As data breaches continue to make for everyday headlines, the need to raise cyber awareness has never been more critical. Some organizations are still hesitant to comply with the latest up-to-date cyber security standards and upgrade their security postures due to what they perceive as extra operational costs. Security experts are fully aware that these defensive measures are only a friction of the cost of a well carried-out cyber attack. Many prominent organizations across the world such as Equifax, the NHS, Zomato, etc. have endured significant losses due to data breaches in 2017. Cyber attacks have been proven to strike when least expected. It is therefore essential to implement safeguards not only to minimize threats, but also to downplay the the emerging damages on reputation and customer loyalty.
The Value of Cyber Security
Implementing cyber security has never been an easy task due to the constant technological development of threats and the sophistication of successful cyber attacks. What recently drew the attention of the public to the importance of cyber security was the increased global spending that have reached record numbers. The global spending on cyber security had reached approximately $71.1 billion in 2014 and it is expected to reach $100 billion in 2018. Advancement and efficiency are the most needed traits when it comes to cyber security programs. That’s why organizations are starting to prepare themselves for modern threats by allocating resources where needed and by investing in research and development. The stakes are significantly higher for companies and organizations that process valuable data such as customer personal and financial information.
The Cost of a Data Breach
Data breaches can sometimes be disastrous when the target is large organization that collect private customer data in various forms. They can have the same effect if the target is employee data such as social security numbers, personal addresses, and healthcare information. There is no getting around the huge financial cost of a data breach and any individual who can get their hands on cryptocurrency and a connection to the dark web can buy the leaked information. According to Ponemon Institute’s 2016 Cost of Data Breach Study, the dark-web cost for a record stolen from businesses and associations can go as high as $145 and $158, while the cost for health records can be the most expensive and it can reach $355 per record.
The aftermaths of data breach can also include customers losing their trust in the organization because they do not feel their personal information is safe. Losing customers impacts the businesses bottom line the most, so to make up for their reputation, organizations must spend more on keeping their customers because bringing new ones can be very hard in this situation.
Modern Security Threats
With the increase of cyber crimes that is expected to surge in number by the year 2021, cyber security needs to reach new technological milestones to defy the possible unexpected threats that are getting evolved through the last decade. Businesses are recently making remarkable efforts by investing more and more money on security for hiring professionals, maintaining data privacy and making all the precautions for the ever advancing threats and attack vectors. In 2017 alone, all of these security efforts cost businesses a combined $86.4 billion.
For organizations to be able to secure themselves from data breaches, cyber threats need to be deconstructed and dissected like no previous time before. The reason why is that cyber attacks have become more sophisticated and attackers are continuously adding to and refining their skill sets either by creating new types of malware or developing new attack techniques. Here is a list of the most notable new substantial threats that are expected to change the cyber security landscape.
Ransomware has been referred to as the most substantial modern threat for cyber security. What makes it more threatening than other classes of malware is its ability to spread like plague through an organization and all of its digital assets. Some types of ransomware can even spread to connected clients through shared networks. This hazardous category of malware encrypts files and sometimes even computers and data servers and the attacker threatens to delete all the data unless the they are paid a certain amount usually in cryptocurrency. Attackers hold the decryption keys for all the files and there is no guarantee they will deliver them once the transactions go through which makes the situation even worse for the victims. Unfortunately, ransomware attacks keep getting more sophisticated when it comes to encryption techniques and strategic targeting. Ransomware attacks directed towards health institutions can literally be deadly if doctors do not have access to their patients’ information which makes it more likely that any ransom amount will be paid. Looking back at the previous two years we can safely assume that ransomware attacks aren’t ceasing through time or at least decreasing.
Even though Ransomware emerged as a substantial threat putting everything on the internet in danger, many organizations are not doing the necessary work to combat this imminent menace. There is a whopping 42 percent of businesses who still use outdated disaster recovery systems and obsolete hardware making them a prime target for ransomware attacks.
Blockchain has a horizon of good promises for the future of cyber security. The structure of blockchain insures the decentralization of information which decreases its chances to be compromised. Blockchain allows cyber security experts to take advantage of the decentralization of data and databases allowing organizations to get rid of certain types of threats like data mining and other attack vectors.
It is obvious that with blockchain technology cyber security will likely look much different than it has in the past. Unfortunately, the impact will not be all positive because cyber attackers are already taking advantage of blockchain. In early 2018, crypto-mining emerged as the trending cyber crime of the year. Mining in general is not just related to generating cryptocurrency as it can also be used by the attackers to garner multiple processing units and use that computing power for other purposes as well such as DDoS attacks ( Distributed Denial of Service). Moreover, blockchain will grant intractability to cyber attackers when it comes to monetary transactions if they choose to be paid with cryptocurrency for their ransomware attacks.
2- IoT Threats:
Internet of Things (IoT) has the potential to be the future of technology. Computers and smartphones are not the only devices that connect to the internet anymore. Recent technological developments introduced a new venue called IoT where we can make use of some devices such as TVs and locks and control them through the internet. While this might look like a blessing in a certain way, it opens the door for a whole new category of cyber threats. Manufacturing companies can sometimes make insecure firmware or simply fail to update it regularly which leaves whoever uses their product in danger because it is connected to the internet. That is because IoT is relatively a technological newborn that we are still learning about. Specifically, when it comes to insecure web protocols and data transfers, insufficient authentication methods and a lack of consumer security knowledge will leave users open to attacks.
The Role of Security Regulations
Although governments and regulatory bodies keep creating and implementing new regulations, the level of cyber risk surrounding organizations keeps on constantly evolving. Continuously updating security infrastructures and policies should be a priority for all organizations. If it were not for some mandatory regulations such as PCI DSS (Payment Card Industry Data Security Standard), GDPR (General Data Protection Regulation), ISO 27001, and HIPAA (Health Insurance Portability and Accountability Act), some organizations will take security and the data they collect lightly and not see themselves as obliged to strengthen their security postures. In today’s cyber security climate we hear about data breaches almost on a daily basis and that is exactly why more security initiatives and regulations keep being created and implemented. Addressing modern security issues should be a priority and not a choice.
The New York Department of Financial Services (NYDFS for short) became one of the first bodies to implement a cyber security operational regulation for qualifying institutions and organizations within the financial services industry. The regulation is called 23 NYCRR Part 500 and it was tailored to financial institutions, banks, mortgage companies, insurance companies, licenced lenders, and other organizations that provide financial services and collect valuable data from their clients. Organizations that fall under the umbrella of characteristics brought forward by the NYDFS are required to meet a certain security standard and implement a comprehensive cyber security programs in accordance with a defined compliance timetable. If organizations fail to meet the criteria within the mandated deadlines, the NYDFS will be cited and fined. Failure to administer the requirements within the mandated deadline can result in severe penalties and even put some organizations out of business.
The National Institute of Standards and Technology (NIST) has released a framework to improve the security of critical infrastructure for 16 sectors called the Framework for Improving critical Infrastructure Cybersecurity and the current version for it is 1.1. An executive order was passed for federal agencies to implement this framework but unfortunately, not many private organizations were required to comply which leaves it as an optional decision for many. Current data reports that the Federal agencies have fallen behind in the required implementation of the (NIST) framework requirement. The current federal agency adoption reports that only 12 out of 16 cited sectors have completed successful implementation. Many challenges still exist for organizations when enforcing the NIST framework which include: a lack of knowledge on how to adopt, limited financial resources, and prioritization of other responsibilities. The current strategy needs stricter enforcement and the current framework requires more definitive detail that includes mandatory adoption from the federal and private sector.
Tips for Cyber Security
If anything is connected to the internet then it is not completely safe from cyber attacks. What we can do is try to make our devices more secure by following industry best practices. Here is a list of cyber security tips that might look common but are very important to implement and they should not go unnoticed. They include basic general recommendations for businesses that need to take first steps through cyber security.
- Move towards serious methods for dealing with passwords:
businesses employees should use robust method for selecting their passwords, and avoid using similar ones. Two-Factor Authentication can immune these businesses if they face some cases of weak password.
- Anticipate threats and attacks:
Never think that your business is not a target of attacks. Thinking that your organization is unimportant so no one will benefit from attacking it is immature, because you have to think of your customers data and privacy that could very important for them.
- Backup your data:
Using a data backup solution and making sure it is frequently updated will preserve data safely, especially when the organization uses more than one backup solution and takes them offline.
- Using upgraded defensive technologies:
Network defense technologies like firewalls, anti-viruses and anti-malware software can make companies block disastrous attacks initiated by sophisticated phishing attacks and ransomware.
- Monitor user accounts and limit privileges:
Employees should not be granted fully privileged access. Accounts should be monitored and just granted the permissions that allows them to make their jobs.
- Staff awareness:
Employees should have a level of awareness that make them eligible to face cyber threats.
- Have mobile management policies in place:
Companies should practice strict policies regarding employees to no put sensitive data outside companies’ assets. Laptops and smartphone are vulnerable to loss and theft and that is a real threat to companies’ data.
- Build a strong cyber resilience strategy:
Organizations are encouraged to actively learn from their experiences and build strong resilience strategies when it comes to cyber breaches. Businesses should prepare themselves for real life breach scenarios and clarify roles and responsibilities for incident response and program implementation. They are also required to identify additional departmental mitigation and preparedness needs. The conclusion of these real life exercises will result in action plans for continued improvement of internal emergency plans. A strongly resilient organization will suffer fewer security breaches, those breaches that do occur will cause less harm, and it will recover faster.
- Monitor and test your networks
Continuously monitor all systems and networks and perform penetration tests or vulnerability assessments to detect vulnerabilities that could possibly lead to breaches.