Cyber Defense eMagazine July 2021 Edition

The growing threat
In the last 12 months, the percentage of organizations experiencing a cyber-attack jumped from 38% to
43%, according to Hiscox data, and 73% of those victims experienced more than one attack. A paltry 9%
reported they were able to defend the attack with no impact on operations. Stronger defenses and better
preparation are required to avoid potential disaster.
Beyond the disruptive impact of ransomware or DDoS attacks, there lurks the even worse threat of a fullblown
data breach. It takes 280 days on average to identify and contain a data breach and costs $3.86
million, according to the Ponemon Institute. It’s far better to spend a fraction of that amount to bolster
your defenses and harden your security posture.
The question is where to spend it to ensure the greatest impact.
Phishing and BEC attacks
We know that malware can usually be traced back to a phishing attack. Threat actors are increasingly
picking their targets and getting smarter about how they approach them. Spear phishing is on the rise
and sophisticated attacks employ stolen credentials to attack laterally. If a message or email appears
legitimate, or worse comes from a colleague’s account that has been hacked, the risk of someone clicking
a link or downloading a file and triggering a malware installation is much greater. The unpleasant truth is
that anyone can be fooled. Employees of all levels can fall victim to phishing scams.
Business Email Compromise (BEC) is also a serious concern, with the FBI reporting $1.8 billion losses
through BEC, which is a staggering 42% of the cybercrime loss total. Much more sophisticated and
targeted at CEOs, CFOs, and other high-ranking executives, BEC can be the result of months of
reconnaissance, with attackers building complex infrastructures and hacking multiple accounts in pursuit
of a big payday.
Spending effectively to boost security
The temptation to sink any budget increase for cybersecurity into a tool or platform that promises to
safeguard your data is understandable, but there’s a better way to strengthen your security. If we accept
that security systems can always be bypassed by persuading people to unwittingly grant access, then
it’s clear that the best way forward is to educate and empower your workforce.
Security awareness training is crucial because by teaching people to spot the common signs of a phishing
attack will develop the muscle memory you want to see.
Establish a baseline before you begin and set targets for improvement with periodic tests, such as mock
phishing campaigns, to determine what progress has been made. Test results and any real-life security
incidents that occur should be leveraged as learning opportunities and used to inform ongoing training.
Make sure that you combine training with stronger security controls and strict procedures. At the shallow
end, you have to provide phish alert buttons to make it easy to report suspicious emails. Reports should
Cyber Defense eMagazine – July 2021 Edition 43
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.