Top Cyber Threats For Business In 2020

The security threat has seen an unparalleled increase in IT systems and AI analysis which has benefits but is also set to make 2020 a real cyber security problem for most businesses. 

As organisations as diverse as hospitals, banks, schools, and retailers continue to grow their digital infrastructure, they’re in danger of unwittingly expanding their attack surface, offering new opportunities for hackers to make money. Furthermore, the average ransomware payment is growing as criminals become more sophisticated in their attacks.

Attackers focused on larger targets and honed their attacks using social engineering. There is a rising use of ransomware strains that tend to demand higher ransoms, like SamSam and RyukRecently, a top energy executive was tricked into transferring £200,000 of company money to fake recipients  following a phone call from that appeared to come from his boss at the German parent company. 

The average ransomware incident lasted 6.2 days and cost $54,904 in downtime, and the average ransomware-related downtime increased 47% over Q3.

The biggest factor in that increasing downtime is the rising number of compromised backup systems. 75% of organisations that paid a ransom had their backups encrypted by ransomware too. Professional services is the hardest-hit sector at 22.4%, followed by software services (13.8%) and financial services and healthcare, the latter two sectors each garnering 12.1%.

An effective response to these threats will require a blend of best practice basics and a willingness to embrace new security technologies. That’s because, although there will be new hacking tools and techniques to tackle over the coming year, many of the challenges facing organisations will be a continuation of current trends.

Here Are Six Top Threats To Watch Out For:

Leaking Email: Email remains the number one threat vector for global organisations. It continues to be the easiest and most effective way for cyber-attackers to harvest user credentials and personal information, and/or install malware on a target’s machine. In 2020, Chief Information Security Officers CISOs must do more to make this channel more resilient to threats, by investing in Domain-based Message Authentication, Reporting and Conformance (DMARC), enforcing Multi-Factor Authentication (MFA), improving security training and awareness programmes and enforcing other policies such as disabling macros.

New AI-powered tools are becoming more widespread, offering an innovative and more effective way to detect spear-phishing and other fraudulent messages.

Email Fakes and Compromise: Business Email Compromises (BEC) cost organisations $1.3 billion in 2018, half of the total losses associated with global cyber-crimes reported to the FBI that year. Organisations are going to need to build staff awareness raising about the threat into their internal training programmes, as well as rolling out technologies and processes designed to spot and block attacks. 

Deepfakes: An potntiallyy bigger threat is from  AI-based spoof videos and audio. These so-called “deepfakes” are already being used to trick employees into making wire transfers. This is likely to be just the tip of the iceberg, and will need advanced tools and improved employee training to mitigate.

Cloud Platforms: The most obvious manifestation of digital transformation investment is increased spending on cloud platforms. But the advent of hybrid and multi-clouds is creating complexity that many in-house security teams are ill-equipped to manage. 

Ransomware: Over the past 12 months, we’ve seen an evolution of one of the biggest threats of recent years, as cyber-criminals refocused their ransomware campaigns on fewer targets. But that doesn’t mean your business is safe in 2020. In fact, the hackers are going to extra lengths to make sure their attacks are successful, deploying fileless malware techniques, RDP compromise and lateral movement to stay hidden until the time is right to strike. 

Best practice security steps like Multi Factor Authentication (MFA), network segmentation and prompt patching can mitigate many attacks, while regular on- and offline back-ups are essential.

Supply Chain Problems: Modern organisations are nothing without their supply chains. Whether it’s a bakery relying on providers of flour, water and energy, or an online retailer with an expansive ecosystem of digital suppliers, these networks provide the products and services essential to business operations. But they’re also a potential security risk. Hackers will become increasingly adept at exploiting these supply chain relationships to further their own ends.

In 2020 there will be more attacks on Managed Service Providers, which provide a handy stepping-stone into client networks, and digital skimming campaigns targeting the supply chain. The GDPR brought in strict new rules designed to improve transparency and accountability for just these circumstances. 

Chief Information Security Officers would do well to revisit their Service Level Agreements and Partnership agreements to guarantee a baseline level of cybersecurity among all their suppliers, or they will also risk the wrath of the regulators.

Barracuda Blog:      Infosecurity Magazine:      CityAM:       FBI IC3

You Might Also Read:

Why An Effective Security Culture Is Essential For Your Organisation:

Hackers Steal $50 Million From Leading Aviation Design Company:

 

« Britain Allows Huawei 5G Network Access Against US Advice
President Putin Addresses The Russian Tech Gap »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Enosys Solutions

Enosys Solutions

Enosys Solutions is an IT security specialist with a skilled professional services team and 24x7 security operations centre servicing corporate and public sector organisations across Australia.

BigWeb Technologies

BigWeb Technologies

BigWeb Technologies is dedicated to provide its clients with ICT related services including Infrastructure Solutions, Consultancy and Security.

XM Cyber

XM Cyber

XM Cyber is a leading hybrid cloud security company that’s changing the way innovative organizations approach cyber risk.

Cyber Physical Security Research Center (CPSEC)

Cyber Physical Security Research Center (CPSEC)

CPSEC aims to contribute to the security enhancement of industrial infrastructure that creates value across cyber space and physical space.

DreamIt Ventures

DreamIt Ventures

DreamIt Ventures is an early stage venture fund that accelerates startups building transformative tech products in the fields of Healthtech, Securetech, and Urbantech.

Marlabs

Marlabs

Marlabs is a Digital Technology Solutions company that helps companies adopt digital transformation using a comprehensive framework including Digital Automation, Enterprise Analytics and Security.

Prodera Group

Prodera Group

Prodera Group is a specialist technology consulting partner trusted to help navigate the complex and dynamic lifecycle of change and transformation.

ISTC Foundation

ISTC Foundation

ISTC Foundation is one of the leading innovation centers in Armenia, founded by joint initiative of IBM, USAID, Armenian Government and Enterprise Incubator Foundation.

MazeBolt Technologies

MazeBolt Technologies

Israel-based MazeBolt is an innovation leader in cybersecurity, with over two decades of experience in pioneering DDoS protection solutions.

Capital Network Solutions

Capital Network Solutions

Capital Network Solutions are a highly accredited managed IT services and consultancy provider, specialising in cyber security, infrastructure and communications.

Identity Digital

Identity Digital

Identity Digital simplifies and connects a fragmented online world with domain names and related technologies that allow people and businesses to build, market and own their digital identities.

Kirk ISS

Kirk ISS

Kirk ISS are the leading provider of IT services in the Cayman Islands. We offer best-in class hardware, software, communications and cloud computing, all backed by professional services support.

Cyberplc

Cyberplc

Cyberplc is a global cybersecurity consulting firm providing services to government, the public sector and enterprises.

OxCyber

OxCyber

OxCyber's mission is to ignite and encourage cybersecurity and technology growth in the Thames Valley through meetings, webinars, in person events, workshops and mentorship programs.

Reco AI

Reco AI

Reco is an identity-centric SaaS security solution that empowers organizations with full visibility into every app, identity, and their actions to control risk in their SaaS ecosystem.

Post-Quantum Cryptography Alliance (PQCA)

Post-Quantum Cryptography Alliance (PQCA)

The alliance seeks to address cryptographic security challenges posed by quantum computing by producing high-assurance software implementations of standardized algorithms.