Dealing With Cyber Security Threats Is Hard Work

Modern society, economy, and critical infrastructures have become highly dependent on computer networks and information and communications technologies (ICT), however, with such advances comes a rise in the scale and complexity of cyber security challenges. 

Increased dependence on ICT and the pervasive inter-connectivity of critical infrastructure generates exposure to an evolving range of threats. Securing your network against cyber threats can be challenging, but taking care of the basics can go a long way towards keeping hackers out.

Cyber security is hard. Technology is continually changing, cyber criminals' tools and techniques are always evolving and maintaining the security of a network with users who each want to do their own thing without being restricted by security is a constant challenge.

Ransomware is a significant problem as cyber criminals threaten to encrypt networks and victims give into their extortion demands for the decryption key and government cyber security agencies in the US and UK while have issued warnings about the hacking and cyber threats as a result of Russia's invasion of Ukraine. But while these are some of the most headline-grabbing cyber security threats, there are other issues that might not be discussed as much but are still significant cyber security problems that organisations must be prepared to deal with. 

For many businesses remote working has become the normal and organisations are moving towards cloud based applications and services to enable this.  But while this shift has been effective for productivity and improving employee happiness, hybrid working also comes with additional cyber security risks that organisations might not be thinking about making it easier for cyber criminals to operate. 

"The main concern that remains for me around remote work is inadvertent exposure and public-facing applications," says Jamie Collier, senior threat intelligence advisor at Mandiant

For example, cloud applications like Microsoft Office 365 and Google Workspace offer employees the ability to work from anywhere, but if hackers can get user names and passwords they can enter the network. That's especially true if the password is weak enough to be cracked in a brute force attack.  

Cyber Security Updates Are Often Ignored

“In 2020 and 2021, we observe a spike in non-malicious incidents, as the COVID-19 pandemic became a multiplier for human errors and system misconfigurations, up to the point that most of the breaches in 2020 were caused by errors, “says an ENISA statement. "We increasingly see all of those configuration issues and threat groups are actually getting a lot of success, they don't even necessarily need an exploit because the defenders provided that open goal," says Jamie Collier. 

  • It's not only security vulnerabilities in cloud based applications that are being ignored and cyber security teams often struggle to manage vulnerability management and patching. "The velocity of vulnerabilities to our infrastructure, technologies and tools over the last year has created quite a challenge for organisations," says Thomas Etheridge, SVP of services at Crowdstrike
  • Phishing is also used in several ways, from stealing sensitive information like bank details and passwords from individuals to being used as the opening stage in sophisticated cyber attacks targeting whole organisations. 

All it takes is a convincing email lure and a well-designed fake version of a real website, or any other online service that people use a login name and password to access, and data falls right into the hands of the attackers. Hackers target businesses using phishing emails and social engineering to target businesses and trick employees into transferring large sums of money to bank accounts owned by the fraudsters.  

"If you actually look at the amount of money business email compromise groups are making, it's significantly higher than what ransomware groups are making," says Jason Steer, CISO at Recorded Future

Cyber Security Basics Make A Big Difference

When it comes to securing cloud services, emails and the wider network, there are steps that information security teams can take that can help protect users, and the network, from most cyberattacks.  

  • Applying security patches as soon as possible prevents cyber criminals from exploiting known vulnerabilities in software to enter or move around networks, so it should be a pillar of cybersecurity strategy for any organisation in any sector. 
  • Using Multi-Factor Authentication (MFA) can also provide a significant barrier to cyber attacks, because it means that, even if a hacker has a legitimate username and password, they're unable to take control of a cloud service or email account without the user approving it. 
  • Users should not use simple passwords as the more complex passwords makes accounts more difficult to break into. Using a password manager can help with this.  

These measures might sound like basics of cyber security, but to ensure that people and networks are safe from cyber attacks, the basics need to be put in place before anything else.

ENISA:    Roderic Broadhurst:    Science Direct:    ZDNet:    Futurelearn:    Security Magazine

You Might Also Read: 

How to Prepare Your Security Team For The Future Of Vulnerability Management:

 

« Hot Competition To Build 5G In India
Unexplained Surge In Robotext Scams »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

CertiKit

CertiKit

CertiKit produce toolkit products that accelerate the adoption of ISO/IEC standards, including ISO 27001, helping organizations all over the world to realize the benefits as soon as possible.

Thales

Thales

Thales provides solutions, services and products that help its customers in the defence, aeronautics, space, transportation and digital identity and security markets to fulfil their critical missions.

Greenbone Networks

Greenbone Networks

Greenbone Networks delivers a vulnerability analysis solution for enterprise IT which includes reporting and security change management.

DataSunrise

DataSunrise

DataSunrise Data-Centric high-performance security software protects the sensitive data in real-time in cloud or on premises, and helps organizations to stay compliant.

MBL Technologies

MBL Technologies

MBL Technologies specializes in information assurance, enterprise security, privacy, and program/project management.

Omada

Omada

Omada is a leading provider of IT security solutions and services for identity management and access governance.

Glilot Capital Partners

Glilot Capital Partners

Glilot Capital Partners is an Israeli seed and early-stage VC. We specialize in businesses which disrupt enterprise technology, mainly in the fields of AI, big data and cybersecurity.

PurpleSynapz

PurpleSynapz

PurpleSynapz provides hyper-realistic Cyber Security Training with a modern curriculum and Cyber Range.

CACI International

CACI International

CACI is at the forefront of developing and delivering technological breakthroughs that transform and optimize government operations.

BitTrap

BitTrap

BitTrap helps companies worldwide detect attackers and put an early end to breaches, preventing data exfiltration and ransomware altogether.

Computer Services Inc (CSI)

Computer Services Inc (CSI)

CSI is a leading fintech, regtech and cybersecurity solutions partner operating at the intersection of innovation and service.

GTT Communications

GTT Communications

GTT are a global network provider that serves thousands of multinational and national enterprise, government and carrier customers with a portfolio of advanced connectivity and security services.

Transatlantic Cyber Security Business Network

Transatlantic Cyber Security Business Network

The Transatlantic Cyber Security Business Network is a coalition of UK and US cyber security companies which facilitates collaboration to help address critical cyber security challenges.

MAUSHIELD

MAUSHIELD

MAUSHIELD is the national platform for sharing cyber threat information and intelligence that can help organisations to improve their cybersecurity posture, minimize risks and prevent cyber-attacks.

ACDS (Advanced Cyber Defence Systems)

ACDS (Advanced Cyber Defence Systems)

ACDS was founded in the belief that cyber security can be done better. We’re combining emerging technologies and proven methods to bring a new approach to tackling the growing threat landscape.

Quantum Squint

Quantum Squint

Quantum Squint is a cutting-edge cybersecurity company specializing in the use of advanced regression management techniques to detect, analyze, and prevent vulnerabilities in digital systems.