The holiday season is well upon us and along with all that holiday cheer also comes some malevolent spirits. Companies need to be on high alert for cyberattacks and insider threats that can compromise the most desired gift of the season – your data. Let’s take a walk with the Security Ghosts of Past, Present and Future for some Scrooge worthy cybersecurity lessons to take with us as we prepare for what’s next in 2022.
Ghosts of Security Past
Businesses need to be vigilant this time of year as hackers flood company and contractor email accounts with messages meant to lure your credentials to access the company’s crown jewels – customer payments card details, personal data and other sensitive information.
We all remember the infamous Target breach of 2013, whose impact still haunts those affected. Over 40 million credit and debit card details were stolen when attackers breached Target’s Point of Sales (PoS) systems. The hackers used a phishing scam to successfully steal the credentials of Target’s third party HVAC contractor. They successfully used the stolen credentials to access Target’s POS systems that held their customer’s credit card numbers, PINs and other personal data. The breach wreaked havoc on the company, its reputation and bottom line – resulting in an $18.5 million multistate settlement.
Ghosts of Security Present
Ransomware, Phishing and Malware
Phishing scams, malware, Trojans, ransomware; the list of present cyberthreats goes on and on. Determined attackers will stop at nothing to get at your systems and data. The Colonial Pipeline attack in May showed how disruptive a ransomware attack could be – shutting down the company and its gas delivery for whole sections of the US. According to McAfee, Government, Telecom, Energy, and Media & Communications are the most targeted sectors for these attacks.
Data Breaches & IP Theft
Massive data breaches also topped the cybersecurity charts in 2021. From major software companies to telecommunications companies and retail suppliers, billions of people were impacted from stolen personal data and passwords.
Consumer data isn’t the only thing at risk. From nation-state theft, to malicious insiders including a Tesla employee downloading 26,000 sensitive files in one week, to the Facebook whistleblower downloading thousands of confidential files – IP and company secrets are a big target and a bigger hit to your bottom line. The average cost of a data breach in the U.S. is $8.64 million compared to the $2.5 million plus it can cost to defend a patent lawsuit.
Cloud Threats
The October 2021 McAfee Labs Threats Report reported that as a result of the switch to remote work during the pandemic Cloud threats are also on the rise. The most common cloud threats in Q2 2021 were identified in the report as:
- Excessive Usage from Anomalous Location (i.e. the user has accessed or downloaded a very large volume of data within a short span of time)
- Insider Data Exfiltration
- Privilege Access Misuse
- High Risk Data Exfiltration
- Privilege Access Exfiltration
- Land Expand Exfiltration
- Suspicious Superhuman
- Data Exfiltration by Privileged User
It is all too easy for distributed workers using productivity tools to become the victim of a land and expand attack, overstep their privileges or exfiltrate data for personal gain. With most companies planning to stay remote or keep a percentage of their workforce remote moving forward these challenges need to be front and center in 2022.
Security Ghosts Yet to Come
One thing is clear, cyberattacks and insider threats will continue to plague us into 2022 and beyond. The continuing pandemic and massive volume of remote workers only exacerbates these security issues. Organizations need to continue to evaluate their security practices and tools used to combat both new and old threats.
To start, you need to make ‘I will be breached’ your security mantra. While employee training remains high on the list of security recommendations, so should security techniques that ensure your users only have access to the information they need to get the job done to limit what information can be impacted.
By changing your security mind set and embracing new techniques like zero trust you will be ready for new and stealthy attacks that increasingly are able to make it past your first line defenses, as well as those that come from within your increasingly distributed workforce.
Here’s some additional advice on how to keep your organization protected in 2022:
- Learn how to extend ‘zero trust’ to data access to not just control access to information but also what users can do with the information once they have access to prevent data loss, misuse and theft.
- Brush up on the challenges of building information barriers with role based security and how dynamic attribute-based access control (ABAC) solve complex use cases.
- Learn how using digital security watermarks can prevent data loss and aid in forensics.
- Discover the use case for Multi-Level Security (MLS) and why is it important to better protect classified information.
Finally, contact us if you need help protecting your sensitive data.
