Cyber questions for today’s business

Issue 2 2022 Cyber Security

What would you consider the biggest threats we need to defend against?

Without a doubt, Ransomware poses the biggest threat to companies. Attackers can use any one of a number of methods to deploy ransomware, or even download it directly into an organisation. Especially following on from the light speed digital transformation that came about due to Covid and the greatly increased need for remote working.

Roberto Arico.

This remote working has removed the effectiveness of traditional defences, with employees needing to remember to connect back into the office over a VPN, sharing the use of work devices to facilitate home schooling etc., the attack surface, that is to say the options for attackers to compromise an endpoint has also increased.

Employees are accessing corporate data and information remotely, with the bare minimum of security in their own homes. This has allowed attackers to find a way in to an organisation and to make their way to the ‘crown jewels’, usually undetected due to the minimised security protocols that have become prevalent due to remote working.

Cybercriminals use numerous vectors to conduct their attacks, which are the ones most likely to succeed?

It’s hard to say as every organisation varies in their security posture, security maturity, deployment of effective tooling, skills to best use and value gained from those tools and countermeasures in place. That being said, in my experience, there has been a much sharper rise in phishing attacks and drive-by-downloads.

What I mean is as we work more remotely and in isolation, we are leveraging remote meeting apps and collaboration tools to share more effectively. This has meant people are replying on email or chat programs such as WhatsApp for communication and are sending sharing links more frequently. it is a trivial matter to craft a malicious document or web URL to deceive end users.

Similarly, many corporate devices are being used by family members for schooling, university, chatting with friends, etc. Often these users will not have had the benefit of security awareness training and not think twice about sharing information or downloading something relevant to their interests.

Fake documents and websites have also sprung up globally, claiming to have Covid stats or other Covid-related news, which people are clicking on or downloading, which helps attackers gain access.

Do these vectors differ depending on the size of the business?

Typically, the vectors are similar no matter what the size of the business. However, larger enterprises also have larger budgets etc., and were able to operationally shift at a more rapid pace and could invest in tooling and measures to maintain protection.

They adopted technologies to ensure safety of data, purely because they knew they needed them and because they could afford them. SMEs are not so lucky, which is a huge risk as a lot of these companies interact with the larger enterprises, as niche service providers/vendors.

Due to their lack of security budget, they don’t have the required monitoring or capabilities to protect themselves, which then opens up the larger enterprises to attack, via their own supply-chain or the use of contractors.

When all is said and done, regardless of the size of the business, both need to ensure they have the security ability and skill to be an effective defender. Owing to this, a new market segment has opened up, with MSSP (managed security service providers) now offering enterprise-level security tooling and skills, with a SME price-tag.

What are the most dangerous threats today?

Once again, it has been the speed of innovation of ransomware. From CISOs we have had discussions, across a number of verticals and organisation sizes. Ransomware is in their top three major concerns due to the devastation and indiscriminate nature of the attack.

We have seen this in all sectors in South Africa, with large-scale ransomware attacks taking place. Interpol released a report stating that South Africa has the third-highest number of cybercrime victims worldwide, with an estimated R2,2&nbs;billion lost.

Along with the points I have mentioned previously, this rise in and evolution of ransomware has given rise to attackers using more double-extortion attacks. This is where your data is encrypted in such a way as to be unrecoverable, usually with backups etc. being encrypted as well, so that an organisation’s only hope is to pay the ransom and buy their data back.

Ransomware actors will then also sell the data on the dark web or other places in order to ‘double-dip’ and make twice the profit. Ransomware has become such an industry in the last few years, that actors are run like businesses, with online-support available and offering their ransomware as a service. For a few dollars, attackers can buy access to ransomware platforms and potential targets, in order to get a piece of the ransomware action.

What are your recommendations for securing an organisation?

User awareness is a big part of it, but organisations also need to reward and not punish employees who question or double-check an email instruction or any digital communication. Having a clear process and support for users to report suspicious or suspect communication, links, etc. is vital. Security software is also of vital importance.

Without solutions that allow organisations to mature and execute on a 12 to 14 month strategy, any money spent is wasted. As attacks evolve, your cybersecurity tooling should be able to evolve and keep pace. Behavioural detections, artificial intelligence and machine learning has all aided greatly in this endeavour.

Even the way organisations view security has to change, with a mind-shift from alert-centric security where defenders wait for an alert to appear so that it can be investigated and triaged. Organisations need to adopt a more operation-centric approach, with visibility across their business assets, not just the endpoints. Security is a verb and as such, operation-centric security allows security teams to understand an attack and the context, across all affected users and endpoints at a much-accelerated pace.

In a similar way, being able to effectively scope and provide context around the attack (Mean Time To Detect), including impacted users and machines, network communications and additional context around other cloud-based or network-based assets is key, as this allows for remediation times to be decreased exponentially, but also for those relevant remediations to be applied to all affected assets in the shortest time possible (Mean Time To Respond).

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Poor router security makes SMBs vulnerable to attack
Cyber Security
While major malware and ransomware incidents frequently make headlines in the media, router vulnerabilities are not as frequently publicised, but the outcomes of these violations could be immensely damaging.

Cybercriminals eye South African SMEs lack of security
Cyber Security
Just as a business owner wouldn’t underinsure a tangible business asset such as a factory, SMEs shouldn’t leave their digital assets unlocked and in plain sight of criminals.

Harnessing the power of AI-driven XDR
Cyber Security
According to AIMultiple, 90% of infosec personnel in the U.S. and Japan said they’re anticipating an increase in these automated attack campaigns, due in no small part to the public availability of AI research.

Be prepared for the increase in reconnaissance
Cyber Security
Because ransomware has become so lucrative, cybercriminals are becoming more devious and putting significantly more energy into reconnaissance.

Cybereason expands presence across sub-Saharan Africa
News Cyber Security
Cybereason has appointed Chantél Hamman as its new channel director focused on growing the company’s presence across sub-Saharan Africa.

How to weather the approaching perfect storm
Cyber Security
Cybercrime is spiking and security skills are scarce, and small and medium enterprises (SMEs) are particularly vulnerable as the financial impact of falling victim to these security breaches can result in their total collapse.

Cyber resilience is more than security
Industrial (Industry) Cyber Security IT infrastructure
Kate Mollett, regional director at Commvault Africa advises companies to guard against cyberattacks in the shipping and logistics sector using an effective recovery strategy.

Preventing cyberattacks on critical infrastructure
Industrial (Industry) Cyber Security
Cyberattacks have the potential to disrupt our lives completely, and in instances where critical national infrastructure is attacked, they could disrupt the country’s entire economy, leading to loss of life and livelihoods.

Cybersecure surveillance cameras
HiTek Security Distributors News CCTV, Surveillance & Remote Monitoring Cyber Security
Provision-ISR builds customer trust and opens up new opportunities with Check Point Quantum IoT Protect Firmware built into Provision-ISR cameras.

Why SBOMs are mission critical
Hikvision South Africa Cyber Security
When deployed and managed properly, software bill of materials can provide a 360-degree view of an organisation’s risk exposure to software supply chain threats and vulnerabilities.