Dealing With Cyber Security Threats Is Hard Work

Modern society, economy, and critical infrastructures have become highly dependent on computer networks and information and communications technologies (ICT), however, with such advances comes a rise in the scale and complexity of cyber security challenges. 

Increased dependence on ICT and the pervasive inter-connectivity of critical infrastructure generates exposure to an evolving range of threats. Securing your network against cyber threats can be challenging, but taking care of the basics can go a long way towards keeping hackers out.

Cyber security is hard. Technology is continually changing, cyber criminals' tools and techniques are always evolving and maintaining the security of a network with users who each want to do their own thing without being restricted by security is a constant challenge.

Ransomware is a significant problem as cyber criminals threaten to encrypt networks and victims give into their extortion demands for the decryption key and government cyber security agencies in the US and UK while have issued warnings about the hacking and cyber threats as a result of Russia's invasion of Ukraine. But while these are some of the most headline-grabbing cyber security threats, there are other issues that might not be discussed as much but are still significant cyber security problems that organisations must be prepared to deal with. 

For many businesses remote working has become the normal and organisations are moving towards cloud based applications and services to enable this.  But while this shift has been effective for productivity and improving employee happiness, hybrid working also comes with additional cyber security risks that organisations might not be thinking about making it easier for cyber criminals to operate. 

"The main concern that remains for me around remote work is inadvertent exposure and public-facing applications," says Jamie Collier, senior threat intelligence advisor at Mandiant

For example, cloud applications like Microsoft Office 365 and Google Workspace offer employees the ability to work from anywhere, but if hackers can get user names and passwords they can enter the network. That's especially true if the password is weak enough to be cracked in a brute force attack.  

Cyber Security Updates Are Often Ignored

“In 2020 and 2021, we observe a spike in non-malicious incidents, as the COVID-19 pandemic became a multiplier for human errors and system misconfigurations, up to the point that most of the breaches in 2020 were caused by errors, “says an ENISA statement. "We increasingly see all of those configuration issues and threat groups are actually getting a lot of success, they don't even necessarily need an exploit because the defenders provided that open goal," says Jamie Collier. 

  • It's not only security vulnerabilities in cloud based applications that are being ignored and cyber security teams often struggle to manage vulnerability management and patching. "The velocity of vulnerabilities to our infrastructure, technologies and tools over the last year has created quite a challenge for organisations," says Thomas Etheridge, SVP of services at Crowdstrike
  • Phishing is also used in several ways, from stealing sensitive information like bank details and passwords from individuals to being used as the opening stage in sophisticated cyber attacks targeting whole organisations. 

All it takes is a convincing email lure and a well-designed fake version of a real website, or any other online service that people use a login name and password to access, and data falls right into the hands of the attackers. Hackers target businesses using phishing emails and social engineering to target businesses and trick employees into transferring large sums of money to bank accounts owned by the fraudsters.  

"If you actually look at the amount of money business email compromise groups are making, it's significantly higher than what ransomware groups are making," says Jason Steer, CISO at Recorded Future

Cyber Security Basics Make A Big Difference

When it comes to securing cloud services, emails and the wider network, there are steps that information security teams can take that can help protect users, and the network, from most cyberattacks.  

  • Applying security patches as soon as possible prevents cyber criminals from exploiting known vulnerabilities in software to enter or move around networks, so it should be a pillar of cybersecurity strategy for any organisation in any sector. 
  • Using Multi-Factor Authentication (MFA) can also provide a significant barrier to cyber attacks, because it means that, even if a hacker has a legitimate username and password, they're unable to take control of a cloud service or email account without the user approving it. 
  • Users should not use simple passwords as the more complex passwords makes accounts more difficult to break into. Using a password manager can help with this.  

These measures might sound like basics of cyber security, but to ensure that people and networks are safe from cyber attacks, the basics need to be put in place before anything else.

ENISA:    Roderic Broadhurst:    Science Direct:    ZDNet:    Futurelearn:    Security Magazine

You Might Also Read: 

How to Prepare Your Security Team For The Future Of Vulnerability Management:

 

« Hot Competition To Build 5G In India
Unexplained Surge In Robotext Scams »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Panzura

Panzura

Panzura optimizes enterprise data storage management and distribution in the cloud, making cloud storage simple and secure.

Cleafy

Cleafy

Cleafy are a team of fraud hunters, cybersecurity experts, data scientists, and software engineers. Our purpose is to make people’s life easier and free from the threats in the digital ecosystem.

DataVisor

DataVisor

DataVisor is a big data fraud detection and anti-money laundering solution.

maCERT

maCERT

maCERT is the national Computer Emergency Response Team for Morocco.

IT Association of Slovakia (ITAS)

IT Association of Slovakia (ITAS)

ITAS is a professional association of domestic and foreign companies operating in the field of information and communication technologies

Acutec

Acutec

Acutec is an award winning IT support, services and solutions provider including managed IT Security and backup/disaster recovery.

Veriato

Veriato

Veriato develops intelligent solutions that provide companies with visibility into the human behaviors and activities occurring within their network, making them more secure and productive.

Thinkst Applied Research

Thinkst Applied Research

Thinkst is an Applied Research company with a deep focus on information security.

AimBrain

AimBrain

AimBrain tools detect and prevent fraud, faster and more accurately than ever before.

CybeReady

CybeReady

CybeReady’s Autonomous Platform offers continuous adaptive training to all employees and guarantees significant reduction in organizational risk of phishing attacks.

Vanbreda

Vanbreda

Vanbreda Risk & Benefits is the largest independent insurance broker and risk consultant in Belgium and the leading insurance partner in the Benelux.

Exire Technologies

Exire Technologies

Exire Technologies is comprised of a team of professionals who are specialised in cybersecurity and a value added reseller and integrator of ICT security systems.

CybX Security LLC

CybX Security LLC

CybX is the first company of its kind to merge the practice of computer forensics with computer security and information security.

Gluu

Gluu

Modern Authentication for Digital Enterprise. Organizations around the world trust Gluu for large-scale, high-security identity & access management.

c0c0n

c0c0n

c0c0n is the longest running conferences in the area of Information Security and Hacking, in India.

Redblock

Redblock

Redblock's mission is to eliminate the drudgery and repetitive 'eye on the glass' work done by Security Teams.