Dealing With Cyber Security Threats Is Hard Work

Modern society, economy, and critical infrastructures have become highly dependent on computer networks and information and communications technologies (ICT), however, with such advances comes a rise in the scale and complexity of cyber security challenges. 

Increased dependence on ICT and the pervasive inter-connectivity of critical infrastructure generates exposure to an evolving range of threats. Securing your network against cyber threats can be challenging, but taking care of the basics can go a long way towards keeping hackers out.

Cyber security is hard. Technology is continually changing, cyber criminals' tools and techniques are always evolving and maintaining the security of a network with users who each want to do their own thing without being restricted by security is a constant challenge.

Ransomware is a significant problem as cyber criminals threaten to encrypt networks and victims give into their extortion demands for the decryption key and government cyber security agencies in the US and UK while have issued warnings about the hacking and cyber threats as a result of Russia's invasion of Ukraine. But while these are some of the most headline-grabbing cyber security threats, there are other issues that might not be discussed as much but are still significant cyber security problems that organisations must be prepared to deal with. 

For many businesses remote working has become the normal and organisations are moving towards cloud based applications and services to enable this.  But while this shift has been effective for productivity and improving employee happiness, hybrid working also comes with additional cyber security risks that organisations might not be thinking about making it easier for cyber criminals to operate. 

"The main concern that remains for me around remote work is inadvertent exposure and public-facing applications," says Jamie Collier, senior threat intelligence advisor at Mandiant

For example, cloud applications like Microsoft Office 365 and Google Workspace offer employees the ability to work from anywhere, but if hackers can get user names and passwords they can enter the network. That's especially true if the password is weak enough to be cracked in a brute force attack.  

Cyber Security Updates Are Often Ignored

“In 2020 and 2021, we observe a spike in non-malicious incidents, as the COVID-19 pandemic became a multiplier for human errors and system misconfigurations, up to the point that most of the breaches in 2020 were caused by errors, “says an ENISA statement. "We increasingly see all of those configuration issues and threat groups are actually getting a lot of success, they don't even necessarily need an exploit because the defenders provided that open goal," says Jamie Collier. 

  • It's not only security vulnerabilities in cloud based applications that are being ignored and cyber security teams often struggle to manage vulnerability management and patching. "The velocity of vulnerabilities to our infrastructure, technologies and tools over the last year has created quite a challenge for organisations," says Thomas Etheridge, SVP of services at Crowdstrike
  • Phishing is also used in several ways, from stealing sensitive information like bank details and passwords from individuals to being used as the opening stage in sophisticated cyber attacks targeting whole organisations. 

All it takes is a convincing email lure and a well-designed fake version of a real website, or any other online service that people use a login name and password to access, and data falls right into the hands of the attackers. Hackers target businesses using phishing emails and social engineering to target businesses and trick employees into transferring large sums of money to bank accounts owned by the fraudsters.  

"If you actually look at the amount of money business email compromise groups are making, it's significantly higher than what ransomware groups are making," says Jason Steer, CISO at Recorded Future

Cyber Security Basics Make A Big Difference

When it comes to securing cloud services, emails and the wider network, there are steps that information security teams can take that can help protect users, and the network, from most cyberattacks.  

  • Applying security patches as soon as possible prevents cyber criminals from exploiting known vulnerabilities in software to enter or move around networks, so it should be a pillar of cybersecurity strategy for any organisation in any sector. 
  • Using Multi-Factor Authentication (MFA) can also provide a significant barrier to cyber attacks, because it means that, even if a hacker has a legitimate username and password, they're unable to take control of a cloud service or email account without the user approving it. 
  • Users should not use simple passwords as the more complex passwords makes accounts more difficult to break into. Using a password manager can help with this.  

These measures might sound like basics of cyber security, but to ensure that people and networks are safe from cyber attacks, the basics need to be put in place before anything else.

ENISA:    Roderic Broadhurst:    Science Direct:    ZDNet:    Futurelearn:    Security Magazine

You Might Also Read: 

How to Prepare Your Security Team For The Future Of Vulnerability Management:

 

« Hot Competition To Build 5G In India
Unexplained Surge In Robotext Scams »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Caliber Security Partners

Caliber Security Partners

Caliber Security Partners is a full-service information security company, with a wide range of security services for clients with varying levels of security maturity.

TraceSecurity

TraceSecurity

TraceSecurity, a leading pioneer in cloud-based security solutions, provides IT governance, risk and compliance (GRC) management solutions.

International Federation of Robotics (IFR)

International Federation of Robotics (IFR)

The International Federation of Robotics connects the world of robotics around the globe. Our members come from the robotics industry, industry associations and research & development institutes.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

ACPL Systems

ACPL Systems

We offer leading-edge technology solutions, expert professional and managed services and proven methodologies to ensure your data is protected and business risks are reduced.

Capula

Capula

Capula is a leading system integration specialist for control, automation and operational IT systems across all applications and industry sectors.

MPC Alliance

MPC Alliance

A consortium of developers and practitioners of multiparty computation (MPC), committed to accelerating market awareness and adoption of MPC to increase the security and privacy of online services.

DCX Technology

DCX Technology

Recognized as a leader in security services, DXC Technology help clients prevent potential attack pathways, reduce cyber risk and improve threat detection and incident response.

Fend

Fend

Fend secures smart infrastructure. We provide a robust, highly secure way to have situational awareness of IoT enabled assets.

Fudo Security

Fudo Security

Fudo Security is a leading provider of privileged access management and privileged session monitoring solutions.

Datacentrix

Datacentrix

Datacentrix provides end-to-end cybersecurity services for the operational technology (OT) and IT environments to monitor, assess and defend our customers' information assets.

Trusted Security Solutions (TSS)

Trusted Security Solutions (TSS)

TSS are specialist in IT Security and providing Cybersecurity Solutions & Services combined with storage and backup.

Synoptek

Synoptek

Synoptek is a global systems integrator and managed IT services provider (MSP). We offer comprehensive IT management and consultancy services to organizations worldwide.

KnoTra Global

KnoTra Global

KnoTra Global is a next-generation Managed Service provider with a portfolio of services including Cybersecurity Solutions, Network Management, IT Leadership, and Day-to-Day Helpdesk and IT services.

SecureAck

SecureAck

From our A-Op SaaS automation platform to Managed Automation-as-a-Service (MAaaS), SecureAck offer powerful security automation the way that best suits your organisation's needs.

Pacific Certifications

Pacific Certifications

Pacific Certifications provide accredited certification, training and support services to help you improve processes, performance and products and services.