Security Feature

What’s the most probable thing that you think can impact you significantly? If you think it could be a road accident, a brutal assault, an earthquake, or even heart disease, you’re way off the mark. So let’s put things in perspective right off the bat. Certainly, as this is the era of the digital ‘big bang,’ the risk of falling prey to a cyber attack eclipses all these risks.

Here are some numbers that will shake any false sense of security that you may have.

A United Nations report reveals that international homicide took the lives of almost half a million people in 2012. Statistics from a WHO report states that heart disease, the world’s No. 1 killer ailment, claimed about 7.4 million lives globally in 2012, while road traffic accidents leading to deaths rose to 1.25 million globally in 2013. In 2015, the world witnessed 14,795 earthquakes of various magnitudes.

In contrast to these numbers, last year saw over 315 million pieces of malware being reported, averaging it to close to a million malware threats per day! Coupled with this, there were actual cases of over 1 million attempts at attacking individuals and businesses each day. That’s the gargantuan risk we faced. And it’s only growing with time. To assume that your current system protection measures provide immunity to your business from such risk would be a fallacy.

Now comes the spine-chiller. Digital records of close to half a billion people were accessed and pulled out by hackers last year from various data banks of insurance companies, banks and hospitals. When such a thing happens, besides the businesses which bear the unprecedented impact, it’s individuals such as clients and customers whose data security has been compromised, thus standing at high risk. This sensitive data may then be sold by mercenaries through clandestine deals for a pretty sum on the Darknet, which may become the subject matter of identity thefts, fraudulent financial transactions, or spam marketing, adding to the collateral damage.

What’s the estimated damage?

2015 also witnessed one of the biggest bank robberies of that year, with over 100 banks across several countries such as USA, China, Germany and Russia losing out on close to $1 billion through cyber attacks.

British insurance company Lloyd’s estimates that cyber attacks cost companies $400 billion every year, while Juniper research predicts that the cost of data breaches will rise astronomically to $2.1 trillion globally by 2019. If we go down to the enterprise level, the average cost of recovering from a security breach for a small business is around $38,000, while that for a large one could go up to $551,000 as stated in a 2015 Kaspersky Lab (News - Alert) study. What’s more, intelligence at the Ponemon Institute shows that in cases where the attack is financial in nature, 68 percent of the stolen dollars are generally declared unrecoverable. Ramifications of attacks are costly to say the least.

Some large victims of infamous attacks over the last year:

• Anthem Inc, USA’s second largest health insurer, where hackers plundered the data of nearly 80 million people
• T-Mobile (News - Alert), where 15 million customer records were stolen when hackers got into the data of Experian, T-Mobile’s credit application processing partner
• TalkTalk, where around 20,000 customer data points were stolen, running up to £35 million in damages and its shares nose-diving
• The office of the U.S. Personnel Management, where hackers got in and exposed data of nearly 22 million people, including more than a million fingerprints
• Ashley Madison, the adultery website, where close to 32 million people suffered public shaming as their online presence and data were exposed, leading to the suicide of one pastor, who found his name on the list
• And the more recent breach suffered by Amazon, where a hacker exposed login credentials of 80,000 of its kindle customers after allegedly being refused of a bug bounty

What facilitates an attack despite all what businesses do, and what kind of attacks can happen?

More often than not, hackers pinprick and exploit existing vulnerabilities in the system software, or processes and practices followed within organizations. It’s like an ongoing cat and mouse chase between hackers and the potential victims. The more prepared you are, the better your chance of fending off the threats. Over 70 percent of websites have been found to have vulnerabilities. Last year witnessed at least one Zero-Day vulnerability being reported worldwide each week. Attacks can be of many types, such as:

1. DoS (Denial of Service): The victim’s sever gets flooded by more traffic per second that it can handle, leading to its inability to cope and unavailability. A DoS attack can flood or even crash services.
2. DDoS (Distributed Denial of Service): This is a DoS attack, but more diabolic in nature, orchestrated by multiple computers which the hacker has control over, thereby compounding the effect with intensity of the flood sometimes reaching as high as 400 GB per second. A DDoS attack may be an Application Layer attack, Volume-based attack, or a Protocol attack, and may manifest as a Zero-Day exploitation, HTTP flood, SYN Flood, UDP (News - Alert) flood, a Ping of Death, NTP amplification, or a Slowloris.
3. SQL Injection: A type of application layer attack that penetrates through the front-end applications that talk to user-supplied data.  
4. Spear Phishing: An Advanced Persistent Threat (APT (News - Alert)) carried out through a link embedded in a cleverly crafted deceptive email masquerading as being trustworthy.
5. Botnets: Hackers may acquire control over hundreds or thousands of computers and instruct the bots to unleash a merciless attack on a specific target.
6. Rogue software: This puts on a false face of being genuine, while concealing malicious code.
7. MITM (Man in the Middle): A MITM attack generally happens through a non-encrypted access point which may expose itself when you use your smartphone to transact with your bank.
8. Password attacks: Weak passwords can easily reveal themselves in the face of clever password guessing tools.
9. Malware: This constitutes the myriad set of malicious programs created for harm.
10. Socially engineered attacks: Once a hacker gains control over a website, he can use it to ride on a visitor’s trust by prompting a download, which then unleashes the menace.  

As hackers get viler, more sophisticated and ingenious in their ways, we see several new and alarming ways in which attacks are conducted. Gartner (News - Alert) predicts that in 2016 there will be over 6.8 billion connected devices. This proliferation of digital devices is providing an even larger playground for hackers to create havoc.

The changing faces of these demons of online terror

Driving their knives deeper, hackers have more recently targeted SCADA systems and successfully kept the power distribution down for several days. Malevolent applications have surreptitiously found their way even into MRI and X-ray machines in hospitals and hijacked data. Known as ‘Medjacking,’ this poses a serious threat to patients as well as hospitals. Ghostwares, a type of artillery in cybercrime that infiltrates deep inside the network and then covers up its tracks, are predicted to be deployed. Another observation has been of a two-faced malware that poses itself as innocent Dr. Jekyll when it is under scrutiny, but soon enough peels off its mask to reveal Mr. Hyde once the eye of suspicion moves away from it. That’s when it goes about doing its satanic work. Blastwares which wreck or disable systems once they are identified, continue to enjoy popularity of usage

What precautionary measures can help you be one up against the attackers?

While it is next to impossible to keep your business totally impermeable from such attacks, there are some best practices that you can follow to help improve your defense:

• Invest in employee education, discouraging the temptation of opening unscanned attachments or those from unknown sources, avoid clicking on embedded links from unknown sources
• Always use safe connections to the Internet facility and update your firewall
• Ongoing physical monitoring of all systems and data flows Have a strong password protection policy to thwart any attempts at password guessing
• Be wary of advertising that sounds preposterous or ostentatious, and avoid clicking to know more
• Here are four time tested risk mitigation strategies that are believed by the Australian Signals Directorate to prevent 85 percent of the targeted cyber intrusions.

With cyber attacks being devised with increasing levels of trickery, deception, obfuscation and malice, prevention is always better than the cure. And far cheaper too.

Lucjan Zaborowski is the Head of Digital for 1E. Lucjan is also an experienced marketer and project manager with a solid understanding of digital acquisition and optimization, product marketing and program management. He has over six years of experience in multi-channel digital acquisition. He is keen to learn and stay up to date with the latest marketing trends.