It’s getting tougher for small and medium sized businesses (SMBs) to avoid cyberattacks. Not only are these threats on the rise, but the average breach will set you back $276,000 according to the Australian Cybercrime Online Reporting Network (ACORN).
Not to mention your business is likely to suffer reputation damage if you suffer a data breach as the result of a cyber attack, as there are now mandatory reporting rules.
In our conversations with businesses looking for a better way to manage this risk while keeping costs manageable, Byte has compiled the main challenges that are facing organisations right now.
1. Not having visibility of cyber threats
The number one issue is getting visibility and understanding over cyber attacks, and how they may be impacting sources of data they don’t know they have.
With the pandemic accelerating the rate of change in how we work, many businesses now don’t know what data they have, how it’s travelling between applications or databases, and how or from where their employees now access data from various systems. They also don’t know whether users are keeping the data in the right platforms.
They want to know a few things:
2. Defending against the most popular cyber attack — phishing
Phishing is the most widely used method in most attacks – 91% of cyber attacks starting with a phishing email or text – and yet it’s probably the least understood.
Phishing, or “spear phishing”, can take the form of a text message or email from someone that masquerades as a reputable source or as a legitimate institution that lures an individual into providing personal information, sensitive data or login credentials.
Employees are often unaware of the methods to identify a fake email and accidentally click on embedded links or respond to the email’s call-to-action.
3. Preventing theft or compromised credentials
Credential compromise typically starts with a phishing email that tricks a person into giving up their login details. A common example is a phishing email that, at a quick glance, looks like a legitimate password reset request from Gmail or Outlook. When the employee enters their login details into the fraudulent site, they are handing over their username and password to cyber attackers, providing access to their email account.
Outside of phishing, compromised credentials via an unknown method is the second most prevalent cyber incident that can be attributed to data breaches that have been reported to the Office of the Australian Information Commissioner (OAIC) during the second half of 2019 and the first half of 2020.
Because so many people re-use login details across multiple online accounts, coupled with the stratospheric rise in online credentials due to the need to work remotely, most cyber attackers use login credentials obtained from breached user credentials that have been leaked or posted online to gain access to other accounts.
The problem is that quite often SMBs have no visibility over this threat, as their employees themselves don’t even know their credentials have been compromised.
4. Combatting the rise in ransomware
From January to June 2020, the OAIC reported more than 150% increase in data breaches from ransomware attacks. There are many forms of ransomware attacks, but one of the most common is where a malicious individual encrypts important files and then demands payment – either money or information – in exchange for the key to decrypt them.
Some of the more insidious ransomware attacks are now taking a copy of the data as they encrypt it, so even if you pay the ransom to gain access to the data, they can get another payoff.
Ransomware attacks are on the rise, particularly those that encrypt files that are stored in cloud storage. It can be installed on a system through a malicious email attachment, a fraudulent software download, or by visiting a malicious webpage.
When a company is attacked by ransomware, they lose access to their own system, making it difficult to understand the extent of the data breach.
5. Staying on top of the ever-changing malware threats
Malware consists of viruses, spyware and other malicious software that is designed to disrupt, damage or gain unauthorised access to sensitive data. Since the pandemic, malware is accounting for a larger percentage of cyber incident data breaches reported to the OAIC. With the blurring lines between personal and work systems, and work from home arrangements still largely in place for many since March 2020, businesses still face greater risks of malware infection from home networks.
Conclusion
There is a lot to keep abreast of in the ever-changing cyber threat landscape. We haven’t even touched on education and awareness of your employees, which is a constant task in itself. No matter how stringent your cyber education, your employees’ first thought every day will be on their key priorities and ensuring business as usual, not on security measures.
This is why Byte has developed a comprehensive Managed Security Operations Centre (SOC) specifically aimed at the mid-market. As part of the evaluation of your security needs, we look at your specific challenges and map them to our monitoring solutions. If there is a need to rectify any issues or plug any gaps, we have a team of experts who can help.
Call us for a chat about your immediate needs, or for more information click here.
Dive behind the scenes and keep up to date on the latest people centred tech.
