National Cyber Security Awareness Month covers online safety and privacy, and promotes good cyber security for all. Ransomware is by far the most popular cyber-attack method that hackers use.
“This shouldn’t come as a surprise – ransomware has been around some time now, and the reason hackers continue to favour it is simple: it is the most successful, effective way they have to separate victims from their money,” says Thomas Cartlidge, Head of Threat Intelligence at Six Degrees.
“Ransomware is here to stay, and hackers will continue to evolve their tactics to make their attacks as effective as possible. There are short-term mitigating steps your organisation can take to protect itself, such as undergoing a comprehensive external penetration test. However, the truth is that in the long-term there is no substitute for taking a holistic approach to cyber security, reviewing your people, processes and systems and aligning your cyber security posture to your organisation’s risk appetite.”
Gijsbert Janssen van Doorn, Director Technical Marketing at Zerto, agrees cyber security needs proactive steps. “Employees, now more than ever, need to remain vigilant in protecting their organisation. Ransomware attacks can and will still occur, so cyber resilience is imperative. With a 72 per cent increase in ransomware attacks during COVID-19, organisations need to be prepared for the inevitable.
“Once compromised, it’s too late to take any preventative measures. Organisations need to be able to recover data and get back to operating swiftly and painlessly, without paying a ransom. Key to this is leveraging IT resilience solutions that can quickly and effectively provide recovery after an attack. With the right continuous data protection tools in place, businesses need not worry about paying ransoms and can instead simply recover pre-attack data files within seconds.”
Backup
“As the risk of cyberattacks increases, ensuring an air-gapped and immutable copy of your data exists is now more important than ever,” said Mark Jow, Vice President – Technical Services EMEA at Commvault.
“While the traditional 3-2-1 backup strategy is commonplace, to prevent today’s cyberthreats, businesses should consider newer SaaS options that can provide much higher levels of protection and resilience, whether your data sits in the cloud, in your data centre or on the laptops and desktops of your home or field based employees. Data is the lifeblood of businesses and in a time when keeping customers on board is harder than ever for many, it’s crucial that IT teams have the solutions in place that can ensure business and customer data is kept secure, and customer loyalty is kept intact.”
Tim Bandos, VP Cyber Security at Digital Guardian, argues that regularly reviewing system settings and disabling unnecessary services that may leave them open to attack is also crucial.
“It is also absolutely essential that IT systems are constantly updated and free from known vulnerabilities. Whilst data protection solutions can help prevent data loss, successful security programs also require proactive training around employee awareness and their ability to comply. This includes educating remote workers about attacks via SMS and smartphone apps, teaching them to make informed decisions around the use and protection of data. This shifts the focus towards identifying, controlling and securing data, which will ultimately decrease threat risk – and hopefully the need to admit you should have known better.”
For many in security, the focus of the conversation with employees this year will be identifying and mitigating the risk of phishing attacks. Andy Collins, Head of Security at Node4, says: “2020 has been a year like no other for security professionals and threat actors have upped their game significantly in an attempt to capitalise on widespread remote working and a vastly wider attack surface. Research released last month revealed more than half (53pc) of organisations have witnessed an increase in phishing activity since the start of the COVID-19 pandemic.
“Regular training and awareness drives are vital to help employees recognise malicious behaviour – which is rarely static. Social engineering often extends to out-of-band communication, so employees need to remain vigilant across all channels – even on social media or the telephone.
“One of the most effective ways to prepare employees for an inevitable phishing attack is with non-destructive phishing campaigns – simulated campaigns that track and analyse behaviours to give you a clear understanding of how to fill employees’ awareness gaps. Analysing specific individuals or departments with selective spear-phishing testing means you can target training more effectively, from a department level right down to an individual member of staff. The key is consistency of training. As the saying goes: teach your employees how to phish and you can protect them for a lifetime.”
Sam Humphries, Security Strategist at Exabeam, agrees that as the cyber-threat landscape is becoming ever more sophisticated, it’s up to us to pick up the pace and arm security teams with the knowledge and tools required to succeed in building a better cyber defence.
“Just a momentary lapse in concentration can lead to an employee clicking on something they shouldn’t, and as soon as they have… it’s too late.
“We saw in the rapid transition to a remote workforce, security leaders had to quickly find the right balance between ensuring the organisation’s productivity needs are met, and keeping the organisation secure. Finding this equilibrium continues, and as we maintain a working-from-home structure we cannot afford to be complacent when it comes to cybersecurity.
“This National Cybersecurity Awareness Month, it’s time to hit the reset button. Without a doubt, a combination of training, organisational alignment, and technology is the right approach to detecting and stopping security threats. Effective training should help employees understand and buy-in to the importance of cybersecurity, and in the BYOH (Bring your own home) world organisations should broaden awareness efforts to include helping users secure their home environments.”
Stephen Roostan, VP EMEA at Kenna Security, offered some final thoughts: “2020 is definitely not panning out the way many of us had thought. Personal plans have been put on hold and professional milestones have shifted too. Initiatives like Cyber Security Awareness Month are important because they remind us that cybercrime is all around us, a silent but deadly predator, waiting to attack when we’re at our most vulnerable.
“Whilst multiple professions and professionals are experiencing the challenges of the global pandemic, IT security and remediation teams are having a super tough time. Already drowning in data, overwhelmed by tickets, and having to deal with an ongoing skills shortage, the working day for these guys is pretty full-on right now – and likely not much fun.
“Although it only runs for a few weeks, the impact of Cyber Security Awareness Month is ongoing because it creates a platform for best practice and ideas exchange among IT security professionals. This can only be a positive development, helping to reduce wasted efforts, improve collaboration across teams and having a meaningful impact on risk profiles.”
