Intensity and Diversity of Attacks Are Paying Off for Cybercriminals
The REAL State of Cybercrime
Cyberattacks have been expanding rapidly over the past decade; according to Juniper Research, the costs of cybercrime are estimated to reach over $2 trillion in 2019. This is double the nearly $1 trillion of damage reported from 2018. In addition, according to the Official 2019 Annual Cybercrime Report from Cybersecurity Ventures cybercrime will cost US$6 trillion annually by 2021. This is the largest amount of money generated by criminal means and will likely represent the greatest transfer of wealth in history. Cybercrime will likely be more profitable than the global trade of all major illegal drugs!
As hackers and cybercriminals continue finding new avenues for their exploits, we can expect these numbers to keep rising, and the cost of cybersecurity defense with it. Cybercrime is not just one method of hacking directed against a particular people group or type of organization. It has become a complex web of various types of hacking, phishing, malware, and other destructive and costly tactics targeted against almost anyone, anywhere.
Last year, nearly half a billion personal records were stolen through various types of hacking and data breaches according to another cybersecurity survey by Cybersecurity Ventures. This figure is staggering, and a reminder of how important information security is for individuals as much as it is for IT departments.
Big Companies Can Mean Big Paydays for Hackers
Cyber-attackers are targeting large organizations with big pockets in hope of increasing their profitability from each attack. Many of these attacks have been directed specifically at companies in the technology, communications, and professional service industries. Targeting the bigger firms, even those in healthcare, finance, academia, and defense, has meant opportunity for huge payouts for successful data breaches, ransomware, phishing, and other tactics.
Ransomware has become one of the largest sources of revenue for cybercriminals, with the majority of those malicious campaigns being targeted towards the growing healthcare industry. According to a recent study conducted by Security Scorecard, over 75% of healthcare companies have reported suffering from some type of malware infection over the past year. The vast amount of personal or sensitive information (PII) in this industry have easily made them a target for increased attention from cybercriminals.
Ransomware Interactive Map
Allan Liska, an intelligence analyst at the cybersecurity firm Recorded Future, published research that listed 169 different ransomware attacks against state and local governments dating back to 2013. Now there are new attacks every couple of few weeks including those against small and medium-size government organizations like Baltimore; Riviera Beach and Lake City, Florida as well as 23 communities in Texas. The interactive map that was created with Liska’s tracks each ransomware attack and lists the victim organization, payout, and other information – it is updated almost daily.
Interactive Ransomeware Map
More than 100 public-sector significant ransomware attacks have been reported in 2019 so far, compared to 51 reported in 2018. Big cities can fail to prepare for ransomware just as easily as the small ones, though. In Baltimore, where a virus called RobbinHood encrypted several municipal systems. Baltimore officials expect their ransomware attack will ultimately cost taxpayers $18 million, while the CIO Frank Johnson, once the city’s highest-paid employer, was fired due to the lack of an incident response plan.
Variety of Cybercrime Activities and Methods
According to a report by the Clark School at the University of Maryland, there is an attack from hackers every 39 seconds in the United States. The frequency of attack is astonishing, but even more so is the diversity by which these threats happen. Cybercrime has expanded from viruses, phishing, and traditional malware to attacks that include bots that search for vulnerabilities, spear phishing, and APT’s or advanced persistent attacks.
As the digital transformation has spread and more devices are connected to the internet, the threats of cyberattack have not only increased but also diversified. Users must not only be aware of password protection and email scams but also for malicious files, ransomware attacks. In addition, they must know how to protect their specific devices and technology from harm. It’s a continually evolving process, and the most dangerous cyberattack threats are almost definitely the types we don’t even know about yet.
Even the cloud is subject to attack. Anyone signing up for cloud-based storage or other services should be wary of the system and do their own research into the security offered by the service provider. Hackers are becoming more sophisticated at gaining access to new platforms as the technology we use continues to evolve and expand. With every new technology is a new avenue for hackers to gain entry and exploit data for their own gain.
Changes in Types of Cyber Criminals
According to a recent report by CrowdStrike, 61% of recorded cyberattacks in the first half of 2019 were initiated by cybercriminals. The other 31% was devised by state-sponsored hackers. This is a significant change from last year when approximately 75% of targeted attacks were from state-sponsored sources.
This means digital crime and data breach risk has been steadily increasing, making a strong security posture and incident response team even more imperative for companies with a lot to lose from an attack. As technology changes and our dependence on it increases, we can expect to be hit harder by those trying to take advantage of weaknesses and unprotected devices.
Strengthening Your Security Posture
Even though cyberattacks have increased dramatically over the past decade, an estimated 77% of organizations do not have an incident response plan for any type of threat. 54% of companies also say they have experienced at least one cyberattack within the past year. These statistics are part of the astonishing reality that most people and organizations are at risk for cyberattack activity, but only an estimated 23% are taking steps toward preparing themselves to prevent those attacks from being successful.
Last-minute planning means companies will have to scramble when security breaches do happen. It means they may lose time, money, and even their reputation when an incident cripples the organization. Rather than waiting until something happens, companies should be taking steps toward understanding the current risks of cyberattacks as well as preventing them from happening.
As cyberattacks increase in frequency and complexity, organizations must be prepared with a cybersecurity plan and process. Whether this is to develop and train IT professionals within your company or to outsource it to Managed Security Service Providers (MSSP), it is better to do it before major incidents occur. The statistics don’t lie. No company is immune to cyberattacks. Various types of threats and breaches occur daily to individuals and organizations alike.
Those who prepare their companies and personnel with an understanding of specific best practices have the best chance of preventing intrusion due to user error.
Conclusion
Approximately 95% of actual security breaches are reported to be a result of human error, meaning with proper training they can be prevented from causing significant damage. Training and ongoing education for personnel at all levels of your company are essential for ongoing protection of precious data and resources. Especially as the frequency and complexity of cyberattack increases, thorough understanding, and preparation for incident response are key to making it through safely.
Even if your company is not in one of the more heavily targeted industries, you are still at risk for suffering some type of attack or costly incident. If you are one of the companies that do not have a plan on how to prevent or deal with a cyber threat effectively, you could be putting your company at risk every day without even knowing it.
At SecureOps, we work with companies of all sizes to develop and maintain ongoing practices and precautions that help not only prevent routine attacks but also to minimize the effects of targeted attacks when they happen. One of our competitive advantages is that we answer the phone and respond to chat even to simply provide security advice. Our customers tell us what a relief it is to know that if they have a question, an answer is a simple phone call away.
