“CYBERSECURITY A CRITICAL POINT FOR ALL TYPES OF ORGANISATIONS”
At 16, Karol developed his first security software program. He completed a cybersecurity program at MIT in Boston and is one of two people in the Czech Republic to hold a NATO security clearance. He is also a court-appointed expert in cybersecurity. Over the last ten years, he has been looking after the privacy and security of companies and well-known figures around the world. He is a member of a team of cybersecurity experts at www.Shift2Cloud.eu, which improves company efficiency and security.
Organisations around the world are dealing with the challenges of this pandemic, including through rapid growth in digitalisation and new methods of remote working. On the one hand, many of us appreciate the positive impact this has had on efficiency. But on the other hand, the situation offers opportunities to cybercriminals, who continue to come up with new methods of attack. Also coming into play are dynamic events in politics and the related boom in disinformation campaigns.
The impact? There are a number of predictions. According to the prestigious Cybersecurity Ventures research company, cybercriminality is expected to cost the global economy up to 6.1 billion US dollars this year. But cybercriminality also threatens the overall security of society and the reputation of organisations. Thus there are new demands on leadership, because only a strategically focused solution can secure the cyber health of organisations and the whole of society. The era when only large enterprises were at risk is long gone. A large number of attacks are carried out generally and automatically across the internet to which we are all connected. These are made regardless of sales (or profits in general), employee numbers or type of activities of the victims. While it is true that hackers logically have a better chance at gaining a large amount of data from large companies, in general they are better secured than small and mediumsized organisations. Research undertaken by experts at Shift2Cloud suggests that 60 % of small and medium-sized firms do not address security, making them easy targets. Yet 61 % of cybersecurity incidents occur within SMEs.
How do attacks reflect global events?
Fraudulent messages, in particular, respond to events in society. This category, which we collectively refer to as “phishing”, involves manipulation of people’s trust through false messages across communication channels. This doesn’t involve just e-mails, with an increasing frequency of messages sent via messaging apps, fraudulent advertising on the internet, and even telephone calls. There can be various objectives, with the user typically called upon to make a payment, provide personal or bank details, or click on a link. This can then install a malicious program such as ransomware on your device. The attacker uses ransomware to encrypt data on your computer, requiring a ransom to be paid in order to access your data again. But paying the amount demanded is no guarantee that the hacker will let you access your data again – and certainly no guarantee that he is not already trading it on the black market. During the pandemic, many fraudulent messages working this way have offered miraculous Covid cures or vaccination registration.
As soon as a new subject appears which resonates with society, it becomes a new subject for hackers. Hackers work not just for themselves, but also for various countries’ secret services and for terrorist organisations. The Czech National Cyber and Information Security Agency (Národní úřad pro kybernetickou bezpečnost – NÚKIB), for example, recently warned that the Czech Republic is at increased risk of attacks as a result of its expulsion of Russian embassy staff in response to the suspected involvement of Russian agents in the explosion of the ammunitions depot in Vrbětice. This could involve not just attacks on critical infrastructure, but also disinformation reports which lead the user to click on links to find out more. The diversity of possible attacks is illustrated by the fact that just in connection with Vrbětice, NÚKIB has issued recommendations on its website to watch out for 23 methods of attack, along with the 17 most frequently exploited vulnerabilities.
Working from anywhere and millennials
The accelerating shift to work-from-home logically carries risks. Home computers and tablets, like home networks and internet connections, may not be sufficiently secure. Often a number of family members use home devices, including children, and not just because of distance learning. It is thus entirely appropriate to ensure every employee and company software user is sufficiently familiar with security when working remotely. The gradual entry of a younger generation more familiar with modern technology may mark an easier path to cyber health. On the other hand, although young people better understand the core rules, this fact should not be relied upon. A strategically managed system of continuous education is of the utmost importance. The advantage here is not just that education is perceived as a valuable employee benefit, but especially that there are huge costs savings from resolving security incidents. A single successful attack costs companies an average of 80 million crowns. If it also involves loss of personal data, the company could face a fine of up to 4% of its global revenue. It doesn’t matter whether the incident occurred in the Czech Republic or elsewhere – the fine is calculated in accordance with revenue from all subsidiaries around the world.
Management, control and continuity
The Achilles heel of many organisations is the fact that they do not have clear security and control mechanism standards for observing obligatory regulations (e.g. GDPR). Relying on the security of the organisation’s IT services provider or its own division may not pay off. Like doctors, for example, IT experts also specialise in particular areas. What were the most recent proposals for increasing IT security from your IT department or supplier? Do you get regular security monitoring reports? If not, then hackers may already be in your network. The Marriott hotel chain, for example, discovered in 2018 that somebody had been stealing customer data for a full four years through a hole in their IT infrastructure. Discuss with your IT team what their idea of cybersecurity is. Explain that you’re not criticising them, and open space for discussion on getting a cybersecurity expert involved.
Many organisations face threats to their continuous operation due to inappropriate methods of data backup – or their complete absence. Although backing up data isn’t a primary method of protecting it from theft, it does provide the option of restoring data from a safe repository. This will be found in one of the cloud services which are available, where technological maturity plays the greatest role. In this regard, Microsoft solutions are the unquestionable leader, as consistently confirmed by Gartner analyses. This is logical – who else would be best able to secure the backup of data from the most used operating system than its author? A number of copies of your data are stored at geographically distant data centres which are equipped with cutting-edge protection, including against the risk of natural disasters, and managed by teams of experts. Furthermore, by using a professional cloud service you save significant costs for your own infrastructure, and greater procedural efficiency will be reflected in your revenue. Through the cloud, all end devices – company computers and other devices connected online – are also automatically updated and continuously screened.
Security audit – the essential starting point
In order that a strategic plan and proposal for optimum security architecture, processes and education can be set up, the initial situation needs to be ascertained. A basic audit can be implemented at a cost from 17 900 crowns. During an audit, it isn’t just security settings which will be checked: it is also necessary to get a clear picture of how your current security system, as well as people in your company, withstand specific hacking attempts. A simulation of real attacks is used for this. Not only is the resilience of the IT infrastructure itself tested, but methods of social engineering are also exploited. These are techniques which attackers apply directly on people in order to make them reveal certain information. Imagine, for example, that an attacker calls your company and, using systematically posited questions, ascertains whether your company has its own IT specialist, or makes use of an external company. This ostensibly banal information may, however, play a crucial role in planning an attack.
This is followed by implementation of chosen measures and the installation of cutting-edge tools for detecting advanced cyber attacks. Another integral component is bespoke regular training for all users and your IT division. Your company’s security is only as strong as your people are adept at using it. Regular training is essential in order to keep pace. Nobody’s perfect, and anyone can make an error which may cause an issue despite all the security you might have. Today, transferring to a cloud solution clearly offers the greatest benefits to organisations of all sizes and types.