{"id":7784,"date":"2021-11-30T11:43:19","date_gmt":"2021-11-30T11:43:19","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=7784"},"modified":"2021-12-08T15:23:11","modified_gmt":"2021-12-08T15:23:11","slug":"biggest-cybersecurity-threats-to-businesses","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/biggest-cybersecurity-threats-to-businesses\/","title":{"rendered":"What are the biggest cybersecurity threats facing businesses?"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"7784\" class=\"elementor elementor-7784\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p><span style=\"font-weight: 400;\">Cybersecurity is a living thing, constantly moving in new directions. The size and scope of attacks grow, the biggest cybersecurity threats change (although previous biggest cybersecurity threats rarely disappear), and the methods of attack evolve.<\/span><\/p><p><span style=\"font-weight: 400;\">That\u2019s why it is important for organisations of all shapes and sizes to stay on top of current cybersecurity threats. Understanding what the current trends are is how organisations can protect themselves against cyber attack when it comes. The information provided by cybersecurity agencies helps organisations build <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/security-risk-and-compliance\/cybersecurity-risk-management\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">cybersecurity strategies<\/span><\/a><span style=\"font-weight: 400;\"> that can help them reduce the risk of current cybersecurity threats becoming attacks.<\/span><\/p><h2><span style=\"font-weight: 400;\">What are the biggest cybersecurity challenges right now?<\/span><\/h2><p><b>Increasing number of attacks: <\/b><span style=\"font-weight: 400;\">Cyber attacks in the UK are on the rise. The <\/span><a href=\"https:\/\/www.ncsc.gov.uk\/collection\/ncsc-annual-review-2021\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">National Cyber Security Centre (NCSC) annual review 2021<\/span><\/a><span style=\"font-weight: 400;\"> reported that they were called to support 777 organisations following a major attack in the year to August 2021. This figure represented a 7.5% increase on the year before.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">Another government report published earlier this year, the <\/span><a href=\"https:\/\/www.gov.uk\/government\/statistics\/cyber-security-breaches-survey-2021\/cyber-security-breaches-survey-2021\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Cyber Security Breaches Survey<\/span><\/a><span style=\"font-weight: 400;\">, reported that 39% of all businesses reported a cyber attack or cybersecurity breach in 2020.<\/span><\/p><p><span style=\"font-weight: 400;\">The actors behind these attacks are also changing. Some of the highest profile attacks mentioned in the NCSC Annual Review were attributed to nation state actors, particularly Russia and China.<\/span><\/p><p><b>Larger digital footprint:<\/b><span style=\"font-weight: 400;\"> As the impact of the Covid-19 pandemic continues to push employees to work remotely, and organisations put in more and more technologies to support remote working, cyber criminals continue to take advantage.<\/span><\/p><p><span style=\"font-weight: 400;\">The move to remote working has pushed many organisations to increase their digital footprint, investing in more systems, and investing in cloud-based solutions so that their remote workers can easily access their work. This in turn increases the attack surface through which they can be attacked (more about that later).<\/span><\/p><p><b>Lack of protections for employees:<\/b><span style=\"font-weight: 400;\"> Remote working removes employees from the safety of the office network. Only 35% of organisations in the Cyber Breaches Survey responded that they deploy security monitoring tools, and only 32% undertake user monitoring as it is more difficult when employees are working outside the network.<\/span><\/p><p><span style=\"font-weight: 400;\">Keeping track of endpoints is also difficult, and pushing security products such as malware protection and program and system updates is also more difficult when employees are working remotely. Overall visibility of cybersecurity has reduced over the pandemic.<\/span><\/p><p><span style=\"font-weight: 400;\">Furthermore, cybersecurity training for employees has decreased even as the risks have grown. The Cybersecurity Breaches Survey reported that just 20% of organisations test their employees\u2019 cybersecurity knowledge, and just 23% have policies that cover remote working which could help employees stay safe when working remotely.<\/span><\/p><h2><span style=\"font-weight: 400;\">What are the biggest cybersecurity threats right now?<\/span><\/h2><p><span style=\"font-weight: 400;\">The top current cybersecurity threats contain some familiar trends, and some twists on old forms of attack. Below are three of the biggest cybersecurity threats, out of a list of many more.<\/span><\/p><h3><span style=\"font-weight: 400;\">Ransomware\u00a0<\/span><\/h3><p><span style=\"font-weight: 400;\">Ransomware is one of the biggest cybersecurity threats facing organisations. Use of ransomware has been growing over the last few years, and the rate of <\/span><a href=\"https:\/\/www.theguardian.com\/uk-news\/2021\/oct\/25\/ransomware-attacks-in-uk-have-doubled-in-a-year-says-gchq-boss\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">ransomware attacks more than doubled<\/span><\/a><span style=\"font-weight: 400;\"> between 2020 and 2021.<\/span><\/p><p><span style=\"font-weight: 400;\">Recent ransomware attacks have used \u201cdouble extortion\u201d attacks. In these attacks the attacker will steal data before they encrypt it. This way, if an organisation <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/is-it-legal-to-pay-ransomware-demands\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">does not pay the ransom<\/span><\/a><span style=\"font-weight: 400;\"> because they have a backup in place, the ransomware gang can threaten to release their data unless they pay up.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">This now puts further pressure on organisations to protect data at rest, avoiding keeping it plain text that can be accessed by criminals.<\/span><\/p><h3><span style=\"font-weight: 400;\">Supply chain attacks<\/span><\/h3><p><span style=\"font-weight: 400;\">The last year has seen an increase in high profile supply chain attacks. In a supply chain attack, attackers will target less secure organisations within a supply chain to move up and down the chain and gain access to as large a group of victims as possible.<\/span><\/p><p><span style=\"font-weight: 400;\">The first attack last December was the <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/us-treasury-cyber-attack-suppliers-in-the-spotlight\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">SolarWinds hack<\/span><\/a><span style=\"font-weight: 400;\">, which exploited a vulnerability in a supplier (SolarWinds) to gain access to high profile organisations including the US Treasury, cybersecurity firm <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/fireeye-cyber-attack-an-attack-of-the-hgihest-level\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">FireEye<\/span><\/a><span style=\"font-weight: 400;\">, and other government agencies across the US and even the UK.<\/span><\/p><p><span style=\"font-weight: 400;\">In March, <\/span><a href=\"https:\/\/www.microsoft.com\/security\/blog\/2021\/03\/02\/hafnium-targeting-exchange-servers\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Microsoft<\/span><\/a><span style=\"font-weight: 400;\"> announced that their Exchange Servers had been compromised by Chinese state actors. Microsoft is one of the world\u2019s largest suppliers, and thousands of organisations of all sizes were impacted by this attack.<\/span><\/p><p><span style=\"font-weight: 400;\">The <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/kaseya-ransomware-attack-update\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Kaseya ransomware attack<\/span><\/a><span style=\"font-weight: 400;\"> in July 2021 was a classic supply chain attack. Kaseya\u2019s tool for managed service providers was compromised giving the attackers access to their customers\u2019 systems. In all, over 1,500 organisations were affected by these attacks, including the Swedish Coop chain, and dentists in New Zealand.<\/span><\/p><p><span style=\"font-weight: 400;\">For smaller organisations such as small businesses and startups, supply chain attacks are a double threat. Small businesses may be the final victims of an attack on their supplier. Thousands of small businesses were impacted by each of the three attacks listed above even if they weren\u2019t the primary targets.<\/span><\/p><p><span style=\"font-weight: 400;\">Smaller organisations may also be the target for launching the attack &#8211; the broken link in the supply chain. The attacks above (other than the Microsoft attack) targeted smaller players with perceived weaker cyber protections.<\/span><\/p><h3><span style=\"font-weight: 400;\">Phishing and social engineering attacks\u00a0<\/span><\/h3><p><span style=\"font-weight: 400;\">Phishing and <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/6-social-engineering-tactics-in-action-in-2021\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">social engineering<\/span><\/a><span style=\"font-weight: 400;\"> are still popular forms of attack because people still fall for them. 80% of UK organisations reported that they experienced phishing attacks in 2020 where criminals attempt to get regular employees to give them information or passwords that will give them access to an organisation\u2019s systems.<\/span><\/p><p><span style=\"font-weight: 400;\">The NCSC annual report mentioned that they saw thousands of phishing campaigns targeted at users, including 442 phishing campaigns using NHS branding, and 80 illegitimate NHS apps.<\/span><\/p><p><span style=\"font-weight: 400;\">Phishing and social engineering are deceptively simple. A surprising number of people fall for them, inadvertently providing a launch pad for cyber criminals to enter systems and launch the types of catastrophic attacks listed above.<\/span><\/p><h2><span style=\"font-weight: 400;\">How to avoid cyber threats<\/span><\/h2><p><span style=\"font-weight: 400;\">Reading the headlines, it would feel as though the criminals always get their mark. However, just like an iceberg, the reality is that a large proportion of cyber attacks are repelled by organisations who have put effective cyber defences in place.<\/span><\/p><p><span style=\"font-weight: 400;\"> NCSC annual report gives the example that the University of Oxford\u2019s vaccination research team were able to repel a ransomware attack that would have severely disrupted their research. This was because they had followed a cybersecurity programme earlier in the year.<\/span><\/p><p><span style=\"font-weight: 400;\">In another example that did make the headlines, <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/manchester-united-cyber-attack-a-textbook-response\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Manchester United FC<\/span><\/a><span style=\"font-weight: 400;\"> were able to minimise the damage of a cyber attack, again because of the quality of the cyber defences they had in place.<\/span><\/p><p><span style=\"font-weight: 400;\">So how can organisations avoid cyber threats?<\/span><\/p><ol><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Create a <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/security-risk-and-compliance\/cybersecurity-risk-management\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">cybersecurity programme<\/span><\/a><span style=\"font-weight: 400;\"> that includes policies, processes, and roles and responsibilities.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Check for misconfigurations of <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/network-security\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">networks<\/span><\/a><span style=\"font-weight: 400;\"> and systems, and in <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/cloud-security\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">cloud environments<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Secure networks, systems, and cloud environments with protective technology such as firewalls, endpoint protection, anti-malware, and more.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Protect sensitive data with encryption at rest and in transit.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Create a backup schedule and store backups securely on a different network.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/outofsite.biz\/cynance\/10-cyber-security-mistakes-to-avoid\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Train employees to be safe<\/span><\/a><span style=\"font-weight: 400;\"> &#8211; encourage <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/secure-passwords-dont-protect-network-security\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">strong passwords<\/span><\/a><span style=\"font-weight: 400;\"> and help them understand their <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/10-cyber-security-mistakes-to-avoid\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">cybersecurity responsibilities<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Create a <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/measuring-success-cybersecurity-performance-metrics\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">measurement schedule<\/span><\/a><span style=\"font-weight: 400;\"> to understand the success of the cybersecurity programme.<\/span><\/li><\/ol><p><span style=\"font-weight: 400;\">Stay safe.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Cybersecurity is a living thing, constantly moving in new directions. The size and scope of attacks grow, the biggest cybersecurity threats change (although previous biggest cybersecurity threats rarely disappear), and the methods of attack evolve. That\u2019s why it is important for organisations of all shapes and sizes to stay on top of current cybersecurity threats.&hellip;<\/p>\n","protected":false},"author":10,"featured_media":7792,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7784"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=7784"}],"version-history":[{"count":0,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7784\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/7792"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=7784"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=7784"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=7784"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}