Ten Myths About Cybercrime

Don't let a cybersecurity fantasy stop you from building the effective countermeasures you need to protect your organisation from attack.

Cybercrime is all over the place, with damages, according to one estimate by Cybersecurity Ventures, expected to double from $3 trillion in 2015 to $6 trillion by 2021. 

In a prominent 2016 ransom attack, according to the 2016 McAfee Threat Report, a criminal was supposedly able to pocket $121 million within just six months, netting $94 million after expenses. 

Still, too often people believe in myths that prevent them from building effective counter-measures. Here are some examples:

Myth #1: Only large enterprises need to worry

No one is immune. Cyber-crime is affecting everybody, people and businesses of all sizes alike. 

Radware concluded in their 2016-2017 Global Application & Network Security Report that 98% of organisations experienced cyberattacks in 2016. A reported 31% of these attacks were directed at small and mid-sized companies with less than 250 employees.

Myth #2: Threats are completely overrated; it’s not a big deal!

That’s wishful thinking; the frequency of incidents is eye-opening. According to McAfee Labs’ Threats Report, the average mid-sized organisation (1,000–3,000 employees) encounters 11–20 incidents in a single day. 

Larger organisations (3,001–5,000 employees) are slightly busier, with the median at 21–30 incidents per day. The largest organisations (more than 5,000 employees) are busiest, with the median at 31–50 incidents daily.

Myth # 3: Bad guys are always outsiders

According to the Radware report, roughly one-third (27%) of all incidents are caused by insiders due to malicious or accidental actions. Some sources believe that number to be much higher. 

Indeed, users are often unaware and easy to dupe. In a more recent Verizon study, 30% of phishing messages were opened by the target across all campaigns. Some 12% even went on to click the malicious attachment or link and thus enabled the attack to succeed.

Myth #4: Companies are prepared to combat cyber-crime

New research this year from by BMC and Forbes suggests that 68% plan to enhance incident response capabilities in the next 12 months. This seems to be overdue as companies are still pretty unprepared. The report notes that 40% have no incident response plans, while 70% have no cyber-insurance.

Myth #5: I’d sign up for an insurance policy if I could.
 
It’s a booming market. Perhaps one of the areas experiencing the strongest growth within the insurance area is cyber-security. As a matter of fact, annual gross written premiums are set to triple, from around $2.5 billion in 2015 to $7.5 billion by 2020, according to PWC.

Myth #6: All of our PCs are equipped with antivirus and encryption.

Even so, bad news: by 2020, PCs will only play a minor role as the vast majority of users will opt for mobile devices such as tablets and smartphones instead. According to a 2015 prediction from Cisco, traffic from wireless and mobile devices will account for 66% of all IP traffic worldwide. 

Data stored on connected devices will be five times higher than data stored in data centers. Devices are used in highly insecure environments, including Wi-Fi hotspots, where intruders could potentially interfere. Moreover, according to a 2013 Ernst & Young whitepaper, millions of cell phones and smartphones are lost or stolen every year. Over their lifespan, approximately 22% of the total number of mobile devices produced will disappear, and over 50% of these will never be recovered.

Myth #7: We have great firewalls and network security, why bother?

Survey results from F5 Networks infer that network security is often not the issue; 57% struggle with the application layer instead. The frequency and severity of attacks on the application layer are considered much greater than at the network layer. 

Fifty-five percent say the application is attacked more often, with 58% thinking these attacks are more severe than at the network layer. Furthermore, there is a big mismatch in terms of budget allocation: on average, 18% of the IT security funding is dedicated to application security. More than twice that amount (39%) is pumped into network security.

Myth #8: Millennials are digital natives and more cautious

The common assumption that young talent, especially millennials, are digital natives and tech-savvy enough to safeguard corporate data is probably wrong. In fact, it’s likely going to be the opposite. 

Young people tend to be more relaxed and less concerned about privacy. They need even more awareness of today’s threats as they’re used to a completely different mindset where life is all about sharing, via social media and other channels that aren’t necessarily secure.

Myth #9: Strong passwords solve the issue

Strong passwords are powerful, but only when combined with other measures such as a two-factor authentication, for example. If strong passwords are too complicated to remember or users are forced to change them too frequently, people won’t be able to memorise them and will start making notes in one form or the other, thereby undermining even the most sophisticated security tools.

Myth #10: Let’s just hire a few more capable IT security gurus

Being understaffed remains the prime issue when it comes to countering cybercrime. Despite 47% of executives surveyed in 2017 by BMC and Forbes being willing to allocate more resources, the key question is how to find them. In a Trustwave 2016 report, 57% of respondents reported that finding and recruiting talented IT security staff is a “significant” or “major” challenge. Retaining these people is also viewed as a difficult problem by 35% of the respondents. 

There was a severe cybersecurity workforce gap, with 1 million vacancies in 2016, says Cyber Security Ventures. The shortage is expected to worsen and reach 1.5 million by 2019. Thus, hiring is a great idea, but much easier said than done.

Dark Reading
 

You Might Also Read: 

Directors Report January 2017. Cyber Security Checklist For Management (£)

Cybercrime Is A Growing Threat To Small Business:

Cybercrime Cost The Global Economy $450Billion In 2016:

Why SMEs Need Cyber Insurance:

 

« Snowden Can Stay In Russia For As Long As He Likes
Technology Can Not Diminish Insider Threats By Itself »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Ascentor

Ascentor

Ascentor specialises in independent information and cyber security consultancy. We’re experienced industry experts, providing cyber security services since 2004.

TBG Security

TBG Security

TBG provides a portfolio of services including cyber security, compliance and continuity solutions.

Applause

Applause

Applause provides real-world software testing for functionality, usability, accessibility, load, localization and security.

Military Cyber Professionals Association (MCPA)

Military Cyber Professionals Association (MCPA)

MCPA are a team of Soldiers, Sailors, Airmen, Marines, Veterans and others interested in the development of the American military cyber profession.

Convercent

Convercent

We offer comprehensive and integrated compliance management, reporting, and analytics. A 360-degree view of compliance drives efficiency by aligning initiatives and data into a single dashboard.

SwiftSafe

SwiftSafe

SwiftSafe is a cybersecurity consulting company providing auditing, pentesting, compliance and managed security services.

Carbide

Carbide

Carbide (formerly Securicy) breaks down enterprise-class security and privacy requirements and makes them accessible to, and achievable by, companies of all sizes.

Dualog

Dualog

Dualog provides a maritime digital platform which ensures that services work reliably and securely onboard.

SmartContractAudits.com

SmartContractAudits.com

SmartContractAudits.com is the leading platform for finding companies providing smart contract auditing services.

Police Digital Security Centre (PDSC)

Police Digital Security Centre (PDSC)

PDSC is a not-for-profit organisation, owned by the police, that works across the UK in partnership with industry, government, academia and law enforcement.

Framatome

Framatome

Framatome Cybersecurity portfolio is directly inspired by its unique experience in nuclear safety for critical information systems and electrical systems design.

Xmirror Security

Xmirror Security

Xmirror Security focuses on integrated detection and defense of the continuous threat to the DevSecops software supply-chain with artificial intelligence technology as the core.

Onyxia Cyber

Onyxia Cyber

Onyxia's unique dynamic cybersecurity platform identifies gaps and prioritizes recommendations for proactive cybersecurity strategy, performance, remediation and management.

National Cybersecurity Agency (ACN) - Italy

National Cybersecurity Agency (ACN) - Italy

The ACN is the National Authority for Cybersecurity in Italy. the Agency promotes public-private initiatives to strengthen the national cybersecurity and resilience posture.

ITQ Latam

ITQ Latam

ITQ Latam are specialists in cybersecurity, in a convergent ecosystem of technological solutions in infrastructure, cloud and security networks.

Sacumen

Sacumen

Sacumen is a niche player in the cybersecurity market, solving critical problems for security product companies.