Cyber questions for today’s business

Issue 2 2022 Cyber Security

What would you consider the biggest threats we need to defend against?

Without a doubt, Ransomware poses the biggest threat to companies. Attackers can use any one of a number of methods to deploy ransomware, or even download it directly into an organisation. Especially following on from the light speed digital transformation that came about due to Covid and the greatly increased need for remote working.

Roberto Arico.

This remote working has removed the effectiveness of traditional defences, with employees needing to remember to connect back into the office over a VPN, sharing the use of work devices to facilitate home schooling etc., the attack surface, that is to say the options for attackers to compromise an endpoint has also increased.

Employees are accessing corporate data and information remotely, with the bare minimum of security in their own homes. This has allowed attackers to find a way in to an organisation and to make their way to the ‘crown jewels’, usually undetected due to the minimised security protocols that have become prevalent due to remote working.

Cybercriminals use numerous vectors to conduct their attacks, which are the ones most likely to succeed?

It’s hard to say as every organisation varies in their security posture, security maturity, deployment of effective tooling, skills to best use and value gained from those tools and countermeasures in place. That being said, in my experience, there has been a much sharper rise in phishing attacks and drive-by-downloads.

What I mean is as we work more remotely and in isolation, we are leveraging remote meeting apps and collaboration tools to share more effectively. This has meant people are replying on email or chat programs such as WhatsApp for communication and are sending sharing links more frequently. it is a trivial matter to craft a malicious document or web URL to deceive end users.

Similarly, many corporate devices are being used by family members for schooling, university, chatting with friends, etc. Often these users will not have had the benefit of security awareness training and not think twice about sharing information or downloading something relevant to their interests.

Fake documents and websites have also sprung up globally, claiming to have Covid stats or other Covid-related news, which people are clicking on or downloading, which helps attackers gain access.

Do these vectors differ depending on the size of the business?

Typically, the vectors are similar no matter what the size of the business. However, larger enterprises also have larger budgets etc., and were able to operationally shift at a more rapid pace and could invest in tooling and measures to maintain protection.

They adopted technologies to ensure safety of data, purely because they knew they needed them and because they could afford them. SMEs are not so lucky, which is a huge risk as a lot of these companies interact with the larger enterprises, as niche service providers/vendors.

Due to their lack of security budget, they don’t have the required monitoring or capabilities to protect themselves, which then opens up the larger enterprises to attack, via their own supply-chain or the use of contractors.

When all is said and done, regardless of the size of the business, both need to ensure they have the security ability and skill to be an effective defender. Owing to this, a new market segment has opened up, with MSSP (managed security service providers) now offering enterprise-level security tooling and skills, with a SME price-tag.

What are the most dangerous threats today?

Once again, it has been the speed of innovation of ransomware. From CISOs we have had discussions, across a number of verticals and organisation sizes. Ransomware is in their top three major concerns due to the devastation and indiscriminate nature of the attack.

We have seen this in all sectors in South Africa, with large-scale ransomware attacks taking place. Interpol released a report stating that South Africa has the third-highest number of cybercrime victims worldwide, with an estimated R2,2&nbs;billion lost.

Along with the points I have mentioned previously, this rise in and evolution of ransomware has given rise to attackers using more double-extortion attacks. This is where your data is encrypted in such a way as to be unrecoverable, usually with backups etc. being encrypted as well, so that an organisation’s only hope is to pay the ransom and buy their data back.

Ransomware actors will then also sell the data on the dark web or other places in order to ‘double-dip’ and make twice the profit. Ransomware has become such an industry in the last few years, that actors are run like businesses, with online-support available and offering their ransomware as a service. For a few dollars, attackers can buy access to ransomware platforms and potential targets, in order to get a piece of the ransomware action.

What are your recommendations for securing an organisation?

User awareness is a big part of it, but organisations also need to reward and not punish employees who question or double-check an email instruction or any digital communication. Having a clear process and support for users to report suspicious or suspect communication, links, etc. is vital. Security software is also of vital importance.

Without solutions that allow organisations to mature and execute on a 12 to 14 month strategy, any money spent is wasted. As attacks evolve, your cybersecurity tooling should be able to evolve and keep pace. Behavioural detections, artificial intelligence and machine learning has all aided greatly in this endeavour.

Even the way organisations view security has to change, with a mind-shift from alert-centric security where defenders wait for an alert to appear so that it can be investigated and triaged. Organisations need to adopt a more operation-centric approach, with visibility across their business assets, not just the endpoints. Security is a verb and as such, operation-centric security allows security teams to understand an attack and the context, across all affected users and endpoints at a much-accelerated pace.

In a similar way, being able to effectively scope and provide context around the attack (Mean Time To Detect), including impacted users and machines, network communications and additional context around other cloud-based or network-based assets is key, as this allows for remediation times to be decreased exponentially, but also for those relevant remediations to be applied to all affected assets in the shortest time possible (Mean Time To Respond).

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Turnkey data loss prevention solution
IT infrastructure Cyber Security Products
Acronis’s expertise in data protection and the managed service provider market yields an innovative, fast-track approach for the prevention of catastrophic data leaks.

The cybersecurity consolidation conundrum
Editor's Choice Cyber Security Healthcare (Industry)
Check Point discusses why less is sometimes more when it comes to securing your organisation from the innumerable cyberattacks happening every day.

Companies continue to pay multiple ransom demands
News Cyber Security
Study reveals that 80% of companies that paid a ransom demand were hit again, nearly 50% reported paying a second ransom and nearly 10% paid a third time.

DCC becomes sole Symantec distributor for South Africa
News Cyber Security
Drive Control Corporation (DCC) has been appointed the sole distributor for Symantec security solutions to the South Africa channel, and will now also be distributing Symantec into the SADC region.

The evolution of vulnerability management
Cyber Security
As organisations focus on digitally transforming their enterprises, cybersecurity professionals have been facing an expansion of their attack surface – compounded by the digital explosion during the pandemic.

VMware enhances its lateral security for multi-cloud
Technews Publishing Cyber Security
Ahead of RSA Conference 2022, VMware introduced Contexa, VMware’s full-fidelity threat intelligence capability that observes the breadth of VMware’s network, endpoint, and user technologies.

Securing mobile devices for a remote workforce
Cyber Security
As a channel to your personal data, banking and accounts, and a link to your work and business data, smartphones drive cybercriminals directly to your pocket.

XM Cyber counters attacks involving Microsoft Active Directory exploits
Cyber Security
XM Cyber unveils first solution to reveal entire attack paths across AD and other vectors, aiding remediation and continuously protecting critical assets.

How to stop the costliest internet scam
Cyber Security
While ransomware, hacking, API hacks, and all the other cybersecurity threats make headlines, it is worth remembering that the costliest internet scam is still business email compromises.

How the MITRE ATT&CK Framework has revolutionised cybersecurity
Cyber Security
The MITRE ATT&CK framework is the most widely adopted and used by industry experts; what’s more, it is free and provides businesses with a fantastic source of information to strengthen their security posture.