Russian bots and North Korean ransomware are not part of a world-famous science fiction’s plot. They belong to the real world, the one in which we live, work, and play. But they might as well be elements of a novel because no matter how widespread they are, they also seem far away – especially for smaller, private firms.
If we look at affected entities, they usually are from the corporate category. In other words, those who have been subjected to cyber attacks have the means and muscle to act fast to defend their security systems. But that fact does not automatically eliminate your organisation from the list of targets. Further, you don’t have to wait for a catastrophic attack to cripple your business to do something. Here are three things to learn from the security issues that shook the world in 2017:
Incidents involving large and publicly known corporations typically get more media coverage. One of the most recent events to hit the headlines was the PyeongChang Winter Olympics cyberattack. According to a New York Times report, a preliminary hacking already took place, affecting more than 300 Olympics-related computer systems.
Prior to the opening ceremony on February 9th, cybersecurity experts warned against threats as well as attackers’ motives from unearthing embarrassing information on athletes to organisers and manipulating scoring or lighting systems.
The same report says that there are often two ways security researchers discuss risks with stakeholders. One, they talk about possible scenarios that have not happened in the real world. Two, they tackle previous attacks and their consequences. You can study the risks to your organisation using both techniques.
To kick off your research, you can dip into available resources and research platforms. The National Cyber Security Centre (NCSC) and Research Councils UK (RCUK) are behind the Academic Centres of Excellence in Cyber Security Research, which extend their services outside the academia.
The WannaCry ransomware attack in May 2017 affected more than 200,000 computers across 150 countries. Nissan Motor Manufacturing in the UK was one of the victims of this attack. WannaCry was a network worm that targeted older Microsoft systems through an exploit called EternalBlue. The attackers demanded a ransom to be paid in bitcoin. Given its impact on operations alone, this massive incident cost hundreds of millions if not billions of dollars in damages.
Further, WannaCry victims did not deploy the patches that Microsoft released when it discovered the vulnerability in March 2017, two months before the attack. When your system is infected, there is not much you can do. Prevention is your best bet against such threats. Evaluating your system’s security should be a protocol for your organisation. You can assess the vulnerabilities in your system as well as the strengths by simulating an attack or penetration testing.
According to UK penetration testing firm Bulletproof, penetration testing helps you uncover the weak points in your systems, infrastructure, and network through the use of tools and tricks available to real-world attackers. The firm adds that “periodic penetration testing is also a required part of many security standards, such as ISO 27001 and PCI DSS.”
Between April and June 2016, cybersecurity misconfiguration was the top most common cyber incident in the UK. The Information Commissioner’s Office defines misconfiguration as “unauthorised people accessing and viewing personal information because of incorrect security settings and a lack of user access management.”
Instead of a malware attack, however, this incident has an internal cause. When you or your people happen to misconfigure settings, such as on a server, some sensitive, private data like customer information can be made public. There is no guarantee about the consequences should it fall into the wrong hands.
To avoid such inadvertent incidents, you need to invest in educating your people about the facts and foibles of cybersecurity. Raising awareness of threats and sharing best practices within the company are among the pillars of an effective strategy. Together with technology and processes, investment in people will help you keep up with the challenges of the time.
As cyber threats become more visible and cyber criminal become more cunning, having a sound security strategy in place is a must for organisations. With research, risk assessment, and raising people’s awareness, you will be able to defend your business and clients more effectively.