Cybersecurity risk is increasing, driven by global connectivity and usage of cloud services, like Amazon Web Services, to store sensitive data and personal information. Widespread poor configuration of cloud services paired with increasingly sophisticated cyber criminals means the risk that your organisation suffers from a successful cyber attack or data breach is on the rise.
Cyber threats can come from any level of your organisation. You must educate your staff about simple social engineering scams like phishing and more sophisticated cybersecurity attacks like ransomware attacks (think WannaCry) or other malware designed to steal intellectual property or personal data. Information security laws and regulation mean that cybersecurity is no longer something organisations of any size can ignore. Security incidents regularly affect businesses across all industries and often cause irreversible reputational damage to the companies involved.
If you are not yet worried about cybersecurity, you should be.
What is cybersecurity?
Cybersecurity is the state or process of protecting and recovering computer systems, networks, devices, and programs from any type of cyber attack. Cyber attacks are an increasingly sophisticated and evolving danger to your sensitive data, as attackers employ new methods powered by social engineering and artificial intelligence to circumvent traditional security controls.
The fact of the matter is the world is increasingly reliant on technology and this reliance will continue as we introduce the next generation of smart Internet-enabled devices that have access to our networks via Bluetooth and Wi-Fi.
The importance of cybersecurity
Cybersecurity's importance is on the rise. Fundamentally, our society is more technologically reliant than ever before and there is no sign that this trend will slow. Personal data that could result in identity theft is now posted to the public on our social media accounts. Sensitive information like TFNs, credit card information and bank account details are now stored in cloud storage services like Dropbox or Google Drive.
The fact of the matter is whether you are an individual, small business or large multinational, you rely on computer systems every day. Pair this with the rise in cloud services, poor cloud service security, smartphones and the Internet of Things (IoT) and we have a myriad of cybersecurity threats that didn't exist a few decades ago. We need to understand the difference between cybersecurity and information security, even though the skill sets are becoming more similar.
Governments around the world are bringing more attention to cyber crimes. Notifiable data breach laws are a great example. It has increased the reputational damage of data breaches by forcing all organisations that operate in AUS to communicate data breaches, often times publicly.
This has driven standards boards like the National Institute of Standards and Technology (NIST) to release frameworks to help organisations understand their security risks, improve cybersecurity measures and prevent cyber attacks.
Why is cyber crime increasing?
Information theft is the most expensive and fastest growing segment of cyber crime. Largely driven by the increasing exposure of identity information to the web via cloud services. But it is not the only target. Industrial controls that manage power grids and other infrastructure can be disrupted or destroyed. And identity theft isn't the only goal, cyber attacks may aim to compromise data integrity (destroy or change data) to breed distrust in an organisation or government.
Cyber criminals are becoming more sophisticated, changing what they target, how they affect organisations and their methods of attack for different security systems.
Social engineering remains the easiest form of cyber attack with ransomware, phishing, and spyware being the easiest form of entry. Third-party and fourth-party vendors who process your data and have poor cybersecurity practices are another common attack vector, making vendor risk management and third-party risk management all the more important.
According to the Ninth Annual Cost of Cybercrime Study from Accenture and the Ponemon Institute, the average cost of cyber crime for an organisation has increased by $1.4 million over the last year to $13.0 million and the average number of data breaches rose by 11 percent to 145. Information risk management has never been more important.
Other factors driving the growth in cyber crime include:
- The distributed nature of the Internet
- The ability for cyber criminals to attack targets outside their jurisdiction making policing extremely difficult
- Increasing profitability and ease of commerce on the dark web
- The proliferation of mobile devices and the Internet of Things.
What is the impact of cyber crime?
A lack of focus on cybersecurity can damage your business in range of ways including:
- Economic costs: Theft of intellectual property, corporate information, disruption in trading and the cost of repairing damaged systems
- Reputational costs: Loss of consumer trust, loss of current and future customers to competitors and poor media coverage
- Regulatory costs: Data breach laws mean that your organisation could suffer from regulatory fines or sanctions as a result of cyber crimes
All businesses, regardless of the size, must ensure all staff understand cybersecurity threats and how to mitigate them. This should include regular training and a framework to work with to that aims to reduce the risk of data leaks or data breaches.
Given the nature of cyber crime and how difficult it can be to detect, it is difficult to understand the direct and indirect costs of many security breaches. This doesn't mean the reputational damage of even a small data breach or other security event is not large. If anything, consumers expect increasingly sophisticated cybersecurity measures as time goes on.
How to protect your organisation against cyber crime
There are three simple steps you can take you increase security and reduce risk of cyber crime:
- Educate all levels of your organization about the risks of social engineering and common social engineering scams like phishing emails and typosquatting
- Invest in tools that limit information loss, monitor your third-party risk and fourth-party vendor risk and continuously scan for data exposure and leak credentials
- Use technology to reduce costs like automatically sending out vendor assessment questionnaires as part of an overall cyber security risk assessment strategy
Companies should no longer be asking why is cybersecurity important, but how can I ensure my organisation's cybersecurity practices are sufficient to comply with laws and regulation and to protect my business against sophisticated cyber attacks.
Examples of damages to companies affected by cyber attacks and data breaches
The amount of cyber attacks and data breaches in the recent years is staggering and it's easy to produce a laundry list of companies who are household names that have been affected.
Here's a few examples:
- Equifax: The Equifax cyber crime identity theft event affected approximately 145.5 million U.S. consumers along with 400,000-44 million British residents and 19,000 Canadian residents. Equifax shares dropped 13% in early trading the day after the breach and numerous lawsuits were filed against Equifax as a result of the breach. Not to mention the reputational damage that Equifax suffered. On July 22 2019, Equifax agreed to a settlement with the FTC which included a $300 million fund for victim compensation, $175m for states and territories in the agreement and $100 million in fines.
- eBay: Between February and March 2014, eBay was the victim of a breach of encrypted passwords, which resulted in asking all of its 145 million users to reset their password. Attackers used a small set of employee credentials to access this trove of user data. The stolen information included encrypted passwords and other personal information, including names, e-mail addresses, physical addresses, phone numbers and dates of birth. The breach was disclosed in May 2014, after a month-long investigation by eBay.
- Adult Friend Finder: In October 2016, hackers collected 20 years of data on six databases that included names, email addresses and passwords for The FriendFinder Network. The FriendFinder Network includes websites like Adult Friend Finder, Penthouse.com, Cams.com, iCams.com and Stripshow.com. Most of the passwords were protected only by the weak SHA-1 hashing algorithm, which meant that 99% of them had been cracked by the time LeakedSource.com published its analysis of the entire data set on November 14.
- Yahoo: Yahoo disclosed that a breach in August 2013 by a group of hackers had compromised 1 billion accounts. In this instance, security questions and answers were also compromised, increasing the risk of identity theft. The breach was first reported by Yahoo on December 14, 2016, and forced all affected users to change passwords, and to reenter any unencrypted security questions and answers to make them encrypted in the future. However, by October of 2017, Yahoo changed the estimate to 3 billion user accounts. An investigation revealed that users' passwords in clear text, payment card data and bank information were not stolen. Nonetheless, this remains one of the largest data breaches of this type in history.
While these are a few examples of high profile data breaches, it's important to remember that there are even more that never made it to the front page.
See the biggest data breaches for more.