The main Cybersecurity threats of 2020
Right from the start to New Year’s Eve, 2020 was such a wild ride. It was an extremely weird year full of challenges and a complete uprooting of our day-to-day routines. Many were forced to shift to remote workplaces. and this jarring switch turned out to be a gateway for a completely different pandemic — cyber threats.
Much like years before, the cybersecurity realm saw a lot of activity. Our cybersecurity experts took the time to analyze the trends and the main cyber threats of last year.
Based on our study, these were the most common online threats we had to deal with and what we can do to protect ourselves from them in the future.
Remote worker endpoint security
Nearly everyone had to switch to remote working in the dreaded 2020, leading to an upswing in the number of employee workstations outside the corporate network. While most employees adapted to working the Internet, only a handful of them was concerned with their online security. And this didn’t just jeopardize the employees themselves, but the companies they worked for as well.
According to a survey carried out by CyberArk, over 77% of employees were using insecure endpoints to access corporate networks.
Hackers took advantage of employees using unsecured connections such as public Wi-Fi and poorly protected home connections. Several cases of remote worker endpoint security were recorded as millions of employees lacked adequate firewall protection.
Because of this, over 80% of companies in the US reported data breaches in 2020, with over 40% of them experiencing breaches more than 10 times!
How can you protect yourself against this?
As we step into 2021, users can take steps like avoiding public Wi-Fi, especially when logging into the workplace and using strong passwords for home connections. They can also use VPNs, e.g. NordVPN, which has a business solution to keep your whole corporate network secure.
Since security in remote environments goes past IT control, IT teams can implement automatic testing and remediate compliance drift. Adopting solutions that automatically detect and rectify user configuration changes to avoid compliance drift is equally important.
Lastly, employees can enforce real-time breach remediation. Any unsupervised remote work setting is a potential security risk. Staying ahead of cybercriminals looking to leverage this loophole is key. Tools that can detect issues and remediate them immediately are the best way to get ahead of the curve.
Spear phishing
Phishing attacks are social engineering attacks that deceive users into giving sensitive information such as credit card information and login credentials. These attacks are mostly carried out via emails or phony websites.
A study by Small Business Trends concludes that there is a potential phishing attack in 1 out of every 99 received emails.
Scammers are not fooling around either. General phishing everyone has caught on to has turned into spear phishing, which is much more targeted and specific.
Spear phishing is a sophisticated form of phishing where a cybercriminal learns highly specific details about the victim. The criminal then uses that information to either assume the identity of someone the victim knows to trick them or carries out highly targeted phishing attempts posing as a well-known brand.
This fraudulent practice is not only direful but also disastrous. A single spear phishing attack results in an average loss of $1.6 million according to Security Boulevard.
Security Boulevard further reported that 22% of all data breaches in 2020 involved phishing attacks. These are indeed worrying figures considering nearly half of phishing attacks make it past default security measures.
Microsoft was the company phishermen were trying to imitate the most. So next time you get an email from Microsoft asking you to change your cloud password — think twice.
How can you protect yourselves from this?
There are effective counters you can use to protect yourself.
As a start, you need to be extremely careful with emails, SMS messages, calls, notifications, and literally everything else.
Triple check everything. If there’s even a shadow of a doubt it’s your bank sending you notifications about your account being hacked or Microsoft saying your subscription has expired, contact customer support through official channels.
Companies can also conduct training to help employees recognize phishing attacks and implement custom anti-phishing tools to identify falsified emails.
Malware (Banking Trojans and Botnet)
Remember when everyone was scared of Trojans, and no one knew what they were? Well, they are back and better (read: worse) than ever.
Accenture reports that the average cost of a malware attack on a company is $2.6 million. Yes, that’s how bad it is.
It gets worse. Over 360,000 new malware files are generated daily, although some are rehashes of older malware. The most common malware kinds seen last year were Trojans and worms.
A worm is a malware form that self-replicates once installed on your device and searches for specific information.
Trojans are a form of malware that disguise themselves as legitimate software. This way they deceive victims into installing it onto their devices. Trojans can take many forms and can potentially cause a lot of damage while appearing harmless.
Today, Banking Trojans commonly target mobile devices since everyone has a banking app. No one is safe – not businesses, not individuals, or even financial organizations. You can get a Trojan from anywhere – visiting a nasty site, spam, phishing, or even from accidentally clicking an ad.
Once the malicious code is installed on your device, it employs different techniques to obtain the targeted information. This could be access to your social media, your financial information, or even identity theft.
How can you protect yourself from that?
An antivirus can provide just enough protection against most malware forms. However, to be safe, you need multilayered security tools that feature an email virus scanner, antivirus, intrusion detection system, and deep-packet inspection firewalls.
Note that it is not enough to install an antivirus program on your device and let it be. Always keep it updated.
You can also use a good VPN tool with advanced cybersecurity features, such as NordVPN or Surfshark.
IoT based attacks
The Internet of Things has been the in-thing in the last few years. Almost, if not, everything is connected to the Internet today – from your alarm clock to your dishwasher. Even faucets (and this is not a joke) have an Internet connection.
But the security measures within these appliances are often overlooked (it’s not like your fancy washing machine will come with an installed antivirus).
According to a Symantec report, IoT devices see an average of 5,200 attacks monthly.
IoT devices are becoming increasingly targeted by hackers to sneak a piece of malicious code and infiltrate enterprise networks. Statistics heavily backs these claims. CSO Online reports that about 61% of organizations have experienced an IoT security incident.
How can you protect yourself against IoT based attacks?
Since this threat is relatively new, there aren’t measures against that. Professionals (meaning we) recommend maintaining a thorough inventory of all smart devices as well as the operating systems they run on.
It is also important to ensure their firmware (inbuilt security) is updated all the time. This way you will prevent attacks that have been patched by the manufacturer.
The only other real solution we can recommend is installing a VPN on your router. This simple step will encrypt and secure all of your home and office traffic and keep you safe.
Ransomware
The days of taking down MAERSK might be in the past, but ransomware is still a very real and scary threat.
Last year, ransomware attacks were not any less grave. As a matter of fact, ransomware attacks increased, and the average ransom demand by attacked surged by 60% to $178,000 last year.
Statistics show that businesses tend to be targeted more compared to individuals. This is because businesses have more money and are likely to pay ransoms. Almost every 11 seconds, a ransomware attack hit a global business, and the average cost of recovering from that is north of $150,000, although this hinges on the business.
How can you protect yourself from ransomware attacks?
Ransomware is generally tough to fight against. If you are an end-user, you are probably safe since ransomware mostly targets businesses. However, if a piece of malicious code ends up on your device, it might ask you for a bitcoin or two as well.
Investing in a good antivirus for individual workstations that can scan emails, since that is the entry point for most threats, is the first step in defending yourself. It is also best to enforce strong perimeter security like firewalls.
You can also consider hiring a security expert that can check the system and application for breach vulnerabilities.
Another measure is to have a disaster recovery plan in place to shield you from data loss.
DDoS attacks
DDoS attacks are nothing new in the cyber world, and they remain a significant threat. No one is safe – whether you’re running a world-leading company or playing Fortnite competitively.
The cloud computing giant Amazon Web Service, for instance, suffered the biggest DDoS attack of 2020 last February. The attack was arguably the most extreme DDoS attack in recent years.
Such attacks are very costly as they paralyze business operations. According to recent surveys, the average hourly cost of a DDoS attack ranges from $20,000 to $40,000.
How can you protect yourself from DDoS attacks?
DDoS attacks have become so common in recent years, they can actually be hired as a service (DDoS-for-Hire). And yet, combating them remains a difficult task, as there are no specific countermeasures against all of them. Different methodologies of DDoS attacks, such as volume-based and application-layer, call for different measures.
A countermeasure for protocol-based attacks won’t necessarily mitigate an application layer DDoS attack.
A better solution is to use a VPN application. By switching your IP address, you considerably lower the chance of being crippled by a DDoS attack. And there’s no better way of having a bunch of IP addresses at your disposal than a VPN!
You can also blacklist all IP addresses associated with DDoS attacks. To thwart DDoS attacks completely, you need a thoroughly worked out security strategy to manage the different kinds of DDoS threats. Tapping on the expertise and resources of having a specialized cybersecurity service provider is very useful in such instances.
It isn’t over…
Hopefully, 2021 will bring an end to the coronavirus pandemic. However, the cyberthreats will remain. And scammers and hackers have had plenty of time to hone their skills and make online threats much more sophisticated.
We suggest you adjust your New Year’s resolution and consider investing in better cybersecurity measures. That cracked Antivirus you haven’t updated in years won’t cut it anymore.
Leave a Reply