Business owners and executives dread receiving the call that criminals have breached their computer systems. It may happen in a flash, but this moment is often the culmination of days to months of moves by cybercriminals, finding ways into systems, gaining control, and eventually executing an attack. It is the proverbial iceberg; the breach is just the visible tip of the operation.
"Vigilance and knowledge are our most potent weapons in the battle against cyberattacks," asserts Gerhard Swart, Chief Technology Officer at Performanta. It is in the criminals' best interest if ONLY security teams can detect the signs of an impending attack. The good news is that anyone can grasp the basics of a cyberattack and spot suspicious activities."
How to spot a cyberattack
Popular culture's depiction of a cyberattack is often very misleading. The cybercriminal figure is someone sitting in a dark room, typing a few commands into a laptop, then sitting back and sipping a drink while their code causes havoc. The reality is very different.
Cyberattacks have multiple stages that can happen sequentially or concurrently. Security experts often refer to a standard blueprint called the Cyber Kill Chain, developed by Lockheed Martin. This blueprint describes seven stages: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions.
Briefly, the stages involve:
1. Reconnaissance: The criminals find targets and research their weak areas, such as weak passwords.
2. Weaponisation: The criminals prepare tools for the attack, such as malware or deepfakes.
3. Delivery: The criminals initiate an attack to try and enter the systems, often using phishing emails.
4. Exploitation: The criminals worm into the systems and prepare for a larger attack.
5. Installation: The criminals use their extended knowledge of the breached computer systems to install more tools and backdoors.
6. Command and control: The criminals expand their control to run the breached systems effectively.
7. Actions: The criminals launch their main assault, at which point the breach often becomes visible.
Detection is better than cure
Knowing these details, how can you spot an attempted cyberattack? There are often telltale signs to look out for, namely:
• There has been a surge in phishing emails targeting your or your employees. Emails that are not from where they claim to be, stress great urgency, or contain unsolicited attachments or links should be treated with suspicion.
• Unusual network traffic or file access attempts: reports of unexpected traffic or files being accessed, especially by accounts that normally do not do so (such as a sales accountant trying to access financial records).
• Account logins at strange times or unusual locations: when someone logs in at 2am or from an undisclosed location, that can be a massive red flag.
• Stolen or lost devices: Though stolen devices can be a case of petty theft; if someone loses a phone that can authenticate account logins, there is cause to take that seriously.
• Passwords no longer work: If you cannot access an account yet have not changed the password, there is reason to be concerned.
The above signs might also result from other causes, but as the maxim goes, just because you are paranoid does not mean they are not out to get you.
Three steps to strengthen security
Firstly, they should support and encourage security training for their staff, including regular tests, and do so supportively. Businesses should make their employees feel like part of the solution, not the problem. Secondly, businesses should encourage general vigilance - if someone notices something strange, they should speak up. Employees should be given accessible channels to notify security concerns, even frivolous ones. Thirdly, businesses should look to invest in technology services that improve detection, visibility, and reporting. Security tasks can quickly overwhelm security and IT teams, while the right security services alleviate such pressure.
"When you stop that phishing mail or inform your security admin about suspicious activity, you deal a big blow to the attackers' plans," says Swart. "When companies combine good security habits and technologies with security-savvy employees, they become a very hard target, and the bad guys usually go looking for something easier."
It might seem worth taking the risk. After all, what are the odds you will be attacked? Unfortunately, they are considerable as South Africa is a major cybercrime target, and fixing the damages of a cyberattack is very costly. Prevention is better and cheaper than cure! Even if you are not a security pro, you can help spot cyberattacks and avoid such risks.
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version