Despite technological advances in the cybersecurity world, evolving cyber-risks and complicated threats abound \u2013 and that\u2019s not just a qualitative statement.<\/p>\n\n\n\n
These figures presented by CSO Online<\/a> (March 2020) speak for themselves:<\/p>\n\n\n\n Cybersecurity-related incidents were clearly rampant throughout 2020, and that\u2019s not expected to change in the coming years.<\/p>\n\n\n\n Though by no means an exhaustive list, here are some of the cybersecurity threats and trends that made an imprint on the cybersecurity landscape this year.<\/p>\n\n\n\n On July 15th 2020, accounts of high profile users (e.g. Elon Musk, Bill Gates, Kanye West, Joseph R. Biden Jr., Former President Barack Obama, etc.) of the microblogging platform, Twitter, were compromised and used to fraudulently tweet about bitcoin. The tweets requested the followers of these accounts to send bitcoin to an address, falsely promising to return double the amount. This hack netted the criminals more than $100,000 in bitcoin – despite the tweets being live for only a short amount of time.<\/p>\n\n\n\n According to reports, the hackers \u201cused a phone spear phishing attack<\/a> to obtain the credentials of Twitter employees who had access to internal support systems and tools.\u201d<\/p>\n\n\n\n Phishing methods are increasingly becoming more sophisticated and realistic. As the Twitter incident highlights, it only takes a handful of individuals (if not just one person) to compromise an entire organisation.<\/p>\n\n\n\n Marriott suffered yet another data breach in January of 2020. The hotel chain disclosed that personal identifiable information of approximately 5.2 million hotel guests were accessed. The information included names, addresses, phone numbers, birth dates, and airline loyalty information. These were accessed using the log-in credentials of employees at a franchised property.<\/p>\n\n\n\n In another data server breach incident, the personal information of more than 10.6 million guests of MGM Resorts properties was disseminated on a hacking forum in February of this year. This included full names, addresses, phone numbers, birth dates, and email addresses of hotel guests, including high profile individuals, reporters, government officials, and FBI agents. The company now faces a class action lawsuit because of this breach.<\/p>\n\n\n\n The implications of data breaches can\u2019t be trivialised. Apart from hefty financial consequences, there is longer-term reputational damage to contend with, such as the loss of credibility and trust in the organisation.<\/p>\n\n\n\n In October 2020, Software AG, the second-largest software vendor in Germany and the seventh-largest in Europe, suffered a Clop ransomware attack. (The attack encrypts targeted files and makes them inaccessible – usually until ransom payments are made). It crippled part of its internal network and compromised employee information. The cybercriminals demanded a $23 million ransom. It was reported that the company tried to negotiate with the hackers, but their efforts were unsuccessful. <\/p>\n\n\n\n Finastra, a $1.9 billion revenue firm providing software solutions to financial institutions worldwide (including 90 of the top 100 global banks), was hit by a ransomware attack that disrupted their operations, requiring them to disconnect impacted servers from the Internet. Cybersecurity experts have suggested that Finestra was a target because of their history of issues relating to outdated security practices and equipment. Other firms that were the targets of ransomware attacks include the Chicago-based leading global legal firm, Seyforth Shaw LLP, and Carnival Corporation, the world\u2019s largest cruise line operator.<\/p>\n\n\n\n The prevalence of ransomware attacks requires that servers, systems, and security processes always remain up-to-date. Off-network backups should be considered as part of cybersecurity and cyber-risk strategies as well.<\/p>\n\n\n\n Deepfakes have become increasingly popular over this past year. A deepfake, as defined by this article<\/a>, is \u201ca type of artificial intelligence used to create convincing images, audio and video hoaxes. The term, which describes both the technology and the resulting bogus content, is a portmanteau of deep learning<\/a> and fake.\u201d<\/p>\n\n\n\n The targets of these AI-doctored videos are usually celebrities and politicians and they can (and have been) used to deliver messages for nefarious purposes.<\/p>\n\n\n\n Security experts state that deepfakes will eventually victimise organisations and companies. It will be adopted by cybercriminals to impersonate members of organisations to obtain access to critical business information. It will eventually evolve to become a sophisticated method of phishing. <\/p>\n\n\n\n Deep fakes can also be used to commit fraud, as hackers and criminals \u201ccreate fake versions of real companies to lure in customers.\u201d<\/p>\n\n\n\n The popularity and infancy of the security technology of IoT<\/a> devices (which range from smart security systems to voice assistants and home appliances) have made it a viable target for cybercriminals. IoT devices are not only being widely used in households, but in business organisations as well.Microsoft and other tech giants have highlighted attacks where IoT devices were used as an entry point to exploit secure network access (via printers, VoIP systems, and other devices). <\/p>\n\n\n\n The amount of confidential, personal, and\/or business information that passes through these devices have made it attractive for cyber exploits.<\/p>\n\n\n\n Cybercriminals decided to capitalise on widespread distress around COVID-19. The World Health Organisation (WHO) has warned about hackers and scammers who impersonate the organisation. They send out emails and WhatsApp messages with malicious links or attachments pertaining to COVID-19.<\/p>\n\n\n\n This article<\/a> also states that there have been incidents when employees clicked on fake emails pertaining to intercompany COVID-19 testing information. With a click, systems were compromised.<\/p>\n\n\n\n This threat will likely continue into 2021, as hackers exploit the public\u2019s interest in vaccines.<\/p>\n\n\n\n With the complex security threats mentioned above, companies have turned to cyber insurance to manage cyber security risks. According to the Cyber Insurance Market Research Report<\/a> (June 2020), the industry is expected to reach $70.7 billion by 2030, up from $5.6 billion in 2019. The primary growth drivers of the market are digitisation and the increasing occurrences of data breaches. From January 2019 to April 2020 alone, an estimated 8 billion records (including credit card numbers, phone numbers, and home addresses) have been exposed in data breaches.<\/p>\n\n\n\n Cybercriminals continue to use advanced technologies to crack passwords. Given the number of cyber crimes associated with leaked or compromised passwords, passwordless authentication will continue to gain traction.<\/p>\n\n\n\n These types of alternative authentication methods include: biometric authentication, hardware tokens, unique password tokens, and knowledge-based authentications.<\/p>\n\n\n\n The progressive migration of technology infrastructure to the cloud has spurred the need for cloud-based security services. The largest industry to avail of cloud-based security services has been the banking and financial services industry.<\/p>\n\n\n\n According to Persistence Market Research, the global public cloud management and security services market is expected to grow to $26.41 billion by the end of 2022.<\/p>\n\n\n\n Cloud-based security is believed to offer several advantages, such as improved protection performance, high and increased threat intelligence, and greater, quicker compliance with industry and government security regulations and standards. <\/p>\n\n\n\n The cybersecurity industry, as expected, leveraged AI to counter ever evolving threats.<\/p>\n\n\n\n Antivirus will continue to make use of machine learning to perform tasks such as the scanning of emails to identify social engineering or phishing attacks, the automation of network data analysis to ensure continuous monitoring, or the identification of applications or programs exhibiting unusual behaviour.<\/p>\n\n\n\n In conclusion, the cybersecurity threats and complicated risks attacking organisations from different directions prompted a writer to describe the Internet of today as the \u201cdigital wild west.\u201d There is no indication that these threats will be any less intense in 2021 – or beyond.<\/p>\n\n\n\n Practicing strong digital hygiene<\/a> alongside adopting a \u201csecurity-first\u201d mindset can no longer be an afterthought. Today\u2019s cyber-risk strategies must revolve around a lesson learned in the past year: organisations cannot afford to let their guard down.<\/p>\n\n\n\n Cybersecurity begins at the top. Given the amount of highly sensitive information that flows to and from the directors, the board cannot afford to be the weakest link when it comes to security affairs.<\/p>\n\n\n\n To protect the board against security-related incidents, boards should consider the use of a board portal<\/a> such as Boardlogic.<\/p>\n\n\n\nCybersecurity Threats<\/h2>\n\n\n\n
1. Social Engineering or Phishing Attacks<\/h3>\n\n\n\n
2. Data Breaches<\/h3>\n\n\n\n
3. Ransomware<\/h3>\n\n\n\n
4. Deepfakes<\/h3>\n\n\n\n
5. Internet of Things (IoT) Devices<\/h3>\n\n\n\n
6. Pandemic-Related Exploits<\/h3>\n\n\n\n
Cybersecurity Trends<\/strong><\/h2>\n\n\n\n
1. Cyber Insurance <\/h3>\n\n\n\n
2. Alternative Authentication<\/h3>\n\n\n\n
3. Cloud-Based Security Services<\/h3>\n\n\n\n
4. Artificial Intelligence<\/h3>\n\n\n\n
How Boardlogic Can Help<\/strong><\/p>\n\n\n\n