as ensuring the basics of security are covered by following the requirements of Cyber Essentials or Cyber Essentials Plus, implement CIS hardened images, protect your Web Applications and API's from the Top 10 security vulnerabilities as listed on OWASP. Still, in all cases, they should also consider the business context and associated risk.

Protecting yourself?

People have become desensitised to the risks they take when opening emails, clicking on links, using apps, and sharing personal information without considering the consequences. Here are some measures they can take to defend against Cybercrime:

• They should always be careful with what they share on the internet and with whom they share it, as not all information should be shared
• It is also essential that they stay vigilant about suspicious emails and never open an unexpected or unsolicited email. It could contain malware, a virus, or a malicious link redirecting to a command and control server on the internet
• The public should also use software patches and updates and adopt the use of strong passwords for their devices, social media, and Bank accounts; make use of a Password Manager; there are plenty of them
• Use software patches and updates
• Adopt the use of strong passwords, passphrases and two-factor authentication for their devices, social media, and Bank accounts
• Stay aware of newsfeeds, trends, and articles that are available online or reported in the press
• Mistrust emails or calls from suspicious sources and be wary of people who approach them online

There are many more ways that the public can protect themselves from Cybercrime. Still, most importantly, it is about awareness. Pass good information and practices on to friends and family – spread the word.

Cyberattacks and the Threat Landscape

Security breaches are costing businesses lost time, money, and revenue. The average cost of a data breach damages a firm by an annual rate of?$3.5 million per company. Don't let your business become a victim of Cybercrime. Businesses are vulnerable to Cybercrime for many reasons, mainly due to the lack of security controls and inherent vulnerabilities. Companies must control their cyber threat environment by implementing a multi-layered approach to protect their data, maximise defences, and increase risk mitigation.

Upskilling

Cybercriminals are increasing their skill set and finding weaknesses in cyber defences and can better exploit the misconfigurations in an organisation's security architecture than they've ever been. Organisational leaders must be aware of the importance of cyber risk management and how criminals continue to adapt to new threats.

The 6 Pillars of a Cybersecurity Program?

Personally identifiable information (PII) is the currency of digital transactions - you need a solid program to protect PII and data effectively. The first part of any cybersecurity plan preparation should include those responsible for data protection, including the Security team, Financial Fraud, compliance officers, and your Privacy team. A cybersecurity program comprises six pillars: Strategy, Policy, Technology, People and training, Processes, and Operations. It is essential to monitor all aspects of the cybersecurity program. The different parts of the cybersecurity program are integrated into a holistic plan that provides a long-term approach to risk management. It should be continually reassessed, its effectiveness measured, and new measures should be taken to improve it if necessary.

The Front Line

Cybersecurity professionals at all levels of an organisation should be trained in modern methods of cyber attack. New techniques are continuously evolving; skill sets must cover traditional and Cloud-based operations and be updated regularly. There is no one-size-fits-all approach to building an excellent cybersecurity program. Every organisation should develop a program that is tailored to business needs, culture, and risk exposure.

Conclusion?

Digital operations drive new cybersecurity approaches but armed with the knowledge to solve cybercrime problems, we must look at innovative ways of working and rethinking our technology and considering the security of a remote workforce, looking to outside firms as a critical component to our cybersecurity operations and not forgetting the role of everyone in the company. Suppose we don't improve our business and private defences. In that case, we will continue to see an increase in the number of attacks, breaches, and loss of sensitive data. It is not just about investing in security tools; it's about changing how we think about security, employing a 'Secure by Design' mindset. Take action, don't let the cybercriminals get away with it.