Cybersecurity 101: What is Cybersecurity? Definition and examples
Cybersecurity is the armor for your business in the digital era, meant to protect your organization’s data from attacks. Since unauthorized access can be attempted both externally and from within an organization, cybersecurity is vital to protect not just data, but also computers, software programs, and networks from attack and damage.
Cybersecurity is a combination of structures and technologies, processes, and everyday practices. It is geared at protecting confidentiality and data integrity while ensuring that data remains safely accessible to genuine stakeholders.
Examples of Cybersecurity measures against specific modes of attack
Technology never sleeps, and threats continue to evolve. Organizations need to continually up their game when it comes to protecting themselves in such a dynamic and malicious threat scenario. Listed are a few crucial software and solutions that organizations adopt to arm themselves against cyberattacks:
- Firewalls: Firewalls are comprised of both software and hardware. They are designed for the purpose of keeping systems safe from attackers who try to access them using external as well as internal communication links.
- Malicious software code can be hidden in software code from pop-up windows, or programs that log usernames and passwords with the intention of fraud. Organizations can seek web proxy protection solutions to protect their data from such malware or spyware.
- Since email is a common (and official) mode of communication within an organization, anti-spam software is embedded in email systems to keep them free of broadcasts that may contain viruses or malware.
- Web hosts protect their digital assets by means of anti-phishing software
Companies should install anti-spyware, anti-virus, and anti-malware software on every device belonging to them, as well as on employee devices that are linked to the company network.
- In the context of remote operations, however, many of these measures serve as responses to attacks without any remediation, and can certainly not prevent future attacks of the unknown variety.
This is where the role of managed detection and response (MDR) comes into the picture as a very viable solution for the constantly evolving threat landscape.
Standard frameworks and functions to assess cybersecurity risks and adopt best practices:
The framework here helps understand the best possible way of preempting, responding, resolving, and preventing cyberattacks in today’s world.
- Identify potential risks both in terms of the industry you operate in, as well as your business unit in general. Risks can come in the form of something as simple as clicking on a phishing link to something so complex that it goes unnoticed for months, if not more.
- Protect your organization at both the systems and the network level. Today, when people work over multiple home networks, there are solutions such as BluSapphire that help prevent attacks even in a remote environment.
- Detect attacks before they happen. Naturally, in today’s digital landscape, this isn’t possible using predictive analytics alone. We need to harness the power of machine learning and AI to understand how the landscape evolves, identify potential threat agents, and prevent attacks.
Indeed, the best cybersecurity solution is one that does this and shares a report with you on the triage measures it has taken up, as opposed to siloed methods that detect at best and do nothing thereafter at worst. - Respond immediately when an attack does happen. Switch to a solution that can offer response and remediation in a few seconds, as opposed to the several days and months that are the current industry standard.
- Recover quickly in terms of saving sensitive data, protecting all endpoints and triaging the attack to contain it, and prevent further damage, at all times of day.
Why should you care about cybersecurity in 2021?
Because COVID-19 wasn’t the only pandemic that was rampant in 2020. The cybercrime pandemic took on a life of its own, too! According to a research study conducted by Deep Instinct, hundreds of millions of cyberattacks were attempted every day throughout 2020. Malware increased by a whopping 358% and ransomware increased by 435% compared to 2019. These are numbers that should make any organization sit up and take notice!
Over 100,000 malicious websites and 10,000 malicious files crop up EVERY DAY. Also, 87% of organizations have experienced an attempted strike on an existing weak spot that was already known to them. Moreover, in 46% of organizations, a malicious mobile application was downloaded by at least one employee.
What are the most common cyber threats your business faces?
Trends in 2021 highlight three cyber threats that organizations face in particular:
- Thanks to the coronavirus, the cyber attack target has only gotten wider and bigger with millions forced to work from home. With organizations ramping up their own digital transformation initiatives in 2020 to adapt to the changed circumstances, many more people connected to work interfaces on personal computing devices, accessing data on private and public cloud data centers, various IT infrastructures, and on utility infrastructures, broadening the attack surface.
- Ransomware, as the name suggests, is a cyber weapon of choice in targeting organizations. Ransomware is popular among cybercriminals precisely because the payoff is so big. The average payout attributed to ransomware has reached a dizzying figure of nearly $234,000 per event. According to Deep Instinct, ransomware increased by 435% in 2020 compared to 2019.
Typically, a piece of malware is hidden, disguised, and embedded inside a different kind of document. When unwittingly executed by the target user, the malware can encrypt the organization’s data set with a secret 2048-bit encryption key. Alternately, it may communicate to a control server and await instructions to do further damage. Either way, the data is effectively locked up, even the backup data is rendered inaccessible till the company pays ransom as instructed.
Thwarting ransomware requires entrenching multiple levels of cybersecurity policies and measures across the organization, including anti-malware software, passwords, having secure VPNs, Wi-Fi, and routers.
- Critical infrastructure is in the crosshairs via Industrial Control Systems, ICS, Operational Technology/Infomation Technology cyber-threat convergence, particularly on legacy systems that were not designed to be safe against cyber-attacks. The IoT-based supply chain for various essentials and non-essentials that housebound individuals shop for online is also an inviting target as they present attackers multiple entry points.
How are cyber threats classified?
There are several approaches to classifying cyber threats, with new models being proposed all the time. . A few are described below.
Approaches to cyber threat classification often fall into two main classes:
a) Classification methods based on the attack techniques
b) Classification methods based on threats class or impacts
In one approach, a three-dimensional model subdivides threat space into subspaces according to three orthogonal dimensions that are labeled “motivation, localization, and agent.”
- Threat motivation represents the cause of the creation of the threat and it is reorganized into two classes: deliberate and accidental threat
- Threat localization represents the origin of threats, either internal or external
- The threat agent is the entity that lays the threat on a specific asset of the system which, in turn, is represented by three classes namely: human, technological, and force majeure.
Another model is STRIDE, which is applied to the network, host, and application. The STRIDE acronym is created with the first letter of each of the following categories: Spoofing Identity, Tampering with Data, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. The STRIDE model allows for the characterization of known threats according to the motivation of the attacker.
It is a goal-based approach, where an attempt is made to get inside the mind of the attacker by rating the threats raised against the organization.
What can I do to identify a cyber attack?
The key to mounting a response and initiating successful damage control in case of a cyber-attack is rapid threat detection. For this, the appropriate strategies and mechanisms must already be in place to raise timely red flags. In addition, every employee must be coached on the shared responsibility of cyber-surveillance and to notice the following signs:
- Computer processing has slowed down immensely
- Storage space is suddenly full and new programs/add-ons that they did not install have appeared
- Programs are opening and closing automatically
- Their security software has somehow been disabled
- Popups appear rampant
- The browser automatically redirects sites
- They are locked out of their system or their password has been reset automatically
What should I do when a cyber-attack happens?
Every individual who notices any of the above signs must report them to the IT cell immediately for them to deploy security measures. Businesses are often aligned with cybersecurity partners who have the requisite know-how, tools, and solutions to contain a cyber attack.
What happens to businesses hit by cyber threats?
Depending on how devastating the cyberattack is, the fallout can be tremendous, costing the company big time in terms of both time and money. According to IBM, companies take about 197 days to identify and 69 days to contain a cyber breach. The companies that are able to contain a breach in 30 days or less can save more than a million dollars compared to those that take longer.
What are the current challenges in implementing cybersecurity solutions?
In an ironic twist, cybercriminals have started adopting corporate best practices to focus their attacks, selling or licensing hacking tools and commodities. Ransomware is even offered as a service. This established cybercrime ecosystem makes it increasingly harder for companies to protect themselves from cyberattack.
Other challenges include:
- Cloud vulnerability, i.e. threat to sensitive company data stored in third-party cloud applications.
- AI fuzzing can be utilized by cyber attackers to initiate, mechanize and ramp up zero-day attacks.
- A hacker may insert malicious instructions, mock-ups, or backdoors into a system to weaken it.
How to solve these challenges
Companies’ IT wing must set the software to automatically check for updates in real-time or at least once a day, or nightly, and schedule a complete scan after these daily updates. They can follow up by running anti-spyware, say at 2:30 AM and running a full system scan around 3 AM.
This is possible for companies that have a continual high-speed internet connection. The time may vary, but these daily activities are a necessity. Logs must be backed up and scanned regularly to look for any red flags. Logs must also be saved for at least a year, depending on the type of information they hold, or longer if necessary.
Companies must “patch” frequently, i.e. install newly available code updates in existing software to address any new security vulnerability, install new drivers, or fix any stability issues.
Last but not the least, companies must have insurance that covers costs of fixing not only the damage done, but investigation, rebuilding, and restoration activities. It should also cover productivity loss as a data breach will indefinitely stall operations.
