Time to start taking cybersecurity more seriously

Cyberattacks across the world have drastically increased, while most of them don’t dominate headlines – such as the Adobe or Equifax breaches – hackers have targeted companies of all sizes seeing that business digitization is on the rise due to the COVID-19 pandemic.

With the world transforming into a data-fueled reality, the risks become larger, and more important to protect.

Global spending on cybersecurity products, services, and solutions will likely reach $1 trillion by 2021, according to Cybersecurity Ventures; this indicates that online protection, which was mainly reserved by the biggest of companies, is beginning to hit the mainstream, especially by small and medium enterprises (SMEs).

One of the main creditors to this trend is the huge rise of people relying on digital services, such as working remotely, online shopping, and generally being more digitally connected during worldwide lockdowns.

Hackers & the pandemic gold mine

In the U.S., during the pandemic the FBI’s Cyber Division reported 4,000 complaints of cyberattacks per day, which represents a 400 percent increase during pre-coronavirus times.

But the attacks are not only directed toward businesses.

“The world is witnessing an alarming rate of cyberattacks aimed at major corporations, governments, and critical infrastructure, targeting all types of businesses, including critical medical organizations,” a report by Interpol highlighted.

In parallel, Microsoft reported that COVID-19 themed attacks – mainly using phishing or social engineering attacks – have jumped to 20,000 to 30,000 attacks a day in the U.S. alone.

According to a recent survey published by PwC, 65 percent of organizations in the UK alone have reported that they’ve either been breached or exposed to a cyberattack.

Meanwhile, only 42 percent said they were “well prepared” for moving to remote working, compared to 45 percent who were “somewhat prepared” and 13 percent who were not prepared at all – leaving more than half of all firms at least moderately under threat.

PwC surveyed almost 3,249 business and technology executives across the world, including 265 in the UK, which saw Internet of Things (IoT) and cloud service providers top the list of ‘very likely’ threat vectors in the coming 12 months, accounted by 33 percent of companies.

 “Cyber-attacks on cloud services were found to be the most likely threats to have a significantly negative impact – as noted by 24 percent of those polled,” PwC highlighted.

Strengthening the frontline

The UK witnessed the most brutal of attacks, as British respondents cited 58 percent of their attacks being on cloud services, followed by 52 percent done by disruptionware attacks on critical business services, and finally 50 percent using ransomware.

This large number of cyberattacks has pushed British-based businesses and execs to upgrade their security systems since “around 40 percent of executives in the global survey planned to increase resilience testing to ensure that, if a disruptive cyber event occurs, their critical business functions will stay up and running – but 96 percent of UK respondents said that they will shift their cybersecurity strategy due to COVID-19,” the survey added.

Businesses across the board have taken note of this, which is why cyber budgets will look to drastically increase as the new year approaches.

This has been confirmed by PwC, as 55 percent of its survey respondents echoed the above statement, regardless of 64 percent of execs forecast a decline in business revenues.

While companies are prepping to foot a cybersecurity bill, a quarter of respondents have stated that they will downsize their spending, leaving cyber teams doing more with less resources in hand, as 13 percent of companies will have to make do with the same budget.

“It’s surprising that so many organizations lack confidence in their cyber security spend. It shows businesses need to improve their understanding of cyber threats and the vulnerabilities they exploit, while changing the way they think about cyber risk, so it becomes an intrinsic part of every business decision,” Richard Horne, Cyber Security Chair at PwC said.

Can AI champion cybersecurity?

As technological advancements keep moving forward at a rocketing pace, cyberattacks become more and more sophisticated; while the current protection tactics have proven to be effective against certain scenarios, the fear lies with the unknown.

Which is why many cybersecurity firms have begun using artificial intelligence (AI) as a means to close the gap between the sophisticated cybercriminals and the forcefield that keeps them out.

AI systems have the ability to detect new forms of attacks and breaches and react to them accordingly; this would not only change the security’s approach of being reactionary, but would allow experts to study these techniques to develop solutions that would counter them.

One example of how AI is used in the rapidly changing pandemic and post-pandemic landscape is in recognition of uncategorized or unlabeled websites with illicit intentions that are related to the usual triggers, such as fear.

According to MarkMonitor, there are more than 100,000 COVID-19-registered domains.

“Our AI analysis of uncategorized websites that were accessed by people over a period of 50 days shows that between 20 percent – 35 percent of websites contain content which, while not directly dangerous, is at least misleading or shows signs of possible illicit intent,” writes Leonardas Marozas, Security Research Lab Manager at CUJO AI, a U.S.-based software company.

He added that while threat intelligence is a source of confirmation for a cyber threat actor, AI usage will foresee potential malicious activities before they are known or registered in knowledge bases.

With the business world becoming more and more comfortable with the idea of remote working, AI has the potential to overcome and help solve a myriad of challenges on the security front.

Alternatives to weather the storm

As the conversation of cybersecurity in businesses continues and will likely intensify, there are numerous ways that companies can help their employees become more aware and secure of their behavior online.

The Center for Internet Security published a resource guide on how employees can keep themselves safe as they continue their work schedules from the comfort of their own homes.

Securing employee home networks

While conducting business through a VPN can add a layer of security, there are simple steps employees can take to secure their home networks. Employees need to know what devices they are using while working from home.

Once they’ve identified the devices they’re using, have them download the instruction manuals from the respective manufacturer websites. These instruction manuals will give them step-by-step instructions on how to enable security settings like these:

• Practice smart password management and enable two-factor authentication (2FA) wherever possible.
• Enable automatic updates for all routers and modems. If equipment is outdated and can no longer be updated, it should be replaced.
• Turn off WPS and UPnP.
• Turn on WPA2 or WP3.
• Configure the router or modem’s firewall with a unique password and enable the firewall.

Employee personal device security

Some employees may be using personal equipment instead of, or alongside, company-issued hardware. Here are some steps employees should take to secure their personal devices, especially when they’re using them for work purposes:

• Patching – Patching systems to remedy known vulnerabilities continues to be essential. Your organization’s plan for doing so may need some adjustment with a largely remote workforce.
• Home Computers – Recommend that employees implement security on these devices including installing anti-virus, firewall, and anti-spyware, and apply security settings in web browsers.
• Printers – Employees should look up printer security for their printer make and model to ensure security of the device and network connection. If printing, use an appropriate shredder based on company best practices.
• USB Devices –Staff should use only company-approved USB devices.
• Storage – Designate how and where an employee can store sensitive information. Use hard drive encryption on work laptops or external hard drives.
• Access by Others – People who work from home during the occasional weekday usually don’t have a full house, but they might now. Ask employees to keep work devices for professional use only and lock their devices when they step away from them. Innocent activity on a work computer could lead to a breach. This is also a good opportunity to educate family on cybersecurity.

While online security threats keep rising and advancing, business and government leaders need to keep cybersecurity as a top priority to ensure that healthcare, supply chains, military operations, and other vital systems are not compromised.