CYBER RESILIENCE HOW TO PROTECT SMALL FIRMS IN THE DIGITAL ECONOMY

fsb.org.uk
Unsurprisingly, different crimes were distributed differently between sectors. Table one illustrates
how different sectors are impacted by different types of cyber crime.
KEY RESULTS:
• Reporting of Phishing and Spear Phishing attacks was generally high across all sectors, but both
types of Phishing had the highest incidence in the arts, entertainment and recreation sector. 17
• Malware was most prevalent against the manufacturing, finance and insurance, professional
services and administrative and support services sectors. 18
• The proportion of businesses in the wholesale, retail and motor repair sectors that had been
a victim of CNP fraud was double the proportion reporting CNP fraud across all sectors, with
nearly 21 per cent of respondents suffering from it. Just behind the wholesale, retail and motor
repair sector are the transportation and storage sector and accommodation and food service
sectors. These are all generally consumer facing sectors, where the opportunities for the
fraudulent use of credit cards and other payment systems is high. 19
• IP theft was reported by over one in ten of respondents in the arts, entertainment and
recreation sector.
• DDoS 20 and ransomware 21 attacks were noticeably higher in both the information and
communications and the administrative and support services sectors.
17 These levels of reporting should not be surprising. As the latest Threat report from Symantec shows, 1 in every 1,846 emails sent in 2015 was a Phishing email.
Symantec identified 1,305 Spear Phishing campaigns in 2015, each involving on average, 12 email attacks, against 11 recipients over a 6 day period. Source:
Symantec, Internet Security Threat Report: Volume 21, 2016.
18 Symantec have identified that around 1 in 220 emails sent and received in 2015 was infected with malware and that one in 3,172 websites were infected with
malware in 2015. 431 million new malware variants were added to the internet in 2015. For mobile devices there were 3,944 new variants of malware created.
Source: Symantec, Internet Security Threat Report: Volume 21, 2016.
19 The UK Cards Association identified 1,019,146 remote purchase (i.e. Card Not Present) frauds in 2014. This equated to a cost of around £331,500,000 in 2014.
Incidents were increased from 875, 086 in 2008, including a seven per cent increase between the years 2013 (951, 988) and 2014. In value terms Card Not Present
frauds increased by 10 per cent between 2013 and 2014. The trend is one of steep annual increases. It is no surprise therefore that consumer facing businesses in
particular are suffering at around twice the average for all the sectors FSB surveyed. Source: UK Cards Association, Card fraud figures, 2016.
Available at: http://www.theukcardsassociation.org.uk/plastic_fraud_figures/
20 These levels of reporting should not be surprising. The latest ‘Threat’ report from Symantec shows that in 2015 there were 362,000 Crypto-ransom-ware attacks.
That is 992 per day for the whole of 2015. This was an increase of 35 per cent on the numbers of incidents in 2014. Source: Symantec, Internet Security Threat
Report: Volume 21’, 2016.
21 Symantec described the trend in Denial of Service (DDoS) Attacks as ‘…growing in intensity and frequency. For example, Symantec saw a 183 percent increase
in DNS amplification attacks between January and August 2014. According to a survey by Neustar, 60 per cent of companies were impacted by a DDoS attack
in 2013 and 87 per cent were hit more than once. Motives include extortion for money, diversion of attention away from other forms of attack, hacktivism, and
revenge. Increasingly, would-be deniers of service can rent attacks of a specified duration and intensity for as little as $10–$20 in the online black market’. Source:
Symantec, Internet Security Threat Report 20, 2015.
In September 2015 alone, Symantec identified over 15 million DDoS attacks. Source: Symantec, Internet Security Threat Report: Volume 21, 2016.
13