By Mousume Roy, APAC Reporter, HCL Technologies Ltd.
As threats to technology and confidential data become more commonplace, Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA) have come together to raise cybersecurity awareness.
This month’s focus is on the “people” part of cybersecurity—See yourself in Cyber—is an opportunity to raise awareness of employees, customers and the general public on cybersecurity risks. The world may be busy carving pumpkins ahead of Halloween, but cybercriminals are busy trying to trick people into giving up their personal information, tampering with devices and stealing identities.
-
The second quarter of 2022 found 1,097,811 observed phishing attacks
Last quarter saw a massive number of phishing attacks, fueled by attempts to target users on their mobile devices. The latest Anti-Phishing Working Group (APWG) "Phishing Activity Trends Report" for the second quarter of 2022 found 1,097,811 observed phishing attacks, the most the group has ever measured in its history.”
The financial sector remained the top target for phishing attempts (27.6%), along with other bombarded sectors, including webmail and software-as-a-service providers, social media sites and cryptocurrency.
"We're seeing a huge increase in mobile phone-based fraud, with smishing and vishing collectively seeing a nearly 70% increase in volume as compared to Q1 totals," Matthew Harris, senior product manager of fraud at Opsec said in reaction to the APWG findings. "We are still seeing fraud coming in via the typical OTT apps (WhatsApp, WeChat, Facebook Messenger, etc.), but the SMS-based fraud is really the kicker here."
According to an analysis by Webroot, 46,000 new phishing sites are created every day and 1.385 million new, unique phishing sites are created each month.
Key actions: Phishing is a crime that employs both social engineering and technical subterfuge to gain key information about the targets or bait them to fall into the trap of cybercriminals. Be wary of emails claiming to be from higher officials and always look for alert signs like spelling errors or a sense of urgency to recognize fraud emails. Never click on suspicious links or attachments in emails and verify requests for payments before responding. Last but not least, never fall for offers that are too good to be true.
- Risk of cloud-based incidents higher than on-premises
Accelerated public cloud adoption and the boom of cloud services have increased the value of attacking organizations’ cloud infrastructures. Despite the obvious benefits of adopting the cloud to transform business outcomes, security and regulatory compliance risks remain top priorities during cloud migrations. According to the Verizon Data Breach Investigations Report (DBIR), cloud security breaches have surpassed on-premise breaches for the first time in history.
According to research from Venafi, over the past 12-month period, more than 80% of organizations have experienced a cloud-related security incident,. Almost half of those organizations reported at least four incidents over the same period. More than half of all organizations said they consider the risk of security incidents higher in the cloud, than with on-premise environments.
Cloud computing and its multiple service models, such as SaaS, Databases-as-a-Service (DBaaS), Platform-as-a-service (PaaS) and Infrastructure-as-a-Service (IaaS/virtual machines) have enabled businesses to move beyond on-premise IT infrastructure for enhanced storage and work process flow.
Key actions: With organizations rapidly transitioning into a cloud or hybrid cloud environment, it is important to work closely with cloud providers to optimize security in the cloud. Implementing dynamic policies, faster data encryption, robust incident response plan (in case of data breach) and increasing transparency for access control can help reduce or mitigate insider and external threats.
- Hackers find exploitable weaknesses in only a few hours
Approximately 40% of ethical hackers recently surveyed by the SANS Institute said they can break into most environments they test, if not all. Nearly 60% said they need five hours or less to break into a corporate environment once they identify a weakness.
The SANS ethical hacking survey revealed that, on average, hackers would need five hours for each step of an attack chain: reconnaissance, exploitation, privilege escalation and data exfiltration, with an end-to-end attack taking less than 24 hours.
The survey done in partnership with security firm Bishop Fox, collected responses from over 300 ethical hackers with different levels of experience and specializations in different areas of information security.
Key actions: This statistic reinforces the need for good cyber hygiene, including strong passwords, multifactor authentication (MFA) and having good anti-malware software.
- Ransomware hit 66% of organizations last year
Ransomware attacks have held the world hostage. Whether it is Russia’s deliberate hacking of Viasat’s KA-SAT network or North Korea’s WannaCry wreaking havoc on computer systems around the world, cybercriminals have become brazen at executing this type of cyber warfare.
Ransomware hits showed a78% increase over a year; hitting 66% of organizations in 2021, up from 37% in 2020. There was a near threefold increase in the percentage of victims paying ransoms of $1 million. Advancements in technologies like Next-Generation Security Controls, Artificial Intelligence (AI), automation and rapid adoption of IoT have created a highly complex environment for organizations.
Key actions: Advancements in technologies like Next-Generation Security Controls, Artificial Intelligence (AI), automation and rapid adoption of IoT have created a highly complex environment for organizations. Staying ahead of perpetrators requires gaining critical insight into attack activity worldwide, adopting flexible security solutions, enabling cybersecurity training and awareness and increasing cybersecurity budgets to help integrate widely distributed and disparate security services.
