Why is Cybersecurity Important in 2023?

Why is Cybersecurity Important? is a question many business owners and organizations attempt to answer today. Not long ago, cybersecurity was considered a job for IT staff alone.  Today cybersecurity is everyone’s job.

In 2022 cybersecurity is among the top priorities for any company.

Organizational executives know that cybersecurity is critical for business operations and processes. The importance of cybersecurity is a primary theme during budget planning and allocation.  Companies attempt to acquire the best cyber defenses available.

Implementing simple security tools like firewalls and antiviruses is not sufficient today because threats have grown in scope, sophistication, and strategy.

Cybersecurity statistics

It is essential first to understand the magnitude of cybercrime before we discuss why cybersecurity is so vital today.  The following statistics will show that cybercrime is rampant and necessary to adopt robust cybersecurity measures.

• Damages resulting from cybercrime will cost the world more than $6 trillion by the year 2022.^[1]
• Senior vice president and CTO of Cisco, Susan Wee, shared research that indicated the coders produce 111 billion software development codes every year.^[2] This introduces a massive number of potential vulnerabilities and will significantly cause an increase in zero-day exploits. They are estimated to reach one exploit every day by 2022 compared to a single one per week in 2015.^[3]
• According to the FBI’s May tally in 2015, Business Email Compromise scams have cost businesses over $12.5 billion in the last four and a half years.^[4]
• A PricewaterhouseCooper survey of 3000 business executives from at least 80 countries showed that more than half of the world’s companies are ill-prepared to handle a cyber-attack.
• Manufacturing, healthcare, transportation, government, and financial service are the five topmost industries targeted by cybercriminals.^[5]
• Hacking kits and tools used for ransomware, malware, identity theft, and other cybercrime types are available in various online platforms retailing for as low as $1.^[6]
• Ransomware attacks are estimated to increase by 57 times by the year 2022 compared to 2015.^[7]
• Damage costs for ransomware attacks are expected to reach $20 billion, increasing from $11.5 billion in 2019, $5 billion in 2017, and $325 million in 2015.^[8]
• Crypto-jacking was the fastest-growing cyber threat in 2018, with a growth rate of 459%.^[9]

A changing technological landscape

A lot of technologies have emerged in the last 10-20 years. These new technologies have redefined how organizations conduct business operations, communication channels, data processing, storage, etc.

For example, social media platforms like Facebook and Twitter are often used to communicate product launches or other information to millions of customers instantaneously.  Just a few years ago, television and radio were the primary means of advertisement.

Almost all businesses today utilize cloud services. Not long ago, all data and IT infrastructure were owned, secured, and located on the business premises.

Other technologies, such as ERP systems, smartphones, and 4G networks, have also been adopted and are now crucial for companies to provide their services.

IoT devices are potential entry points for hackers

The use of IoT (Internet of Things) in business has increased rapidly, with Cisco estimating that 27.1 billion IoT devices will be connected globally very soon. They are smart devices interconnected through the internet, and they include smartphones, iPads, laptops, tablets, etc.

IoT devices can simplify business processes and improve productivity and work efficiency.  However,  each IoT device used for work is also a potential entry point for hackers. Many IoT devices contain security vulnerabilities, and keeping track of these vulnerabilities can be a difficult task.

Manufacturers of some IoT devices tend to abandon them, and they don’t provide new updates or security patches. Such devices can have numerous exploitable vulnerabilities. These vulnerabilities increase the possibility of a successful cyber-attack. To harden cybersecurity posture, organizations should ensure that IoT devices are subjected to frequent and thorough vulnerability assessments.

Cybersecurity impacts everyone

Developing and maintaining effective cybersecurity strategies affects the entire online community in an organization in the same way that safe driving reassures every passenger’s safety. Cybersecurity strategies must start at an individual level. An infected personal device that connects to the company network or system can infect other systems causing the organizations to be vulnerable to attacks.

Securing email or social media accounts with weak passwords and observing insecure practices for storing passwords provides an easy way for hackers to access the accounts. They can, in turn, access the personal information of other users that communicate through the account.

The cybersecurity practices advanced by a company should be developed so that all users are adequately protected. Security policies may vary from one department to another since they may have different data access levels or may be using different IT systems. A comprehensive cybersecurity program is required to ensure that every user’s security needs are addressed without compromising the needs of others.

Cybercrime has increased and evolved.

The technological changes in the past decade have resulted in an advanced approach for executing cybercrimes. Cybercriminals have adopted better strategies for targeting companies and using advanced techniques to launch attacks.

Recently a lot of attacks are planned and achieved using artificial intelligence. They are smarter and have more destructive capabilities. Increased reliance on data processing and storage has also led to a rise in cyberattacks.

Over 2.5 quintillion (1 with eighteen zeros) bytes of data are created every other day,^[11], and since data is valuable to cybercriminals, thousands of cyberattack attempts occur daily. Such statistics are a clear indication that a healthy cybersecurity posture is critical.

Cyberattacks cause considerable damages to the victims

A primary purpose of cyber-attacks is to cause harm to the victim. Attackers gain unauthorized system access to steal data, locking out system users, installing malware for remote monitoring, among others.

Large organizations have been targeted by cyberattacks, costing them millions of dollars in damages and injured reputation. Damages caused by cyberattacks can be very consequential to the victim, as shown in the following examples:

• 144 universities targeted by cyberattacks

Different types of cyberattacks targeted 144 universities based in the United States in 2018.^[12] The responsible group had been executing the attacks for three years before being caught. During the attacks, the group stole data exceeding 31 terabytes. This theft included intellectual property whose worth amounted to more than $3 billion.^[13]

• Exactis breached compromising data for 340 million users

Exactis suffered a largescale attack where the attackers were able to compromise data owned by 340 million clients.^[14] The company offers services for compiling as well as aggregating premium data. It has access to at least 3.5 billion personal data making it a prime target.

• Yahoo and Gmail’s authentication security was hacked.

Yahoo and Gmail are the world’s largest service providers. The companies have implemented a lot of security measures to protect users’ accounts. These measures include the multi-factor authentication technique where a user has to provide the correct username and password and then provide additional information such as a verification code.

Despite this, the companies fell victim to spear-phishing techniques. The targets, most being senior U.S. government officials, were tricked into inputting personal details that were accessible by the hackers, who then proceeded to login into the victims’ accounts.^[15] Although Gmail and Yahoo didn’t suffer any losses, their reputations suffered severely.

• 150 million Under Armor user accounts breached

Under Armor owns the MyFitnessPal mobile app that allows the user to track the calories they ingest every day and then compare intake to their exercise levels. A breach in 2018 caused user data of more than 150 million users to be compromised.^[16] The stolen data included usernames, email addresses, and passwords.

• WannaCry cyberattack

The WannaCry attack affected hospitals across the U.K., causing health services to shut down for close to a week. The attack was a ransomware attack where cyber criminals took control of health systems and demanded payment to relinquish control. It was a large-scale attack since patients across the U.K, and other affected countries could not access medical care.

Many other attacks have targeted companies providing different services and which are in various industries. As shown in the examples above, cybercriminals target any sector, ranging from healthcare, finance, communication to health and fitness. Cyber actors don’t target a specific company or industry, but they instead aim where systems are most vulnerable. Any organization can be a target, and this makes cybersecurity to be critical than ever before.

Cyberattacks can negatively impact your business.

The above examples are a clear indication that cyberattacks have a direct negative impact on the victim. A business without effective cybersecurity solutions can be a victim of cyberattacks. The significant effect caused by cybercrime is the economic impact. An attacked company can;

• Lose its intellectual properties and corporate information, which are critically important to the company’s success.
• Lose intellectual property, meaning that the affected organization cannot claim ownership of its services or products.
• Be unable to continue with business operations due to system downtime or in the case of ransomware attacks.
• Lose customers who are afraid that their data may also get compromised due to insufficient security practices. A damaged reputation causes a lowered profitability.

Other than such direct impacts, a cyberattack usually leads to costly legal battles. A business that has been a victim of cybercrime is responsible for any cyber incidences, especially if the organization’s negligence towards cybersecurity caused the incidents. If a company fails to secure personal data with a password or encryption, it is at fault. The company may be required to compensate all affected data owners translating to millions of dollars.

Many countries have adopted cybersecurity legislation that requires organizations to observe various guidelines when handling personal data. For instance, the GDPR (General Data Protection Regulation) requires data handlers to first seek the data owners’ consent before using their information for any purpose. Cybersecurity legislation imposes hefty fines on breached companies. GDPR can impose penalties on a company for more than 4% of its annual revenue for failing to secure customer data appropriately.

How your business can be cyber secure

Companies today don’t have the luxury of choosing whether to implement cybersecurity systems, tools, or policies. It is now mandatory because a cyberattack can target anybody. While it is impossible to be 100% cyber secure, there are several strategies an organization can implement to realize optimum cybersecurity.

1. Create cyber awareness

Many attacks are successful when an employee or a user makes a security mistake. The mistake can be due to ignorance of observing best security practices when using IT assets. Creating cyber awareness and training employees on cybersecurity can significantly minimize the possibility of a cyberattack.

Cyber awareness and training should consist of effective practices for managing passwords. Passwords provide the most straightforward form of defense, but they can cause many security incidences if not managed well. Effective password management includes creating strong passwords that are difficult to crack, always locking a workstation with a complex password, and observing secure password storage.

Creating awareness on how to identify attacks like phishing can improve an organization’s cybersecurity posture. Phishing attacks utilize emails where the attacker sends a malicious link or attachment to a target. Prompt identification of such emails can reduce the possibility of a phishing attack. Training should show users how to spot fake emails.

Attackers use emails that resemble that of a trusted party. A legitimate email like [email protected] can be modified to [email protected] such that a user can have trouble identifying the differences. Equipping system users with necessary cybersecurity skills can enable a business to be cyber secure.

2. Protect against data leaks

Data leakages are among the biggest threats to a company’s cybersecurity. Data leaks have the potential of causing unrecoverable damages both at an individual and at a company level. Every business handles sensitive data, including the personal details of a customer, confidential employee and supplier data, data revealing the company’s strategic directions and objectives, intellectual properties, etc. Data leaks involving such types of information can have severe consequences for the business.

One way of preventing data leaks is by limiting data accessible by the public. An organization has no business sharing customer or employee data in a public domain like on Facebook. Only authorized individuals should have access to sensitive data, and they should adhere to a business’s policies that govern how to handle such data.

Limiting data access from the public is not enough. Some employees in a company might be insider threats.  These employees may use company data for malicious reasons. For example, an angry employee can blackmail the employer into meeting specific demands by threatening to hand over valuable data to competitors. Such problems are avoided by implementing access control measures.

Access control determines who has all the required permissions for accessing specific content. Widespread access control techniques include the concept of least privilege.  This is where employees are only allowed to access the data they need.  A form of this role-based access in which an employee’s responsibility determines the data they can access.

3. Protect against ransomware attacks

Ransomware attacks have been the topmost threat to businesses for years. The attack is where a cybercriminal encrypts the victim’s data or IT assets and demands large payments as a ransom to provide decryption keys. Although the attacks target data mostly stored in physical computers, there is an increased rate of ransomware attacks targeting data stored in the cloud.

Protecting against ransomware attacks involves creating multiple backups and storing them in secure and separate locations. Even if an attack encrypts the data stored in physical computers, an organization can retrieve the backups and proceed with day-to-day operations. Cloud backups are adequate, but they can sometimes be unavailable. Therefore, the backups should be replicated in locally available but highly secure devices.

Using trusted firewalls and antiviruses can protect against ransomware attacks. A secure firewall with complex and reliable security rules for filtering incoming connections can help prevent ransomware attacks executed through the network.

Users should update antivirus products as soon as new security definitions are released. New malware programs are created every day, and updating the antivirus ensures it can protect against new threats. However, a company should be careful to use antivirus products from trusted vendors.

A fake antivirus product claiming to prevent ransomware attacks can expose your business to many security risks. Windows security center from Microsoft is an excellent example of a trusted antivirus solution.

4. Prevent phishing and social engineering attacks

Phishing attacks are processes attackers use to obtain confidential information fraudulently. Attackers use trickery to convince their targets to click on malicious links or attachments.  Phishing is a form of social engineering.

A single click automatically downloads and installs malware into the system. Typically, a phishing attack executes through emails where unsuspecting victims receive messages from a sender disguised as a trusted party. An example is when an attacker pretends to be a bank employee and emails an individual that his bank account has a problem and requires logging in to the bank’s online account.

However, upon clicking on the provided link, the individual is redirected to a malicious website that installs malware to his computer. Other emails may contain attachments that appear to be legit such as that from a supplier or a customer. The attachments may be laden with malware which automatically installs when opened.

Today, cybercriminals have taken to a new technique where they use artificial intelligence to target new victims.  AI is used to create smarter emails sent to hundreds of email accounts all at once.

To stop phishing attacks, do not open attachments or links sent by unknown people. All suspicious email addresses requiring one to click on links or attachments or ask the recipient for personal information should be marked as spam and forwarded to the IT department for more action.

Avoiding sensitive posting information like email addresses on online platforms can lower the chances of a phishing attack. If an email address must be provided, organizations are highly recommended to use a personal email not opened on company equipment. The emails can be set to forward new messages to official accounts once verified to be safe.

5. Adopt policies for securing emerging technologies

Businesses are raring to try out emerging technologies, especially those that claim to provide better functionalities than existing ones. While there is nothing wrong with this, new, untested technologies can cause severe security issues. They may contain undiscovered vulnerabilities providing cybercriminals with easy exploits.

Emerging technologies might be incompatible with other systems, and this magnifies the security risks. A company should adopt strong policies governing the acquisition and use of new technologies within the workplace as part of its cybersecurity programs.

For example, such a policy would require emerging technologies to have successfully been used and tested to the limit to ascertain they are entirely secure.

Benchmarking organizations that have used the technologies without security problems can also be an effective policy. With the rapid technological changes, IT professionals require to stay abreast of new developments. This ensures that the policies implemented for governing data access, use, and handling in previous technologies can effectively provide security to the latest technologies.

Cybersecurity policies should be continuously amended as organizations populate their IT infrastructures with new ones. Changing security policies eliminates the possibility of an attack.

1. https://cybersecurityventures.com/cybersecurity-almanac-2019/ ↑
2. https://www.networkworld.com/article/3198474/lan-wan/cisco-to-network-engineers-get-comfortable-with-software-it-s-here-to-stay.html ↑
3. https://www.infosecurity-magazine.com/opinions/zero-day-attack-recovery/ ↑
4. https://www.ic3.gov/media/2018/180712.aspx ↑
5. https://www.forbes.com/sites/stevemorgan/2016/05/13/list-of-the-5-most-cyber-attacked-industries ↑
6. http://fortune.com/2017/10/25/cybercrime-spyware-marketplace/ ↑
7. https://cybersecurityventures.com/cybersecurity-almanac-2019/ ↑
8. https://cybersecurityventures.com/global-ransomware-damage-costs-predicted-to-reach-20-billion-usd-by-2021/ ↑
9. https://www.ccn.com/cryptojacking-is-up-459-in-2018-and-its-the-nsas-fault/ ↑
10. https://www.consultancy.uk/news/18435/five-reasons-cyber-security-is-more-important-than-ever ↑
11. https://www.forbes.com/sites/bernardmarr/2018/05/21/how-much-data-do-we-create-every-day-the-mind-blowing-stats-everyone-should-read/ ↑
12. https://www.wired.com/story/iran-cyberattacks-us-universities-indictment/ ↑
13. https://www.wired.com/story/iran-cyberattacks-us-universities-indictment/ ↑
14. https://www.wired.com/story/exactis-database-leak-340-million-records/ ↑
15. https://arstechnica.com/information-technology/2018/12/iranian-phishers-bypass-2fa-protections-offered-by-yahoo-mail-and-gmail/ ↑
16. https://www.forbes.com/sites/paullamkin/2018/03/30/under-armour-admits-huge-myfitnesspal-data-hack/#649ee2f0cc54 ↑