Should We Prepare for a New Era of Cyber Pandemic in 2021

COVID-19 has led to the prolific use of virtual technologies to support remote work. This is gradually paving the way for a new pandemic- a sharp increase in organisations being held hostage by cyber criminals, data theft, privacy breaches and disruption to supply chain across the globe.

Organisations, already under pressure from COVID-19 are being targeted by a variety of scams and threats and are increasingly giving in to these threats. Fatface, a UK fashion retailer has paid out $2 million to a ransomware gang that breached their systems in January 2021.

More recently, in March 2021, Acer, a Taiwanese electronic company, were attacked by a group called REvil , who demanded a ransom of $50 million, one of the largest ransomware demands in recent history. A wide range of reports by cybersecurity scholars (Fireeye 2021, Hiscox 2020, Vasek,2019) have established that cyberattacks are rapidly evolving and growing in both frequency and severity, with costs reaching up to $6 trillion in 2021 and set to rise further. These reports, amongst other security news outlets, have discussed trends that will dominate the cybersecurity landscape in 2021. Some of these are:

1. Evolution of attack techniques and IoT threats

Common attack techniques such as phishing, ransom ware, botnets, trojans and phreaking will remain prominent. However they will likely be automated using artificial intelligence and tailored to specific companies as targets, having carefully mined data on personnel, social networks, and social media. The lack of time to prepare staff for training in the use of remote technology applications and use of IoT in homes is set to exacerbate the problem.

2. The cloud footprint

95% of companies have a cloud presence, if only for payroll or HR functions. Cloud attacks are likely to grow and be executed through hacking-vulnerable cloud applications, stealing credentials via phishing, exploitation of any misconfigurations and through the supply chain, such as cloud vendors.

3. Nation State Attacks

The attack on Solarwinds in 2020 has demonstrated that threat actors can take the form of nation states and can sponsor regional and global attacks. Spear phishing, a common tool, will continue to dominate in 2021. However there is an increased focus on intrusion techniques such as exploitation of web facing applications, password spraying and increased use of third-party intrusion vendors.

4. Fileless malware

Fileless malware depends on tools that are a part of the workflow for most enterprises, specifically tools that are pre-installed on every Windows machine and are vital for all operations. Attackers could use a range of windows processes such as PowerShell, Windows Management Instrumentation (WMI) and .NET. We are likely to see attackers continuously innovate and share techniques as they develop such malware as a service model in 2021.

2021 brings new challenges on the health and cyber front. As cyber criminals are getting organised as ‘companies’ and improving both technologies and attack strategies, we must, as a matter of urgency, look at our own cybersecurity and data protection. Surface level products and software are not enough to combat the threats that 2021 brings. Advanced solutions are needed to monitor risks and assess vulnerabilities and endpoint solutions to thwart threats and build cyber resilience.

The World Economic Forum lists cybersecurity failures among the main global risks in 2021.

Can you shield against a cyber pandemic?

A risk management approach is vital to digital security. A significant part of securing the cyber landscape is knowing how to best protect the most significant assets and effectively defend against security incidents and breaches. As with a biological pandemic some key steps are:

• Reduce the rate of infection. Check your systems to protect critical assets and detect and remove threats in real-time.
• Prevent an infection. Develop an SOC for real time prevention and access to continuous security intelligence.
• Improve cyber hygiene. Practice cyber hygiene by keeping up-to-date with security threats and ensure compliance with regulations and latest standards.

At Cystel, we recommended asking the following key questions to test your state of preparedness.

• What is my current security protocol?
• What vulnerabilities or gaps do I have in my remote infrastructure?
• Do I understand security effectiveness as a business metric?
• What is my risk management approach to mitigating threats of IoT?
• Is my organisation’s security training state-of-the-art?

As cybersecurity researchers at Cystel, we believe cyber readiness needs to be a top priority for every connected individual . There is no one size that fits all and there are a variety of solutions, services, and protocols to evaluate to help meet security challenges. Speak to us about your cyber challenges for 2021 and stay safe during the next wave of cyber attacks.