What would you consider the biggest threats we need to defend against?
Without a doubt, Ransomware poses the biggest threat to companies. Attackers can use any one of a number of methods to deploy ransomware, or even download it directly into an organisation. Especially following on from the light speed digital transformation that came about due to Covid and the greatly increased need for remote working.
This remote working has removed the effectiveness of traditional defences, with employees needing to remember to connect back into the office over a VPN, sharing the use of work devices to facilitate home schooling etc., the attack surface, that is to say the options for attackers to compromise an endpoint has also increased.
Employees are accessing corporate data and information remotely, with the bare minimum of security in their own homes. This has allowed attackers to find a way in to an organisation and to make their way to the ‘crown jewels’, usually undetected due to the minimised security protocols that have become prevalent due to remote working.
Cybercriminals use numerous vectors to conduct their attacks, which are the ones most likely to succeed?
It’s hard to say as every organisation varies in their security posture, security maturity, deployment of effective tooling, skills to best use and value gained from those tools and countermeasures in place. That being said, in my experience, there has been a much sharper rise in phishing attacks and drive-by-downloads.
What I mean is as we work more remotely and in isolation, we are leveraging remote meeting apps and collaboration tools to share more effectively. This has meant people are replying on email or chat programs such as WhatsApp for communication and are sending sharing links more frequently. it is a trivial matter to craft a malicious document or web URL to deceive end users.
Similarly, many corporate devices are being used by family members for schooling, university, chatting with friends, etc. Often these users will not have had the benefit of security awareness training and not think twice about sharing information or downloading something relevant to their interests.
Fake documents and websites have also sprung up globally, claiming to have Covid stats or other Covid-related news, which people are clicking on or downloading, which helps attackers gain access.
Do these vectors differ depending on the size of the business?
Typically, the vectors are similar no matter what the size of the business. However, larger enterprises also have larger budgets etc., and were able to operationally shift at a more rapid pace and could invest in tooling and measures to maintain protection.
They adopted technologies to ensure safety of data, purely because they knew they needed them and because they could afford them. SMEs are not so lucky, which is a huge risk as a lot of these companies interact with the larger enterprises, as niche service providers/vendors.
Due to their lack of security budget, they don’t have the required monitoring or capabilities to protect themselves, which then opens up the larger enterprises to attack, via their own supply-chain or the use of contractors.
When all is said and done, regardless of the size of the business, both need to ensure they have the security ability and skill to be an effective defender. Owing to this, a new market segment has opened up, with MSSP (managed security service providers) now offering enterprise-level security tooling and skills, with a SME price-tag.
What are the most dangerous threats today?
Once again, it has been the speed of innovation of ransomware. From CISOs we have had discussions, across a number of verticals and organisation sizes. Ransomware is in their top three major concerns due to the devastation and indiscriminate nature of the attack.
We have seen this in all sectors in South Africa, with large-scale ransomware attacks taking place. Interpol released a report stating that South Africa has the third-highest number of cybercrime victims worldwide, with an estimated R2,2&nbs;billion lost.
Along with the points I have mentioned previously, this rise in and evolution of ransomware has given rise to attackers using more double-extortion attacks. This is where your data is encrypted in such a way as to be unrecoverable, usually with backups etc. being encrypted as well, so that an organisation’s only hope is to pay the ransom and buy their data back.
Ransomware actors will then also sell the data on the dark web or other places in order to ‘double-dip’ and make twice the profit. Ransomware has become such an industry in the last few years, that actors are run like businesses, with online-support available and offering their ransomware as a service. For a few dollars, attackers can buy access to ransomware platforms and potential targets, in order to get a piece of the ransomware action.
What are your recommendations for securing an organisation?
User awareness is a big part of it, but organisations also need to reward and not punish employees who question or double-check an email instruction or any digital communication. Having a clear process and support for users to report suspicious or suspect communication, links, etc. is vital. Security software is also of vital importance.
Without solutions that allow organisations to mature and execute on a 12 to 14 month strategy, any money spent is wasted. As attacks evolve, your cybersecurity tooling should be able to evolve and keep pace. Behavioural detections, artificial intelligence and machine learning has all aided greatly in this endeavour.
Even the way organisations view security has to change, with a mind-shift from alert-centric security where defenders wait for an alert to appear so that it can be investigated and triaged. Organisations need to adopt a more operation-centric approach, with visibility across their business assets, not just the endpoints. Security is a verb and as such, operation-centric security allows security teams to understand an attack and the context, across all affected users and endpoints at a much-accelerated pace.
In a similar way, being able to effectively scope and provide context around the attack (Mean Time To Detect), including impacted users and machines, network communications and additional context around other cloud-based or network-based assets is key, as this allows for remediation times to be decreased exponentially, but also for those relevant remediations to be applied to all affected assets in the shortest time possible (Mean Time To Respond).
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version