It took five years after the automobile’s public introduction before the first documented automobile accident occurred. By comparison, the first documented Internet cybercrime occurred in 1989, the same year the first iteration of today's public Internet, Web 1.0, was launched! It’s hardly surprising, considering how everything related to computers seems to happen faster.
Fast-forward to over 30 years later, and cybersecurity is a huge concern in today’s Information Technology world. Some prognosticators forecast that 2021’s total cybersecurity spending will increase by around 10%, topping $60 billion.
Where is all that money going to, you wonder? Mainly addressing the most critical cybersecurity issues facing the world today. Since getting informed is half the battle, let's familiarize ourselves with the biggest cybersecurity challenges facing today's commercial and private sectors.
The Return of Brute Force If at first you don’t succeed, bludgeon it!
Over the last year, hackers and cybercriminals have returned to the tactic known as brute force, employing botnet swarms to boost IP requests and overwhelm networks. This flood of requests cause distributed denial of service (DDoS) logjams to slow down and paralyze corporate networks. DDoS attacks increased by 12% in 2020.
The Simple Network Management Protocol (SNMP) and Simple Services Delivery Protocol (SSDP) are prime targets for brute force attacks. This attack form is especially bad for SNMP since the latter connects and manages devices and peripherals such as modems, printers, routers, servers, and switches. Just consider the consequences of a business trying to retrieve data and print it out, only to find their devices paralyzed due to a flood of false requests.
Fortunately, there are numerous countermeasures to prevent and mitigate DDoS attacks.
Home Office Attacks Yet another consequence of the pandemic
The COVID-19 pandemic brought social distancing, quarantines, and lockdowns to the working world, and countless employees found themselves working from home. This work trend, in turn, potentially creates more fertile hunting grounds for cybercriminals.
Although there have been no documented catastrophic breaches of corporate systems thanks to WFH (Work from Home), hackers are more likely to circumvent less secure consumer home networks than the big-muscle firewalls and security measures that the business sector enjoys.
Endpoint Threats User devices have their unique vulnerabilities.
The term “endpoint devices” covers any device physically located at a network’s endpoint. This category includes desktops, laptops, mobile phones, servers, tablets, printers, and even virtual environments. Over 70% of cybercrime threats enter through endpoints.
This threat goes hand in hand with the danger of home office attacks since remote employees increasingly rely on “always-on” endpoint devices like those listed above.
Fileless Malware and Ransomware Now cybercriminals are playing even dirtier.
While cybercriminals and hackers are not known for playing fair, this tactic is a new low. Traditional detection methods look for malicious file attachments or new file creation. Fileless ransomware and malware attacks use the approved software tools and platforms already in place in a corporate network, thereby bypassing standard detection methods. This process is called a “Living off the Land “(LotL) attack.
For example, a hacker could email a link to a malicious website that can launch system tools that will retrieve additional payloads and run them in the targeted system's memory when visited. To make matters worse, since these attacks use the host’s framework, hackers don’t have to spend time developing the needed tools. Consequently, it takes less time to create new varieties of malware.
Phishing Scams and Other Social Engineering Attacks When something works, you stick with it; phishing unfortunately works.
In the context of Internet security issues, social engineering is the practice of manipulating people into giving out personal or confidential information that hackers can ultimately use to perpetrate fraud and other cybercrimes. It’s a form of mind games played by cybercriminals.
Phishing relies on humans engaging in high levels of interaction with electronic communications (e.g., emails). Thanks once again to COVID and ensuing lockdowns and WFH models, more people rely on texts and emails to perform routine work-related tasks otherwise done in person, pre-pandemic. The uptick in electronic usage presents a tempting target for an attack method that already enjoys much success.
For example, have discovered an email in your inbox, confirming a purchase you didn’t make or warning you of breach in your credit card’s security? These letters usually provide a link and a message that says something like, “If you didn’t order this product or subscription, click here to resolve the issue.” Voila! It’s a phishing attack.
And the pandemic itself makes it even worse. People are eager for new information regarding testing, vaccination, and other pandemic-related news, topics that unscrupulous actors can exploit with phishing scams. Think of a fraudulent email from an official-looking government agency asking for the recipient’s personal health information “for pandemic tracking purposes.”
This threat comes in three common forms. There’s phishing (attacks made via email or web browsing), SMS-based phishing (also called Smishing, attacks delivered via SMS messages on your phone), and PDF scams (a phishing variant that attaches a toxic PDF to an email for the target to open). For extra credit and the sake of completeness, let’s add voice phishing or vishing to the list. Vishing tries to make targets give up personal and financial information over the phone. This attack method still falls into the world of Internet Technology since many vishing attacks use Voice Over Internet Protocol (VoIP) features like automated systems and caller ID spoofing.
Simple tip for your friends and family: If you receive an email confirming an alleged purchase or a security breach on one of your accounts, look at the domain name in the sender’s email address. It’s doubtful that if someone purchased $1000 worth from your Amazon account, the notification would come from “badanov@vostavich.ru” or even more discreet, "sales@amazo.ncom." No matter how convincing the email format and logos look, always check the sender's email.
Cloud Security Risks The cloud is phenomenal, but it is fallible.
The cloud is a cost-effective, convenient, scalable, simple, and secure way to store and retrieve data, run software subscriptions, and lease virtual machines. However, it’s not perfect and has the same vulnerabilities as other IT elements.
Many businesses and organizations quickly migrated to the cloud to help offset the increased demands for resources brought on by the pandemic. However, this haste resulted in less stringent security and vetting procedures or even going with a less reliable cloud platform provider due to budget and time constraints.
Whatever the reason, the increased reliance on cloud computing in the wake of lockdown inspired WFH had turned many of these cloud infrastructures into vulnerable targets with a wide attack surface. It doesn’t have to be this way, though. If companies shop around for a reliable provider and find a service to train their IT staff in cloud security procedures, they can mitigate many risks.
Human Error When hitting “Reply All” causes a catastrophe.
Nobody’s perfect and mistakes happen. Unfortunately, sometimes those mistakes can have catastrophic consequences for businesses. Take, for instance, accidental sharing, where an employee accidentally sends sensitive information to people who shouldn’t see that information. This mistake could mean anything from specific departments within the organization getting information otherwise restricted or accidentally sending confidential customer data to the public.
But that’s not the only manifestation of human error. Having lunch at Panera, Karen from HR leaves her laptop open and logged into her company's account because she wants to refill her drink. Joe from Accounting leaves his company-issued smartphone in the front seat of his unlocked car while he and his work buddies grab a Friday night drink. In these cases, hackers and cybercriminals don’t even have to exert much effort; careless treatment of devices that access a company’s IT resources makes it easier to gain illegal access. Granted, this issue doesn’t entail criminal activity or willful maliciousness, but as long as mistake-prone humanity works in the corporate world, people will make careless and sometimes fatal mistakes.
Noteworthy Cyberattacks Here are some of the nastier recent cyberattacks
According to Crowdstrike, a cybersecurity firm, cybercrimes are on the rise, reporting a 400 percent increase in threatening network intrusions in 2019 and 2020 combined. Here’s a sample of the last few years’ worth of massive data breaches. Facebook data breach. This breach occurred in 2019 and affected over half a billion users. Two third-party app datasets were exposed to public web users, including account names, Facebook IDs, likes, comments, and reactions. Yahoo! In August 2013, hackers compromised over three billion accounts. The stolen information likely consisted of names, email addresses, phone numbers, dates of birth, security questions and answers, and passwords. Fortunately, bank information and credit card data were untouched. CAM4. The adult streaming website experienced a breach in March 2020 that affected over 10 billion records, including names, email addresses, sexual orientation, and chat transcripts, among others. LinkedIn. Over half a billion LinkedIn user profiles were found on the Dark Web in April of 2021. This information included names, account IDs, phone numbers, profile links, gender, and other work-related personal information. Experian. In April 2021, an independent security researcher discovered an unsecured Experian API that resulted in a data leak. This breach let anyone easily access tens of millions of Americans’ personal credit scores just by entering their names, date of birth, and mailing address. If there is just one takeaway from all of this, it’s that the pandemic has increased the likelihood of cybersecurity threats, and everyone, whether a corporation or consumer, must exercise extra caution and vigilance. Tightened security practices, using antivirus software, and dash more skepticism will help reduce the number of successful breaches.
A final scary truth about cyber attacks is that hackers often wait long periods of time before actually exploiting cybersecurity vulnerabilities. They find the vulnerability and know they can exploit it, but then wait weeks, months, or even years until just the right moment to strike.
Fortunately, there are businesses like Remote Cloud Consulting which can take a systematic and comprehensive approach in securing your mission critical systems and intellectual property.