Dealing With Cyber Security Threats Is Hard Work

Modern society, economy, and critical infrastructures have become highly dependent on computer networks and information and communications technologies (ICT), however, with such advances comes a rise in the scale and complexity of cyber security challenges. 

Increased dependence on ICT and the pervasive inter-connectivity of critical infrastructure generates exposure to an evolving range of threats. Securing your network against cyber threats can be challenging, but taking care of the basics can go a long way towards keeping hackers out.

Cyber security is hard. Technology is continually changing, cyber criminals' tools and techniques are always evolving and maintaining the security of a network with users who each want to do their own thing without being restricted by security is a constant challenge.

Ransomware is a significant problem as cyber criminals threaten to encrypt networks and victims give into their extortion demands for the decryption key and government cyber security agencies in the US and UK while have issued warnings about the hacking and cyber threats as a result of Russia's invasion of Ukraine. But while these are some of the most headline-grabbing cyber security threats, there are other issues that might not be discussed as much but are still significant cyber security problems that organisations must be prepared to deal with. 

For many businesses remote working has become the normal and organisations are moving towards cloud based applications and services to enable this.  But while this shift has been effective for productivity and improving employee happiness, hybrid working also comes with additional cyber security risks that organisations might not be thinking about making it easier for cyber criminals to operate. 

"The main concern that remains for me around remote work is inadvertent exposure and public-facing applications," says Jamie Collier, senior threat intelligence advisor at Mandiant

For example, cloud applications like Microsoft Office 365 and Google Workspace offer employees the ability to work from anywhere, but if hackers can get user names and passwords they can enter the network. That's especially true if the password is weak enough to be cracked in a brute force attack.  

Cyber Security Updates Are Often Ignored

“In 2020 and 2021, we observe a spike in non-malicious incidents, as the COVID-19 pandemic became a multiplier for human errors and system misconfigurations, up to the point that most of the breaches in 2020 were caused by errors, “says an ENISA statement. "We increasingly see all of those configuration issues and threat groups are actually getting a lot of success, they don't even necessarily need an exploit because the defenders provided that open goal," says Jamie Collier. 

  • It's not only security vulnerabilities in cloud based applications that are being ignored and cyber security teams often struggle to manage vulnerability management and patching. "The velocity of vulnerabilities to our infrastructure, technologies and tools over the last year has created quite a challenge for organisations," says Thomas Etheridge, SVP of services at Crowdstrike
  • Phishing is also used in several ways, from stealing sensitive information like bank details and passwords from individuals to being used as the opening stage in sophisticated cyber attacks targeting whole organisations. 

All it takes is a convincing email lure and a well-designed fake version of a real website, or any other online service that people use a login name and password to access, and data falls right into the hands of the attackers. Hackers target businesses using phishing emails and social engineering to target businesses and trick employees into transferring large sums of money to bank accounts owned by the fraudsters.  

"If you actually look at the amount of money business email compromise groups are making, it's significantly higher than what ransomware groups are making," says Jason Steer, CISO at Recorded Future

Cyber Security Basics Make A Big Difference

When it comes to securing cloud services, emails and the wider network, there are steps that information security teams can take that can help protect users, and the network, from most cyberattacks.  

  • Applying security patches as soon as possible prevents cyber criminals from exploiting known vulnerabilities in software to enter or move around networks, so it should be a pillar of cybersecurity strategy for any organisation in any sector. 
  • Using Multi-Factor Authentication (MFA) can also provide a significant barrier to cyber attacks, because it means that, even if a hacker has a legitimate username and password, they're unable to take control of a cloud service or email account without the user approving it. 
  • Users should not use simple passwords as the more complex passwords makes accounts more difficult to break into. Using a password manager can help with this.  

These measures might sound like basics of cyber security, but to ensure that people and networks are safe from cyber attacks, the basics need to be put in place before anything else.

ENISA:    Roderic Broadhurst:    Science Direct:    ZDNet:    Futurelearn:    Security Magazine

You Might Also Read: 

How to Prepare Your Security Team For The Future Of Vulnerability Management:

 

« Hot Competition To Build 5G In India
Unexplained Surge In Robotext Scams »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

BakerHostetler

BakerHostetler

BakerHostetler is one of the largest law firms in the USA We have five core practice groups including a specialty practice team in Privacy and Data Protection.

Echelon

Echelon

Echelon Company is a provider of information security services specializing in certification of security software and hardware products in Russia.

Cambridge Intelligence

Cambridge Intelligence

Cambridge Intelligence are experts in network visualization and finding hidden trends in complex connected data. Applications include cybersecurity.

Operational Center for Information Systems Security (COSSI)

Operational Center for Information Systems Security (COSSI)

COSSI is responsible for the detection and mitigation of cyber attacks directed at French Government information systems.

Crypta Labs

Crypta Labs

Crypta Labs is an Award Winning IOT Security startup that is developing a quantum-based encryption chip to secure the Internet of Things.

Critifence

Critifence

Critifence provides unique Cyber Security solutions designed for Critical Infrastructure, SCADA and Industrial Control Systems.

SparkCognition

SparkCognition

SparkCognition’s AI-powered solutions enhance cybersecurity, identify and prevent equipment failures before they happen, and provide prescriptive intelligence for maintaining your most critical assets

7 Elements

7 Elements

7 Elements is an independent IT security testing company providing expertise in technical information assurance through security testing, incident response and consultancy.

Quantstamp

Quantstamp

Quantstamp are experts in Smart Contract Security Audits. We provide verification that your decentralized system works as intended.

Speedinvest

Speedinvest

Speedinvest is one of Europe’s most active early-stage investors with a focus on Deep Tech, Fintech, Industrial Tech, Network Effects, and Digital Health.

Guernsey

Guernsey

Guernsey provides a wide range of engineering, architecture and consulting services to multiple markets, including cybersecurity consulting and CMMC certification.

Strike Security

Strike Security

Strike Security offers a continuous penetration testing platform that combines automation with ethical hackers.

Guardz

Guardz

Guardz helps small and growing businesses to go from zero or low cyber protection to having comprehensive security – in the quickest and most straightforward way.

Geobridge

Geobridge

Geobridge was one of the first information security solutions providers to support cryptography and payment applications for payment processors, financial institutions and retail organizations.

CyAmast

CyAmast

CyAmast is an IoT Network security and analytics company that is changing the way enterprise and governments detect and protect networks from the pervasive threat of cyber attacks.

M6iT Consulting

M6iT Consulting

M6iT Consulting is an industry-leading solution partner managing the IT requirements for a full range of companies.