As we head into another year, we continue to see a large-scale transition from physical theft to cyber-theft. This theft (and indeed, all cyber-crime) takes many forms. However, it does tend to fall into certain patterns. Unfortunately, we can only determine the largest threats by looking at the cyber-attacks that succeeded. There is always the chance of an unknown or undervalued threat lurking in the background. Still, it’s always a good idea to look at the prevailing trends and see where things are likely to go. With that in mind, let’s discuss the cyber-threats that are likely to be the biggest threats to your organization.
1. Phishing Attacks
We listed this threat as the number one threat for one simple reason: It is the most common “gateway tactic” by which hackers and similar criminals can bypass common security measures. There are many forms of phishing, although the email phish remains the most common. Businesses tend to exchange a lot of emails, far more than the average person would ever need to do. This is because it is often more convenient than any other method of mass communication. However, its’ vulnerabilities continue to be exploited.
Phishing attacks work through impersonation-based methods. Basically, the criminal impersonates a legitimate entity with whom you normally have contact. It might be another company or organization with which you do business, a financial institution that handles your money, or maybe even your attorney. If the attacker is smart, they can gather intelligence before making their phishing attempt, allowing them to personalize the attack and make it seem all the more legitimate.
If you’re wondering how they actually deliver the attack, that can vary considerably. In most cases, however, their goal will be the theft of login credentials or the installation of malware. The former is usually accomplished by tricking the user into entering their credentials on a fake page. The latter can be a gateway to all sorts of other problems. Because these are “social engineering” attacks, they can be prevented by wariness and education.
There seems to be an upward trend in phishing attacks this year, and most cyber security-related publications have noted this fact. Estimates vary as to the exact rate of increase, but one report indicates that large organizations are dealing with (on average) 1,185 phishing attempts per month. Obviously, most of these do not succeed, but it only takes one to cause serious ruin.
2. Ransomware Attacks
When you look at online lists of the biggest hacks in 2020, you really do see a lot of ransomware attacks. Here is one example, and you will see the trend repeated in most other reports of this kind. Ransomware is an insidious pest because it takes advantage of technology that was originally designed to protect people and their data. We’re talking, of course, about encryption.
Encryption works by scrambling the data, making it unreadable and unusable. It can only be unscrambled using the password, and an attacker may also need to find a way to obtain an encryption key as well. Of course, an encryption key alone will not tell them your password, but it will make the job of obtaining your actual password easier. In any case, encryptions are very hard to break when they are properly applied. So, realizing that, criminals have turned this into a tool against individuals and organizations.
Ransomware most often begins with a phishing attack of some kind. Once they obtain access, the malware is installed. From there, the malware begins encrypting part or all of the target hard drive. When finished, a ransom note is sent to the victim, demanding money in exchange for the password. This type of attack has even been able to compromise some low-level government systems, and some of them have even been foolish enough to pay huge ransoms. Needless to say, you cannot trust a person like that to keep their word. This is why authorities have repeatedly warned people not to pay these ransoms.
So, how do you defeat a ransomware attack? Well, efficient and frequent data backup is probably the surest way. Unfortunately, this can be inconvenient because of one thing: Some hackers will target the backups. Therefore, they must be stored on a computer or device that is not capable of accessing the internet. This means that a trusted individual must physically deliver the backup files to the offline storage device via an external hard drive. There might be a need to provide physical security to that individual as they go to and from the area. This might be a lot of trouble, but it allows you to laugh at ransomware and restore your system with little to no losses.
3. Weak Passwords
This one really shouldn’t be as high on the list, but it has remained a major problem. After so many high-profile cyberattacks, there really is no excuse for anyone to use weak passwords. For those who are operating on behalf of a larger organization, this is even more important, as there is potentially a lot more to lose. Although it is not easy to research password preferences (because any smart person does not reveal them), there has been some research into the matter. If this article is to be believed, the picture is pretty grim.
Nordpass is a company that makes proprietary password management software, and the above is mostly based on their data. They say that the most popular password among their users is “123456.” In second place, we see “123456789.” If this data is accurate, we have to say that a lot of people need to be educated. A password like that can literally be cracked within seconds.
In fact, you don’t have to take our word for the matter. There are quite a few sites where you can test the strength of your password. These sites will tell you about how long a password-cracking program would take to decode your password. As you will see, the password “123456” can be cracked within one second. “123456789” gave exactly the same result, showing that those extra three digits made no difference whatsoever.
We cannot stress enough the need for secure passwords. You need to make sure that everyone in your organization understands this, and they should understand that they will be held accountable if their weak password results in a data breach. Those who use weak passwords are definitely putting your whole organization at risk, so you can use that to impress upon them the importance of using long and strong passwords. To clarify; a good password should meet these requirements:
- 19-20 characters long in total
- Must contain both letters and numbers
- Must contain at least one symbol
- Must contain both lowercase and capital letters
- Dates (like birthdays, anniversaries, etc.) should never be used
- Don’t use a string of common words such as “IlikeFish.” Make things as weird and random as possible
4. IoT Attacks
This one didn’t rate as high on the list because it simply hasn’t caused all that much harm…yet. It is understandable that this would be the case, of course, since most people do not yet use smart devices. Alexa and several others have become popular, but they are not in common usage among the average person. However, these devices are gaining in popularity due to the convenience that they offer. With new technology comes the danger that people will exploit it for nefarious and/or criminal purposes.
When we look at most of the IoT attacks that have happened so far, most of them have been mischievous attacks that could be described as “trolling.” Some of it has been very cruel and mean-spirited, but that’s about all. Still, there is one big danger here, and that is the danger of covert surveillance. That is the main way in which criminals can use this tech to their advantage, and there are many ways in which people can use that surveillance to aid in later crimes.
For example, we might look at the interesting case of a smart fish tank being hacked at an unspecified North American casino. There aren’t that many places in the U.S. where gambling is legal, so that narrows it down somewhat. In any case, this casino had a fishtank thermometer that was designed to adjust itself according to the ambient temperature and the needs of the fish. To facilitate this goal, the thermometer was connected through the internet, and that’s how it was hacked.
All it takes is one weak point in a given network. It is like that one defective window in the basement that a thief might use to gain entry. In this case, no one considered the possibility that the smart thermometer could be used as an entry point. The hackers were not after cash or any other physical riches here, but they did steal a lot of data regarding the casino’s biggest high-rollers. Presumably, this information was taken so that high-wealth individuals could be targeted in some way. Because these particular hackers were never caught, there is no way to know if they ever used that data to victimize the people on that list.
It might seem strange for us to list this as a major threat, but the above example illustrates the reason: Most people and organizations are not prepared for this threat at all. All of these amateurish attacks show just how easy it is to hijack an IoT device, making us wonder why in the world no one thought about this risk when designing such devices! We have yet to see an IoT device on the market with truly good security, and that will not change until demand comes from the public. Unfortunately, an upsurge in IoT attacks is likely what it will take, so make sure you aren’t one of the ones who are forced to learn that hard lesson: Avoid the use of these devices until they become more secure.
5. AI-Enhanced Hacking Tools
You may have noticed that a lot of companies are now offering AI-enhanced antivirus tools and other security software. This has become a common trend, but there is something we must stop and consider. That is the fact that hackers and cyber-criminals can also use AI to their advantage. Virtually any kind of hacking method could be aided through the use of AI and could make some types of attacks a lot easier and more dangerous than ever.
For instance, let’s consider the use of botnets. Cyber-criminals will often hijack large numbers of devices without the knowledge of their owners. Their processing power and identity are used as part of a “botnet.” Botnets can be used for all sorts of things, most of which are nefarious and illegal. Although this is not technically an AI-based method, we are sure that you can see how an AI at the helm could make this kind of thing a lot more dangerous. It would allow hackers to run many botnets at the same time since none of them would have to be managed directly.
Unfortunately, this matter is not strictly theoretical. AI-enhanced botnets have already been seen in several attacks, such as the 2018 hacking of Taskrabbit and two attacks on Instagram in 2019. In the case of the Instagram hacks, however, it seems that botnets were not used. Instead, an AI-based tool was used to scan the system for vulnerabilities. It doesn’t take a genius to see that this kind of thing is going to keep growing until a real solution is found.
Conclusion
While these are not the only cyber-threats on the horizon, we are confident in stating that they are the worst. All of these are threats that show no sign of slowing or stopping, and that is why they were included on this list. After all, you don’t need to know about the threats of the past…it is far more proactive to focus on the future. If you would like to learn even more, you can also call PCH Technologies at (856) 754-7500.