“Why is Cybersecurity Important?” is a question many business owners and organizations attempt to answer today. Not long ago cybersecurity was considered a job for tech guys so it was delegated to IT staff. Today cybersecurity is everyone’s job.
In 2019 cybersecurity is among the top priorities for any company.
Organizational executives know that cybersecurity is critical for business operations and processes. It is included during budget planning and allocation in an attempt to acquire the best cyber defenses available.
Just implementing simple security tools like firewalls and antiviruses is not effective today because threats have grown in scope, sophistication, and strategy.
It is essential to first understand the magnitude of cybercrime before we discuss why cybersecurity is so vital in today. The following statistics will show that cybercrime is very rampant and that it is necessary to adopt robust cybersecurity measures.
- Damages resulting from cybercrime are predicted they will have cost the world more than $6 trillion by the year 2021.
- Senior vice president and CTO of Cisco, Susan Wee, shared research which indicated 111 billion software development codes are produced every year. This introduces a massive number of potential vulnerabilities and will significantly cause an increase in zero-day exploits. They are estimated to reach one exploit every day by 2021 compared to a single one per week in 2015.
- According to the FBI’s May tally in 2015, Business Email Compromise scams have cost businesses over $12.5 billion in the last four and a half years.
- A PricewaterhouseCooper survey of 3000 business executives from at least 80 countries showed that more than half of the world’s companies are ill-prepared to handle a cyber attack.
- Manufacturing, healthcare, transportation, government and financial service are the five topmost industries targeted by cybercriminals.
- Hacking kits and tools used for ransomware, malware, identity theft, and other types of cybercrime are available in various online platforms retailing for as low as $1.
- Ransomware attacks are estimated to increase by 57 times by the year 2021 compared to 2015.
- Damage costs for ransomware attacks are estimated to reach $20 billion which is an increase from $11.5 billion in 2019, $5 billion in 2017 and $325 million in 2015.
- Crypto jacking was the fastest growing cyber threat in 2018 with an increase rate of 459%.
A changed technological landscape
A lot of technologies have emerged in the last 10-20 years. These new technologies have redefined how organizations conduct business operations, their communication channels, data processing and storage, and so on.
For example, social media platforms like Facebook and Twitter are often used to communicate product launches or other information to millions of customers instantaneously. Just a few years ago television and radios were the primary means of advertisement.
Almost all businesses today utilize cloud services. Not long ago all data and IT infrastructure were owned, secured, and located on the business premises.
Other technologies, such as ERP systems, smartphones, and 4G networks have also been adopted and are now crucial for companies to provide their services.
IoT devices are potential entry points for hackers
The use of IoT (Internet of Things) in business has increased rapidly, with Cisco estimating that 27.1 billion IoT devices will be connected globally by the year 2021. They are smart devices which are interconnected through the internet, and they include smartphones, iPads, laptops, tablets, etc.
IoT devices can simplify business processes and improve productivity and work efficiency. However, each IoT device used for work is also a potential entry point for hackers. Many IoT devices contain security vulnerabilities and keeping track of these vulnerabilities can be a difficult task.
Manufacturers of some IoT devices tend to abandon them and they don’t provide new updates or security patches. Such devices can have numerous exploitable vulnerabilities. This increases the possibility of a successful cyber-attack. To harden cybersecurity posture organizations should ensure that IoT devices are subjected to frequent and thorough vulnerability assessments.
Cybersecurity impacts everyone
Developing and maintaining effective cybersecurity strategies affects the entire online community in an organization in the same way that safe driving reassures the safety of every passenger. This starts from an individual level. An infected personal device which is connected to company network or system can infect other systems causing the organizations to be vulnerable to attacks.
Securing email or social media accounts with weak passwords and observing insecure practices for storing passwords provides an easy way for hackers to access the accounts. They can, in turn, access personal information of other users that communicate through the account.
The cybersecurity practices advanced by a company should be developed in such a way that all users are adequately protected. Security policies may vary from one department to another since they may have different levels of data access or may be using different IT systems. A comprehensive cybersecurity program is required to ensure that the security needs of every user are addressed without compromising the needs of others.
Cybercrime has increased and evolved
The technological changes in the past decade has resulted in an advanced approach for executing cybercrimes. Cybercriminals have adopted better strategies for targeting companies and using advanced techniques to launch attacks.
Recently a lot of attacks are planned and achieved using artificial intelligence. They are smarter and have more destructive capabilities. An increased reliance on data processing and storage has also led to a rise in cyberattacks.
Over 2.5 quintillion (1 with eighteen zeros) bytes of data are created every other day, and since data is valuable to cybercriminals, thousands of cyberattacks are attempted daily. Such statistics are a clear indication that a strong cybersecurity posture is critical.
Cyberattacks cause huge damages to the victims
A primary purpose of cyber-attacks is to cause harm to the victim. This is through gaining unauthorized system access to steal data, locking out system users, installing malware for remote monitoring, among others.
Large organizations have been targeted by cyberattacks, costing them millions of dollars in damages and injured reputation. Damages caused by cyberattacks can be very consequential to the victim as shown in the following examples:
144 universities targeted by cyberattacks
Different types of cyberattacks targeted 144 universities based in the United States in 2018. The responsible group had been executing the attacks for three years before it was indicted. During the attacks, data exceeding 31 terabytes was stolen. This included intellectual property whose worth amounted to more than $3 billion.
Exactis breached compromising data for 340 million users
Exactis was hit by a largescale attack where the attackers were able to compromise data owned by 340 million clients. The company offers services for compiling as well as aggregating premium data. It has access to at least 3.5 billion personal data making it a prime target.
Yahoo and Gmail’s authentication security hacked
Yahoo and Gmail are the world’s largest service providers. The companies have implemented a lot of security measures to protect users’ accounts. This includes the multi-factor authentication technique where a user has to provide the correct username and password and then provide additional information such as verification code.
Despite this, the companies were hacked through spear phishing techniques. The targets, most being senior U.S. government officials, were tricked into inputting personal details that were accessible by the hackers who then proceeded to login to the victims’ accounts. Although Gmail and Yahoo didn’t suffer any loses, their reputations were severely harmed.
150 million Under Armor user accounts breached
Under Armor owns the MyFitnessPal mobile app that allows user to keep track of the calories they ingest every day and then compare intake to their exercise levels. A breach in 2018 caused user data of more than 150 million users to be compromised. The stolen data included usernames, email addresses, and passwords.
WannaCry cyber attack
The WannaCry attack affected hospitals across the U.K., causing health services to shut down for close to a week. The attack was a ransomware attack where cybercriminals took control of health systems and demanded payment to relinquish control. It was a large-scale attack since patients across the U.K and in other affected countries were unable to access medical care.
Many other attacks have targeted companies providing different services and which are in various industries. As shown in the examples above, cybercriminals target any sector, ranging from healthcare, finance, communication, to health and fitness. Cyber actors don’t target a specific company or industry, but they instead aim where systems are most vulnerable. Any organization can be a target, and this makes cybersecurity to be critical than ever before.
Cyberattacks can negatively impact your business
The above examples are a clear indication that cyberattacks have a direct negative impact on the victim. A business without effective cybersecurity solutions can be a victim of cyberattacks. The significant effect caused by cybercrime is the economic impact. An attacked company can;
- Lose its intellectual properties and corporate information which are critically important to the company’s success.
- Lose intellectual property meaning that the affected organization cannot claim ownership of its services or products.
- Be unable to continue with business operations due to system downtime or in the case of ransomware attacks.
- Lose customers who are afraid that their data may also be compromised due to insufficient security practices. A damaged reputation causes a lowered profitability.
Other than such direct impacts, a cyberattack usually leads to costly legal battles. A business that has been a victim of cybercrime is held responsible for any cyber incidences especially if the organization’s negligence towards cybersecurity caused the incidents. If an company fails to secure personal data with a password or encryption it is at fault. The company may be required to compensate all affected data owners translating to millions of dollars.
Many countries have adopted cybersecurity legislation that require organizations to observe various guidelines when handling personal data. For instance, the GDPR (General Data Protection Regulation) requires data handlers to first seek the consent of the data owners before using their information for any purpose. Cybersecurity legislation impose hefty fines on breached companies. GDPR can impose penalties on a company more than 4% of its annual revenue for failing to secure customer data properly.
How your business can be cybersecure
Businesses today don’t have the luxury of choosing whether to implement cybersecurity systems, tools, or policies. It is now mandatory considering the fact that a cyberattack can target anybody. While it is impossible to be 100% cyber secure, there are several strategies an organization can implement to realize an optimum cybersecurity.
1. Create cyber awareness
Many attacks are successful when an employee or a user makes a security mistake. The mistake can be due to ignorance of observing best security practices when using IT assets. Creating cyber awareness and training employees on cybersecurity can significantly minimize the possibility of a cyberattack.
Cyber awareness and training should consist of effective practices for managing passwords. Passwords provide the most straight forward form of defense, but they can cause many security incidences if not managed well. Effective password management includes creating strong passwords that are difficult to crack, always locking a workstation with a complex password, and observing secure password storage.
Creating awareness on how to identify attacks like phishing can improve an organization’s cybersecurity posture. Phishing attacks are usually executed through emails where the attacker sends a malicious link or attachment to a target. Prompt identification of such emails can reduce the possibility of a phishing attack. Training should show users how to spot fake emails.
Attackers use emails that resemble that of a trusted party. A legitimate email like firstname.lastname@example.org can be modified to email@example.com such that a user can have trouble identifying the differences. Equipping system users with necessary cybersecurity skills can enable a business to be cybersecure.
2. Protect against data leaks
Data leakages are among the biggest threats to a company’s cybersecurity. Data leaks have the potential of causing unrecoverable damages both at an individual and at a company level. Every business handles sensitive data which can be the personal details of a customer, confidential employee and supplier data, data revealing the company’s strategic directions and objectives, intellectual properties, etc. Data leaks involving such types of information can have severe consequences for the business.
One way of preventing data leaks is through limiting data accessible by the public. An organization has no business sharing customer or employee data in a public domain like on Facebook. Only authorized individuals should have access to sensitive data, and they should adhere to a business’s policies that govern how such data should be handled.
Limiting data access from the public is not enough. Some employees in a company might be insider threats. These employees may use company data for malicious reasons. For example, an irate employee can blackmail the employer into meeting specific demands by threatening to hand over valuable data to competitors. Such problems can be averted through implementing access control measures.
Access control determines who has all the required permissions for accessing specific content. Widespread access control techniques includes the concept of least privilege. This is where employees are only allowed to access the data they need. A form of this role-based access in which an employee responsibilities determines the data they can access.
3. Protect against ransomware attacks
Ransomware attacks have been the topmost threats to business for years. The attack is where a cybercriminal encrypts the victim’s data or IT assets and demands large payments as a ransom to provide decryption keys. Although the attacks target data mostly stored in physical computers, there is an increased rate of ransomware attacks targeting data stored in the cloud.
Protecting against ransomware attacks involves creating multiple backups and storing them in secure and separate locations. Even if an attack encrypts the data stored in physical computers, an organization can retrieve the backups and proceed with day to day operations. Cloud backups are effective but they can sometimes be unavailable hence the backups should be replicated in locally available but highly secure devices.
Using trusted firewalls and antiviruses can protect against ransomware attacks. A secure firewall with complex and reliable security rules for filtering incoming connections can help prevent ransomware attacks executed through the network.
The antivirus products should be updated as soon as new security definitions are released. New malware programs are created every day, and updating the antivirus ensures it can protect against new threats. However, a company should be careful to use antivirus products from trusted vendors.
A fake antivirus product claiming to prevent ransomware attacks can expose your business to many security risks. Windows security center from Microsoft is a good example of a trusted antivirus solution.
4. Prevent phishing and social engineering attacks
Phishing attacks are processes attackers use to obtain confidential information fraudulently. Attackers use trickery to convince their targets to click on malicious links or attachments. Phishing is a form of social engineering.
A single click automatically downloads and installs malware into the system. Typically, a phishing attack is executed through emails where unsuspecting victims receive messages from a sender disguised as a trusted party. An example is where an attacker pretends to be a bank employee and emails an individual that his bank account has a problem and requires to log in to the bank’s online account.
However, upon clicking on the provided link, the individual is redirected to a malicious website which installs malware to his computer. Other emails may contain attachments that appear to be legit such as that from a supplier or a customer. The attachments may be laden with malware which automatically installs once they are opened.
Today, cybercriminals have taken to a new technique where they use artificial intelligence to target new victims. Using AI results to smarter emails which are sent to hundreds of email accounts all at once. This shows the levels to which cybercriminals go to.
Phishing attacks can be prevented through not opening attachments or links sent by unknown people. In fact, all suspicious email addresses requiring one to click on links or attachments, or which ask the recipient for personal information should be marked as spam and forwarded to the IT department for more action.
Avoiding posting sensitive information like email addresses on online platforms can further lower the chances of a phishing attack from occurring. If an email address must be provided, organizations are highly recommended to use unofficial email which are never used on company equipment. The emails can be set to forward new messages to official accounts once they have been verified to be safe.
5. Adopt policies for securing emerging technologies
Businesses are raring to try out emerging technologies, especially those that claim to provide better functionalities than existing ones. While there is nothing wrong with this, new, untested technologies can cause severe security issues. They may contain undiscovered vulnerabilities providing cybercriminals with easy exploits.
Emerging technologies might be incompatible with other systems, and this magnifies the security risks. A company should adopt strong policies governing the acquisition and use of new technologies within the workplace as part of its cybersecurity programs.
For example, such a policy would require emerging technologies to have successfully been used and tested to the limit to ascertain they are entirely secure.
Benchmarking organizations that have used the technologies without security problems can also be an effective policy. With the rapid technological changes, IT professionals require to stay abreast of new developments. Among others, this ensures that the policies implemented for governing data access, use and handling in previous technologies can effectively provide security to the latest technologies.
Cybersecurity policies should be continuously amended as organizations populate their IT infrastructures with new ones. Changing security policies eliminates the possibility of an attack.
- https://cybersecurityventures.com/cybersecurity-almanac-2019/ ↑
- https://www.networkworld.com/article/3198474/lan-wan/cisco-to-network-engineers-get-comfortable-with-software-it-s-here-to-stay.html ↑
- https://www.infosecurity-magazine.com/opinions/zero-day-attack-recovery/ ↑
- https://www.ic3.gov/media/2018/180712.aspx ↑
- https://www.forbes.com/sites/stevemorgan/2016/05/13/list-of-the-5-most-cyber-attacked-industries ↑
- http://fortune.com/2017/10/25/cybercrime-spyware-marketplace/ ↑
- https://cybersecurityventures.com/cybersecurity-almanac-2019/ ↑
- https://cybersecurityventures.com/global-ransomware-damage-costs-predicted-to-reach-20-billion-usd-by-2021/ ↑
- https://www.ccn.com/cryptojacking-is-up-459-in-2018-and-its-the-nsas-fault/ ↑
- https://www.consultancy.uk/news/18435/five-reasons-cyber-security-is-more-important-than-ever ↑
- https://www.forbes.com/sites/bernardmarr/2018/05/21/how-much-data-do-we-create-every-day-the-mind-blowing-stats-everyone-should-read/ ↑
- https://www.wired.com/story/iran-cyberattacks-us-universities-indictment/ ↑
- https://www.wired.com/story/iran-cyberattacks-us-universities-indictment/ ↑
- https://www.wired.com/story/exactis-database-leak-340-million-records/ ↑
- https://arstechnica.com/information-technology/2018/12/iranian-phishers-bypass-2fa-protections-offered-by-yahoo-mail-and-gmail/ ↑
- https://www.forbes.com/sites/paullamkin/2018/03/30/under-armour-admits-huge-myfitnesspal-data-hack/#649ee2f0cc54 ↑