中文 Chinese
October marks Cybersecurity Awareness month. For 18 years, the Cybersecurity & Infrastructure Security Agency (CISA) has made October a month to educate and promote safe online behaviors and practices for both consumers and businesses. CISA has also created the Stop. Think. Connect™ campaign to raise public awareness about cybersecurity and how consumers and businesses can protect and mitigate against cybersecurity threats. This blog will focus on some of the most common cyber-attacks and tips for how today’s enterprises can safeguard their data as well as their customers.
According to RiskBased Security Research, data breaches resulted in 36 billion records being exposed in the first three quarters of 2020. Additionally, the use of malware increased by 358% through 2020. Also, more than 90% of healthcare organizations suffered at least one cybersecurity breach in the previous three years. The cost of cybersecurity runs in the millions and it’s estimated that cybercrime costs organizations $2.9 million every minute with the average attack costing $3.86 million. During the COVID-19 pandemic, online scams spiked more than 400% in March 2020 alone compared to previous months.
It’s important to note that it’s not just the financial burden that negatively affects today’s organizations, but their reputation and brand name are damaged as well.
Most common cyber attacks
There are dozens of different types of cyber-attacks. The most common ones are listed below:
MITM attacks
A man-in-the-middle attack (MITM) is where an attacker intercepts the communication between two parties in an attempt to spy on the victims, steal their personal information and/or credentials, and even alter the conversation in some way between the parties.
MITM attacks are becoming less common these days since most email and chat systems use end-to-end encryption which prevents third parties from interfering with the data that is transmitted across the network, regardless of whether the network is secure or not.
Distributed Denial-of-Service (DDoS) attack
A DDoS attack is where an attacker will flood a target server with malicious traffic in an attempt to disrupt, and maybe even bring down the target. But, unlike traditional denial-of-service attacks, which most sophisticated firewalls can detect and respond to, a DDoS attack can leverage multiple compromised devices to bombard the target with traffic.
Phishing
A Phishing attack is where an attacker tries to trick an unsuspecting victim into handing/sending over valuable and personal information, such as passwords, credit card details, and so on.
Phishing attacks often arrive in the form of an email pretending to be from a legitimate organization, such as a bank, the tax department, the government, or some other trusted entity.
Phishing is probably the most common form of cyber-attack because it is easy to carry-out, and surprisingly effective.
Eavesdropping
An eavesdropping attack occurs when a hacker intercepts, deletes or modifies data that is transmitted between two devices. Often referred to as “snooping” or “sniffing”, the attacker looks for unsecured network communications to intercept and access data that is being sent across the network. This is one of the major reasons why employees are asked to use a VPN when accessing the company network from an unsecured public Wi-Fi hotspot for example.
Tips to safeguard your personal information
There are several ways today’s organizations can protect their data and those of their customers. Let’s review some of them.
a. Patching the Operating Systems & Software regularly
Every new application and/or new software program can open the door to a cyber attack if companies aren’t proactive in regularly patching and updating all software. This includes updates on every device and those used by employees. It’s important to always check for updates especially when purchasing a new computer. Most system and software updates often include new or improved security features designed to protect the system from vulnerabilities.
b. Install and Activate Software and Hardware Firewalls
Firewalls can prevent malicious hackers and stop employees from browsing unsafe websites. Companies should install and update firewall systems on every computer, smartphone, and networked devices. This also includes remote/off-site employees even when using a virtual private network (VPN). To add an extra layer of protection, it’s highly recommended that companies install an intrusion detection/prevention system (IDPS) to provide a greater level of protection.
c. Secure All Wireless Access Points & Networks
Wireless networking can provide cyberattacks an open door to steal confidential company information and data. For secure wireless networking, companies should use these router/gateway best practices:
- Change the administrative password on new devices frequently
- Set the wireless access point so that it does not broadcast its service set identifier (SSID)
- Configure the router to use Wi-Fi Protected Access 2 (WPA-2), with the Advanced Encryption Standard (AES) for encryption
- Avoid using WEP (Wired-Equivalent Privacy)
- If providing wireless internet access to your customers or visitors, make sure it is separated from your business network
d. Educating and training employees
Educating employees in the basics of cybersecurity and keeping them up to date with all the threats your business is exposed to is essential. Insider threats are a major cause of vulnerabilities today. Today’s organizations should have an incident response plan that documents what employees should do in the event they encounter a suspicious file or email and/or are a victim of an attack. Keeping everyone in the loop is critical.
In sum, today’s cyberattacks are becoming more prevalent and affecting businesses of all sizes. However, when companies invest in their cybersecurity infrastructure and cyber resilience, they can protect their business and safeguard customer data from any major cyber attack.
