Cyber questions for today’s business

Issue 2 2022 Information Security

What would you consider the biggest threats we need to defend against?

Without a doubt, Ransomware poses the biggest threat to companies. Attackers can use any one of a number of methods to deploy ransomware, or even download it directly into an organisation. Especially following on from the light speed digital transformation that came about due to Covid and the greatly increased need for remote working.

Roberto Arico.

This remote working has removed the effectiveness of traditional defences, with employees needing to remember to connect back into the office over a VPN, sharing the use of work devices to facilitate home schooling etc., the attack surface, that is to say the options for attackers to compromise an endpoint has also increased.

Employees are accessing corporate data and information remotely, with the bare minimum of security in their own homes. This has allowed attackers to find a way in to an organisation and to make their way to the ‘crown jewels’, usually undetected due to the minimised security protocols that have become prevalent due to remote working.

Cybercriminals use numerous vectors to conduct their attacks, which are the ones most likely to succeed?

It’s hard to say as every organisation varies in their security posture, security maturity, deployment of effective tooling, skills to best use and value gained from those tools and countermeasures in place. That being said, in my experience, there has been a much sharper rise in phishing attacks and drive-by-downloads.

What I mean is as we work more remotely and in isolation, we are leveraging remote meeting apps and collaboration tools to share more effectively. This has meant people are replying on email or chat programs such as WhatsApp for communication and are sending sharing links more frequently. it is a trivial matter to craft a malicious document or web URL to deceive end users.

Similarly, many corporate devices are being used by family members for schooling, university, chatting with friends, etc. Often these users will not have had the benefit of security awareness training and not think twice about sharing information or downloading something relevant to their interests.

Fake documents and websites have also sprung up globally, claiming to have Covid stats or other Covid-related news, which people are clicking on or downloading, which helps attackers gain access.

Do these vectors differ depending on the size of the business?

Typically, the vectors are similar no matter what the size of the business. However, larger enterprises also have larger budgets etc., and were able to operationally shift at a more rapid pace and could invest in tooling and measures to maintain protection.

They adopted technologies to ensure safety of data, purely because they knew they needed them and because they could afford them. SMEs are not so lucky, which is a huge risk as a lot of these companies interact with the larger enterprises, as niche service providers/vendors.

Due to their lack of security budget, they don’t have the required monitoring or capabilities to protect themselves, which then opens up the larger enterprises to attack, via their own supply-chain or the use of contractors.

When all is said and done, regardless of the size of the business, both need to ensure they have the security ability and skill to be an effective defender. Owing to this, a new market segment has opened up, with MSSP (managed security service providers) now offering enterprise-level security tooling and skills, with a SME price-tag.

What are the most dangerous threats today?

Once again, it has been the speed of innovation of ransomware. From CISOs we have had discussions, across a number of verticals and organisation sizes. Ransomware is in their top three major concerns due to the devastation and indiscriminate nature of the attack.

We have seen this in all sectors in South Africa, with large-scale ransomware attacks taking place. Interpol released a report stating that South Africa has the third-highest number of cybercrime victims worldwide, with an estimated R2,2&nbs;billion lost.

Along with the points I have mentioned previously, this rise in and evolution of ransomware has given rise to attackers using more double-extortion attacks. This is where your data is encrypted in such a way as to be unrecoverable, usually with backups etc. being encrypted as well, so that an organisation’s only hope is to pay the ransom and buy their data back.

Ransomware actors will then also sell the data on the dark web or other places in order to ‘double-dip’ and make twice the profit. Ransomware has become such an industry in the last few years, that actors are run like businesses, with online-support available and offering their ransomware as a service. For a few dollars, attackers can buy access to ransomware platforms and potential targets, in order to get a piece of the ransomware action.

What are your recommendations for securing an organisation?

User awareness is a big part of it, but organisations also need to reward and not punish employees who question or double-check an email instruction or any digital communication. Having a clear process and support for users to report suspicious or suspect communication, links, etc. is vital. Security software is also of vital importance.

Without solutions that allow organisations to mature and execute on a 12 to 14 month strategy, any money spent is wasted. As attacks evolve, your cybersecurity tooling should be able to evolve and keep pace. Behavioural detections, artificial intelligence and machine learning has all aided greatly in this endeavour.

Even the way organisations view security has to change, with a mind-shift from alert-centric security where defenders wait for an alert to appear so that it can be investigated and triaged. Organisations need to adopt a more operation-centric approach, with visibility across their business assets, not just the endpoints. Security is a verb and as such, operation-centric security allows security teams to understand an attack and the context, across all affected users and endpoints at a much-accelerated pace.

In a similar way, being able to effectively scope and provide context around the attack (Mean Time To Detect), including impacted users and machines, network communications and additional context around other cloud-based or network-based assets is key, as this allows for remediation times to be decreased exponentially, but also for those relevant remediations to be applied to all affected assets in the shortest time possible (Mean Time To Respond).

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Access & identity expectations for 2024
Technews Publishing IDEMIA ZKTeco Gallagher Salto Systems Africa Regal Distributors SA Reditron Editor's Choice Access Control & Identity Management Information Security AI & Data Analytics
What does 2024 have in store for the access and identity industry? SMART Security Solutions asked several industry players for their brief thoughts on what they expect this year.

Prepare for cyber-physical attacks
Gallagher Information Security Access Control & Identity Management
As the security landscape continues to evolve, organisations must fortify their security solutions to embrace the changing needs of the security and technology industries. Nowhere is this more present than with regard to cybersecurity.

Zero Trust and user fatigue
Access Control & Identity Management Information Security
Paul Meyer, Security Solutions Executive, iOCO OpenText, says implementing Zero Trust and enforcing it can create user fatigue, which only leads to carelessness and a couldn’t care attitude.

Passwordless, unphishable web browsers
Access Control & Identity Management Information Security
Passkey technology is proving to be an easily deployed way to bring unphishable, biometric-based security to browsers; making identification and authentication much more secure and reliable for all parties.

Time is of the essence
Information Security
Ransomware attacks are becoming increasingly common. Yet, many individuals and organisations still lack a clear understanding of how these attacks occur and what can be done to secure their data.

All aspects of data protection
Technews Publishing Editor's Choice Information Security Infrastructure AI & Data Analytics
SMART Security Solutions spoke to Kate Mollett, Senior Director, Commvault Africa, about the company and its evolution from a backup specialist to a full data protection specialist, as well as the latest announcements from the company.

The song remains the same
Sophos Information Security
Sophos report found that telemetry logs were missing in nearly 42% of the attack cases studied. In 82% of these cases, cybercriminals disabled or wiped out the telemetry to hide their tracks.

How hackers exploit our vulnerabilities
Information Security Risk Management & Resilience
Distractions, multi-tasking, and emotional responses increase individuals’ vulnerability to social engineering, manipulation, and various forms of digital attacks; 74% of all data breaches included a human element.

Projections for 2024’s Advanced Threats Landscape
News & Events Information Security
Kaspersky Global Research and Analysis Team (GReAT) experts offer insights and projections for 2024 in the Kaspersky Security Bulletin, with a focus on the evolution of Advanced Persistent Threats (APT).

Veeam and Sophos in strategic partnership
Information Security
Veeam and Sophos unite with a strategic partnership to advance the security of business-critical backups with managed detection and response for cyber resiliency, and to quickly recover impacted data by exchanging critical information.