Cyber security From Evolution To Current Trends
Cybersecurity Explained
Cybersecurity is the function of protecting any kind of device (computer, smartphone, tablet) from criminal threats in cyberspace. Much like how physical security can protect a bank for example, cybersecurity can be used to protect systems from a multitude of attacks, such as fraud or shutting down vital systems.
What is a cybersecurity threat?
A cybersecurity threat is a variety of attacks through the means of cyberspace, a virtual space that is used as a metaphor to help us understand digital weaponry that intends to harm us. This is usually a malicious act that can usually disrupt computer systems, breach vital and personal information from company/government databases, target individuals, or even shut down important and vital systems such as hospital computers.
Currently there are a number of cybersecurity threats, including;
A type of data-encrypting program which locks data and demands payment in return
for the release of said data.
Also known as a distributed denial-of-service. This is a malicious attack which is
intended to temporarily or indefinitely shut down a service connected to the internet.
Often in the form of emails, cybercriminals can often imitate legitimate
resources/companies in order to trick users into giving them sensitive information.
Anything which is connected to the internet is vulnerable to a cybersecurity threat, and as such, cybersecurity is necessary to protect all systems across the globe.
Why is it necessary to protect from cyber threats?
It’s important to protect against cyber threats; without protection, all categories of data are susceptible to things like data breach campaigns which can spread information from your databases wherever the cybercriminal wants to send it.
Sending attacks that may disrupt machinery is also a dangerous threat, for example disrupting medical networks for hospitals or releasing information on vulnerable individuals.
Importance of cyber threat intelligence for enterprises
Cyber threat intelligence allows you to prevent or alleviate cyber attacks by studying threat data and providing information on criminal attacks.
While cyber threat information can be raw unfiltered data, intelligence can sort that data and have it evaluated by trained analysts, providing accurate, relevant solutions to help prevent future threats and cross examine them with reliable and relevant sources to be sure the prevention tactics will be successful.
Are cyber attacks inevitable?
Cyber attacks can happen when you least expect them to, much like other workplace dangers, but using cybersecurity can change and limit the number of attacks faced over time. Cyber threat intelligence is much like preparing for possible fires by creating fire drills, so that your workforce and technology are prepared.
There are no signs that cyber crime is slowing down, so while we can’t say that attacks are inevitable, they are likely.
Which are Cyber Security Advanced Threats?
Advanced threats to cyber security can be stealthy attacks which evade detection and infect your computer with advanced malware, ransomware, or Trojans.
These attacks can also be targeted for specific computers, systems, and users. Once able to access, the assailant studies your browsing habits, the websites you visit and your downloads, and develops an advanced threat that targets a specific vulnerability of their victim.
your browsing habits, the websites you visit and your downloads
that targets a specific vulnerability
of their victim.
How are cyber attacks undermining our economy?
Commercial and credit card fraud can really affect the economy in different ways, other than simply losing money.
Point of Sale malware can harvest credit card data and not only leave merchants liable but also force credit card companies to forcefully cancel cards and reimburse customers who may have suffered.
This also affects trust between customers and merchants; if a customer does not have faith in a payment system, they’re less likely to shop there and that will leave the merchant/brand with a loss in revenues.
Credit card data fraud
Affects trust between customers & merchants
Loss in revenues for merchant/brand
Loss in revenues can also come from the time taken to repair the system if it were broken, as the brand may be unable to function without it.
There’s also the cost of recovery to consider, as many companies may lose a lot of money in reimbursements and designing new security systems to avoid an attack/breach in the future.
Evolution of cybersecurity
1987: the birth of cybersecurity
The first commercial antivirus became available this year, though there are competing claims as to who was the first inventor of the product.
The first antivirus product was for the Atari ST, and also saw the release of Ultimate Virus Killer.
3 Czechoslovakians also created the first version of NOD antivirus, and in the U.S. John McAfee founded McAfee (which was part of Intel Security at the time) and released VirusScan.
1990s: the world goes online
As the online world became more readily available to everyone, cyber security had to step up its game to help protect them. The European Institute for Computer Antivirus Research (EICAR) was established, and early antivirus software was signature based, meaning it compared binaries on a system with a database of virus signatures.
By the mid 90s, one NASA researcher had developed the first firewall program, and modelled it after physical structures which prevented the spread of actual fires.
At the rate criminals were adapting their viruses, it was clear that antivirus programs needed to be distributed on a massive scale across the public.
2000s: threats diversify and multiply
The internet was now available to the majority of the public, both in the home and in the office, but this also meant that cybercriminals had more access to devices and software. In 2001, a new infection technique meant that users were not just vulnerable to downloads; going to a website that was infected would also mean your system could be infected.
Clean pages would be replaced with infected ones, or hide malware on legitimate webpages to go after their victims.
However, antivirus engineers were quickly creating a number of program for protection and between 2000 and 2001 multiple programs were created;
The first open-source antivirus engine was made available (OpenAntivirus Project).
ClamAV was launched as the first ever open source antivirus engine to be commercialized.
Avast launched a free antivirus software to the masses.
2010s: the next generation
Cybersecurity has been creating ingenious ways to protect against attacks, increase detection of viruses, and reduce the number of false positives when preparing for cybercrime. This includes:
Multi-factor authentication (MFA)Multi-factor authentication (MFA): security which only allows access once multiple sources have identified the user
Network behavioural analysis (NBA)This identifies malicious files based on behavioral deviations or anomalies
Real-time protectionReal-time protection which is also referred to as background guard
SandboxingSandboxing, where you create an isolated test environment to execute a suspicious file or URL
ForensicsForensics, where you replay attacks to help security teams better mitigate future breaches
Back-upsCopying files to protect them in case of a data breach
Web application firewalls (WAF)Web application firewalls (WAF) to protect against cross-site forgery, cross-site-scripting (XSS), file inclusion, and SQL injection.
How are cyber threats increasing day by day?
Anything connected to the internet is susceptible to a cyber attack. As more and more people connect, the amount of threats increase as a result.
As more things become automated and systems run via computers and internet connections, more and more things become vulnerable to attacks by cybercriminals such as automated traffic lights, hospital systems, even smart home devices.
What are some well known cyber attacks in US history?
Morris was a student at Cornell University who created the first computer worm transmitted throughout the internet, intended to map out and determine the vastness of cyberspace.
The worm encountered a critical error and transformed into a virus which infected nearly 6000 computers around the world and caused an estimated $10-$100 million dollars worth of damage.
Jonathan James at age 15 penetrated the computers of the US Department of Defense division and installed a backdoor on its servers, effectively allowing him to intercept emails from different government organizations and their many usernames and passwords for various military computers.
A cybercriminal from Miami known as Gonzales was responsible for one of the biggest fraud cases in US history, sealing tens of millions of credit card and debit card numbers from over 250 financial institutions.
He even attacked the payment network from numerous companies, including the convenient store chain 7-Eleven.
Top Cyber Threat Facts, Figures, and Statistics
In a report from 2020,
300,000 thousand
new pieces of malware are created daily,
63%
of data breaches being financially motivated
30,000
websites are hacked daily on a global scale.
As of 2018,
31,107
the number of cyber security incidents reported by U.S. federal agencies with the most targeted online industries being financial institutions via phishing attacks.
How has cyber security changed in the last decade?
Social media has left more of the public’s data more readily available; people are often giving out more of their personal information daily.
Skimming this data on the internet leads to more successful phishing attacks, though some sites and people take extra precautions to protect themselves from such schemes.
This means that cybersecurity has the chance to evolve with the view of those who have understood cyberspace from a young age onwards.
How have cyber attacks affected businesses in 2020?
Cyber attacks increased in 2020 to record numbers due to the disruption of COVID-19.
Businesses had to move to online platforms to stay relevant, leaving themselves open to cybercrime in the race to stay open during the global pandemic.
Other companies also had to contend with changing to a work-from-home- model of working, allowing employees to access systems from their homes while keeping the company’s level of encryption and cybersecurity.
Multiple cybercriminals also took advantage of the pandemic to spread fake information in phishing emails which offered vaccine opportunities or fake news from the World Health Organization.
Types of cybersecurity threats
What are the three main categories of cyber threats?
Malware, Web-Attacks, and Phishing are the main three tactics that cybercriminals use. While not all cyber attacks are equal in strength, understanding these three categories of attack can help prevent such threats in the future and quickly resolve any disruptions that may occur.
Educating others to recognize suspicious online behavior is one of the first steps to preventing cyber attacks, followed by implementing protective firewalls among other things. The more common attacks are;
Malicious software ranging from trojans, ransomware, spyware, viruses and worms. These all may work differently but their intention is to access and/or damage a system without the knowledge of the owner.
- Malware can be activated once a user clicks on a malicious link or attachment
- Leading to the installation of dangerous software.
For example, spyware will covertly obtain information by transmitting data from the hard drive, and ransomware can block access to systems and demand payment for their release.
cross-site scripting)
These target websites and databases with the intent to disrupt systems and compromise accounts.
- SQL Injection is the tactic of inserting a piece of code into a server’s database directly,
- Once activated will reveal hidden data, user inputs, enable data modification and compromise the system.
Cross-site Scripting (XSS) targets the users of a site rather than the application, and inserts a piece of code which is then executed by a visitor. This code can activate trojan horses, modify website content to trick users into giving sensitive information, and/or compromise user accounts.
This utilizes fake communications (such as email or SMS) to trick the receiver into thinking it is a legitimate source, and convincing users to provide sensitive data such as passwords or credit card information.
Spear phishing is when the threat is targeted to a specific user, using their interests and preferred companies to trick them into giving sensitive information.
Wale phishing is an attack specifically aimed at wealthy and prominent individuals such as CEOs.
Other cybersecurity attacks
Other common cybersecurity attacks can vary depending on the intention. Various activist groups and criminals may use larger scale attacks, whereas an individual or even a disgruntled employee may go for an insider attack if their security clearance has not yet been revoked.
Denial-of-service (DoS) and distributed denial-of-service (DDoS) attacksa cyber attack which floods a network (or computer) so that it cannot respond to requests. DDoS works the same way except it comes from a computer network.
Password attack also known as social engineering, this can rely on criminals tricking users into giving their passwords, accessing a password database, or correctly guessing said password.
Eavesdropping attack this steals information as transmitted across a network by device (computer, smartphone) and takes advantage of an unsecured network.
Birthday attack similar to a brute-force attack, this takes advantage of the birthday paradox problem and exploits it. This is used to abuse communication between two or more users/parties.
Brute-Force and dictionary network attacks this is where an intruder can attempt to crack a password protected system by using a collated dictionary list of common words and phrases used by the users of the system.
Insider threats usually a result of a security risk that originates within the company in question. For example, a current or former employee who steals inside information to sell on to competitors.
Man-in-the-middle (MitM) attack this occurs when an attacker inserts themselves into a two-party transaction. They interrupt the traffic, filter and steal data. This can happen when a user connects to an unsecured public wi-fi network.
Zero-day exploit when a new software flaw is discovered, a zero-day exploit involves criminals immediately using this flaw to their advantage to attack a system.
DNS tunnelling the encoding of data of other programs in DNS queries and responses. This enables criminals to insert malware or pass on stolen information through a covert communication channel.
Business email compromise (BEC) the act of hacking into a corporate account to impersonate the real owners and defraud the company, as well as its customers, partners, and/or employees.
Cryptojacking when cybercriminals break into business and personal computers/laptops/mobile devices to install software which uses the computer’s own power to mine or steal cryptocurrency like Bitcoin.
IoT-Based attacksNon-standard computer devices which connect to networks wirelessly can be assigned an IP address and gain the ability to transfer data over a network are known as IoTs. They host a number of vulnerabilities that cybercriminals can take advantage of to gain access to networks and monitor users.
AI powered attacks this involves the use of AI programs to infiltrate systems and perform a number of acts, such as installing malware. It can be difficult to detect AI-powered malware as it quickly understands the internal systems and hides itself by mimicking other legitimate systems.
Cybersecurity vulnerability
What is Vulnerability in Computer Security?
A vulnerability in cybersecurity terms is a weakness in the computer system or network that can be exploited by cybercriminals.
Attackers will often look to exploit any vulnerability, but with the correct cybersecurity measures in place these exploits can be prevented and systems can be protected.
How does it defer from Cyber Threat?
In simple terms, a threat is something a system or organization is defending itself again, while vulnerabilities are gaps/weaknesses in the system.
A vulnerability can be the cause behind the cyber threat, such as a user leaving access to the system open through their unpatched software. A cybercriminal can then take advantage of that vulnerability to threaten the system with an attack.
What is a 'zero day vulnerability' in computer security?
Zero-day vulnerability is when there is a vulnerability in the system that has not yet been patched. This can happen when a software is launched and is not always recognisable at first, which is why patch updates become available. Attacks which utilize this fresh software are known as zero-day exploits (or zero-day attacks) and can be avoided by keeping on top of any patch updates that may be available for the software in question.
The sooner a patch is created and a fix developed, the sooner the usage of such exploits decreases. A vulnerability such as this will also be closely watched thereafter so as not to repeat any mistakes.
Vulnerabilities that linger unpatched
Leaving vulnerabilities unpatched can damage your cybersecurity greatly as it leaves holes for attackers to easily access. Your prior cybersecurity attempts are unlikely to make an impact if cybercriminals will simply utilize the metaphorical back door to your system, and any employee that has not patched their software with an update is liable to such an attack.
With the proper patch updates in place and constant vigilance with any vulnerabilities in the system, your cybersecurity measures will ensure that your system is aware of any potential threats.
Top 5 cybersecurity vulnerabilities
There are a few common cybersecurity vulnerabilities in most systems that are exploited by cyber criminals, and they are not always the result of malicious intent. Some simply happen during development and aren’t recognised, and some may exist on the system to begin with. The top 5 vulnerabilities of systems are;
recovery:
It is important to keep back-ups of the system in order to save any data that may be lost in an attack, but it is also good to keep some back-ups separate as they may have backed up dormant malware.
management
This can affect the security systems by not enforcing password regulations and multi-factor authentication for the system. By having weak passwords, criminals can easily gain access to systems by guessing them.
This can include allowing access to suspicious IP addresses, poor firewall management, not keeping track of network loads and not monitoring known vulnerabilities.
misuses
This can come under phishing attacks and spear phishing which can come as the result of not educating employees of the dangers in downloading unofficial files onto the organization’s systems.
Using inefficient antivirus software to protect the system/computers, not installing updates to antivirus and antispyware programs, or avoiding installing antivirus software altogether.
Other common computer security vulnerabilities can come under the umbrella of these terms and may not be malicious in nature. Some vulnerabilities can simply be down to poor cyber security measures, and can include;
Missing data encryption the lack of data encryption can make systems lose their integrity, confidentiality, and accountability. Encryption protects data from attacks attempting to steal it.
OS command injection also known as shell injection, this allows attacks to activate operating system commands on a server running an application and can compromise all data and application.
SQL injection the process of inputting data into a database in a way which allows the attacker to alter the database in question, compromising the system and the data available within.
Buffer overflow an anomaly in which a program overruns the bugger’s boundary while writing data to a buffer, and overwrites adjacent memory locations.
Missing authentication for critical function the act of not providing appropriate authentication for vital functions within a computer system and protecting it as such.
Missing authorization similarly, this relies on specific employees having designated authorization within the system rather than all staff being permitted to access any information, including confidential files.
Download of codes without integrity checks without checking what staff are downloading, they may be unintentionally allowing access to malware or other malicious software used by criminals to access systems.
Reliance on untrusted inputs in a security decision staff should use reliable sources and inputs in regards to security decisions to avoid any malicious intent or out of date information damaging security systems.
Cross-site scripting and forgery these can force a user to perform malicious actions on a system that they don’t intend to, and get into the system from their computer.
Unrestricted upload of dangerous file types this can leave the system open to attack from malware such as viruses, ransomware and trojans getting into the system and causing a breach or system shutdown.
Use of broken algorithms this can result in the exposure of sensitive information as a cybercriminal may be able to break a non-standard algorithm easier than a standard working one, and compromise protected data.
URL redirection to untrusted sites untrusted websites can have malware waiting to be downloaded simply by visiting the site, and in turn damaging whatever system it’s downloaded to.
Path traversal this allows criminals attacking to access restricted files on your system, leading to compromised data and a lack of confidentiality.
Bugs this occurs when a system doesn’t behave the way it was designed to. This can be abused to access restricted files, but normally this is a design fault with the software and not malicious.
Weak passwords this can open the door to attackers as they will be able to brute-force attack their way into the system with easy to guess passwords.
Software that is already infected with virus if this software links with the main system then the virus can go on to infect every computer linked within that system, leading to catastrophic compromises.
Vulnerabilities, threats, exploits & their relationship to risk
What is a risk?
This is the probability of exposure within cybersecurity, and the probability of damaged reputation and loss of sensitive and/or critical data as the result of an attack. It’s good to keep track of risks in cybersecurity in order to prepare for any attacks that may come in the future and prepare backup plans to save/protect data.
Defining the
components of risk
In order to prevent these risks, analyzing the different components and where they originate can help to assess the dangers involved in each one and lower the risk of attack. These components can include;
keeping track of any assets in your system that will prove valuable to criminals such as bank details or sensitive government information.
keeping track of any vulnerabilities in your system such as unpatched software or educating staff on how to recognize suspicious links/emails.
staying aware of any current cyber threats and the activity of cyber criminals, and recognizing what these criminals are currently targeting.
keeping on top of any possible exploits to your system that attackers could use to their advantage and making sure access to sensitive systems is secure.
Accurately assessing risk
Once you have your risks categorized in your cybersecurity plan, you can begin to assess the dangers of an attack and use this to protect your enterprise from threats. You can begin by assessing the;
Putting the jigsaw pieces together
Once you’ve assessed your vulnerabilities, threats, exploits and risks, you can begin to assess your cyber security system to be sure there is minimal chance of an attack succeeding.
While an attack may still be made, with the correct plan in place from your initial cyber assessment you can stop it before it can cause any damage to your systems, or your reputation.
Protection against Network Vulnerabilities
Analyzing your network vulnerabilities is an important assessment to make. Checking that your physical (server) network is secure is just as important as putting cyber protection in place. These rooms contain the most valuable data and trade secrets of your organization and measures to protect them can range from personalized access cards to biometric scanners.
Most common sources of cyber threats
Threats can come from across the world so it’s good to know where to expect your attacks to come from. The nature of your attacker may differ depending on your organization’s purpose/business, however you should still keep track of any and all possible threats to your system. The most common sources are;
- Nation states or national governments
- Terrorists
- Industrial spies
- Organized crime groups
- Hacktivists and hackers
- Disgruntled insiders
- Business competitors
These are the source of serious attacks and can range from basic espionage to disrupting the nation’s functionality.
These attackers likely have a high degree of technical expertise and can often go to extreme lengths to cover their tracks, making it very difficult to trace their origins.
Cyberterrorism can come in many forms but it can be motivated by ideological causes, or even religious and political causes.
Often these sources intend to intimidate their victims rather than steal information for a larger cause, and can seriously interfere with infrastructural systems.
This threat performs illegal and unethical theft of their competitor’s trade secrets in order to gain a competitive advantage against them.
Often this can be accomplished by someone on the inside of the company, or someone who gains employment so that they can spy and steal information for the organisation they are truly loyal to.
These can be made up of criminals with similar cyber skills that can allow them to collaborate in committing crimes against specific organisations.
Examples of cybercrime groups include the Cobalt Cybercrime Gang and the Lazarus Gang.
This type of criminal often has an ideological cause originating in a social or political reasoning.
Some hacktivists choose to hack systems in order to prove a point for their campaign rather than stealing data, while others will hack systems to breach data for the public to see.
These criminals can attack for a range of reasons, often because they are upset with how they were treated by management.
With insider knowledge of the business system, they can find exploits and vulnerabilities and take advantage of them. Prevention tactics for this threat can be covered by keeping security measures up to date for past and present employees.
Similar to industrial spies, business competitors can be cyber threats as they attempt to disrupt the competition or steal information in order to gain a competitive advantage.
Cyber threat level
Best practices to protect from cyber threats
By first handling your security issues in-house, you can already begin to protect and prepare your systems for possible attacks. These simple techniques include;
This includes compliance based practices for handling data, teaching employees to recognize phishing attempts and understanding procedures to counteract human engineering attempts. This will bolster the defenses of your users and lower the threat level of your cyber security.
Leaving software unpatched when there are new updates available can keep your system vulnerable to attack. Keeping it up to date will ensure that the software is as protected as it can be before including antivirus programs into your protection plan.
This software is vital to keeping your system protected against common malware and simple attacks from cyber criminals. It can keep viruses and ransomware at bay by detecting malicious content and making sure that it doesn’t affect the system as a whole, helping to keep the system uncompromised.
Also known as intrusion detection systems and intrusion prevention systems. IDS can analyze network traffic on a system for known signatures from previous cyber attacks and report back, while IPS will analyze and stop the packet of data from being delivered, stopping the attack.
This can track the system in order to detect any suspicious or malicious activity and either stop it in its tracks or minimize the damage caused by the attack.
Setting this up in place can mean recovering quickly when an attack occurs. It is based on evaluating the system of an organization, including all vulnerabilities, possible threats and risks, and putting measures into place to help minimize damages.
Working with a cybersecurity company can strengthen your security efforts by testing your system in ways you may not have thought of. This can include:
These will put your security efforts to the test without risk of compromising the system and/or data within your servers. Penetration tests intentionally exploit weaknesses in your network to determine the degree of access an attacker will gain during unauthorized access. Vulnerability scans will look in your system for vulnerabilities and report potential exposures and holes that can allow criminals into your system.
While you may have antiviral software and firewalls set up, cyber security companies can offer you more advanced software with up to date knowledge of threats and risks.
Cybersecurity companies make it their business to always keep an eye on potential threats and the evolving tactics of cyber criminals. Partnering with such a company can give you a leg up on the competition and strengthen your security measures to prevent even the most recent trends in cyber crime.
If you’re attacked outside of work hours, your partners will be available to help stop an attack, minimize the damage and investigate the cause/perpetrator. This can allow you to maximize your efforts on rebuilding and recovering from an incident.
Future of cybersecurity
What are the latest trends in cybersecurity?
To keep up with evolving criminal tactics, more organizations are utilizing different techniques to further prevent cyber attacks on their system.
Keeping real-time activity monitoring in your organization is becoming a popular trend to keep a watchful eye for any possible threats and bolster prevention methods.
Is real-time attack detection the future of cyber security?
As more organizations use real-time threat detection, this method of cyber security grows in popularity and helps to protect multiple systems from attack. This technique identifies malicious and suspicious activity that can compromise and can both combat and/or mitigate an attack in progress to avoid further damage to the organization.
IT can also utilize AI technology to protect vital systems such as an IoT hospital system.
Why will COVID-19 bolster the cyber-security industry?
As a result of the global pandemic, many organizations had to implement a work-from-home policy in order to safeguard their employees.
This also meant discovering new cybersecurity techniques to understand how to protect their company’s assets from a distance, rather than all on the same network in one building. With these new policies, companies are turning to the cyber-security industry for help in bolstering their defences against opportunistic cyber criminals.
What should we expect in 2021?
The cyber security industry is constantly evolving to keep up with inventive attacks from cyber criminals, coming up with new and inventive techniques such as real-time threat detection to keep an eye on systems with both humans and AIs.
Cloud security may become a higher priority however, as more remote work becomes available and its users increase. Partnering with a Managed Service Provider (MSP) that is an expert in security will ensure your organization is protected. MSPs offer more in-depth resources, knowledge, and expertise to make sure your IT environment is constantly monitored and safe.
We hope you enjoy reading this article
If you want New Charter Technologies to help you with MSP services, just book a call.
