By Nick Eatock, CEO of intelliflo
Cyberattacks are listed in the World Economic Forum (WEF)’s Global Risks 2021 report as a high-likelihood, high-impact risk which poses a key threat to society1. They are defined as a deliberate attempt to gain unauthorised access to a computer or computer network with malicious intent to disable operations or steal data and are a risk to organisations and individuals.
There are several different forms of cyberattack; here’s a rundown of the three most common.
By far the most frequent type of cyberattack on businesses currently is phishing, which is an attempt to access information or systems by pretending to be a trusted source. According to figures from the Department for Digital, Culture, Media & Sport (DCMS), one in three (32%) UK businesses have experienced a phishing attack in the last twelve months2. Phishing usually refers to email messages, but these attacks can also come via text message (known as smishing) or social media and it is often the entry point for security incidents, for instance, the installation of malicious software, known as malware.
Phishing is usually an untargeted communication sent to a large number of people requesting personal information. Messages can be extremely convincing and look like they come from a trusted source, pointing to a fake website that looks identical to the real thing. According to the Verizon 2021 Data Breach Investigations Report, the median click rate in phishing simulations is 3%, but the range was very broad, with one in six organisations having a click rate of over 10%. Using an email filter and training employees to look out for suspicious communications can help reduce the risk of success. Avoid downloading attachments or clicking on website links unless you are sure you can trust the source.
Spear phishing on the other hand is where an organisation is singled out for a targeted attack, which could be planned over several months. The aim might be to commit fraud, harvest credentials or deliver ransomware, where criminals disable access to your data and demand a ransom to restore it, or threaten to release your data publicly if you don’t pay them. This type of attack is extremely disruptive to business and can be very costly to deal with. Encourage employee vigilance, protect systems and devices with strong passwords and two- or multi-factor authentication and back up your data regularly so you can access it from elsewhere if necessary.
Impersonation is where a fraudster pretends to be a specific person from an organisation to gain trust and exploit employees or clients. DCMS figures suggest this is the second most common type of cyberattack, albeit someway behind phishing, with 11% of UK businesses experiencing an incident in the last year. Criminals impersonate their victim by creating a similar email address to the company’s usual format or using their real email address, having gained access through a phishing or malware attack.
It can be very difficult to spot these attacks, especially if you are expecting correspondence from the individual and trust them with your personal data. Always check that the domain is correct and think about the language used – a sense of urgency may be a red flag as the imposter will want to gain the information quickly before the scam is uncovered. If in doubt, always double-check the request is genuine by contacting the person in a different way.
To avoid becoming a victim of impersonation, protect your systems and devices with strong passwords and two- or multi-factor authentication. Scammers also often gather intelligence on their target to aid the impersonation, so minimise their chances by being wary of the personal information you and your employees are posting on your company website and social media.
As mentioned previously, malware is a form of malicious software that can be downloaded to your computer or systems without your knowledge. It aims to steal, encrypt or delete data from your systems to cause disruption or to make money by selling the data demanding money from you to regain access. It is ranked third in the DCMS figures, with 4% of all UK businesses experiencing a malware attack in the last twelve months, rising to 6% if ransomware is included.
A high percentage of malware is delivered via phishing emails, so having robust procedures against phishing is an important first step in protecting yourself against malware, while installing a firewall will help block non-email attacks. Use strong passwords along with two-factor authentication on systems that store sensitive data and make sure you run provider updates on all systems and devices as soon as possible as these often fix security vulnerabilities. Finally, perform frequent systems backups and store the data elsewhere, for instance via one of the main cloud providers where you’ll benefit from their strong security resources and investment.
With cybercriminals becoming more sophisticated all the time, it’s essential that understand the risks facing your firm. By introducing a variety of measures to improve your firm’s resilience, you can reduce the risk of a successful attack and minimise disruption if an incident does happen.