We live in a time when every business in the modern world is engaged in a constant semi-invisible battle. We see the casualties, data leaks and destroyed networks, but we never see the battlefield. The cybersecurity war has been going on for as long as there has been electronic data to steal. From the phone phreaks to the cryptojackers, the business world has had to defend itself against people who have an unbalanced set of technical skills and a perverse desire to do harm.
In 2018 alone, cybersecurity breaches and spectacularly widespread hacks have made the news time and time again. Ransomware'd hospitals, millions of stolen customer information files, and countless tales of new ways hackers have found to infiltrate our data. And while cybersecurity defense technology is keeping pace, countering every move, upgrading your business IT infrastructure takes time. As we dive headfirst into 2019, no doubt you're thinking about what cybersecurity dangers lie ahead and how to prepare for them.
Let's take a comprehensive tour of the biggest data security threats facing modern businesses in 2019.
Social Engineering Hacks
Social engineering or social hacking is an evolution of classic con artistry, with a twist for the new generation. It, essentially, tries to trick the target (one of your employees) into installing malware onto business computers or revealing valuable information that the hacker will then use later. In some cases, it opens the door to full-on fraud and impersonation. In others, it's a hit-and-run malware infection. There are two prominent forms of social hacking. Phishing and Whaling.
2018 was rife with social hacking and there are no signs of it slowing down for the new year.
Phishing occurs when a hacker tries to 'phish' a target, luring them with a false email or social media message into doing the hacker's bidding. The hacker builds an account that appears to be a coworker, friend, or the boss of their target. Then sends a friendly message with something like "Hey, can you take a look at these documents for me before I submit them?"
Something easy to trust. Something your employee wouldn't think twice about. And when they click the link, a file even appears to open. But malware is already installing itself on their work computer, potentially spreading into the business network from that entry point.
Whaling, on the other hand, is 'phishing' for bigger fish. When a hacker decides to whale, their targets are more grandiose. To convince an accountant to transfer money to them, to gain access to insider information, or simply to infect a usually hard-protected part of your network. Whaling involves a hacker pretending to be one of the top execs in the company. The owner, CEO, or a department head.
They do this to gain the power of authority, because most employees are ready to jump if the CEO tells them to drop everything and do a task. By studying social media to gain the exec's mannerisms, hackers can even effectively fool fellow execs into sending sensitive files or making money transfers.
Brute Force Attacks
Computers are getting more powerful, which is an effective tool for both sides of the cybersecurity war. While we can build better defenses, hackers can build more powerful attacks. Brute force attacks are when a hacker doesn't try to steal your password or figure it out. They simply try every common password combination, every word in the dictionary, every combination of 6-digit numbers. That's why the more nonsensical your password, the better. Because it makes it more difficult for algorithms to guess with brute-force attacks.
But be aware, as more and more common attack methods are known, hackers can try brute-force attacks searching for commonly known website and network vulnerabilities, not just passwords.
Cryptojacking is the hot new thing of 2018 and 2019. You may recall the astounding peak in cryptocurrency prices, bringing the world's attention to a currency that hackers have been using on their dark-nets for years. This led to the crypto mining fad, where anyone with a nice graphics card could mine a few fractions of a coin.
Well, hackers have taken it to the next level. They have built malware that installs itself, hides, and begins using business computer resources to mine cryptocurrency. Which is then transferred into the hacker's crypto-wallet for their dark-net profits.
Smart Device Infiltration
If your business office makes use of any IoT or smart device infrastructure, then there's another threat that's been floating in on the IoT cloud. Smart device manufacturers have only recently begun considering their obligation to provide cybersecurity. Many devices are completely unsecured and a breeze to hack. Even brands that are improving their security still have older generation devices that provide no barrier.
Should a device on your business network get hacked, it can become a direct gateway for malware and worse. At best, it will simply be rendered useless -- known as 'bricking' -- by a rogue piece of IoT malware.
You may think that ransomware is yesterday's news, but believe it or not the attacks are still going strong. Ransomware is a method that works. It has made the international news holding huge hospitals and businesses hostage by encrypting vital files that may have impacted life or death situations. However, this popularity has inspired thousands of copy-cats who are sending out low-quality ransomware as phishing malware.
These days, there's no way to know if a ransom on your screen is real, a complete spoof, or a badly programmed hack job that already destroyed your files by failing to encrypt them correctly.
Remote Packet Reading
Do you have an app that is used by employees or customers? Does the app handle sensitive information like employee account and payment details? If so, then you stand next to thousands of other businesses with mobile apps and one real concern: packet reading. No matter how well you lock down user authorization, there are hackers who know how to read data while it in transit between the phone and your servers.
When the data is in transit, like a submitted password, a hacker may be able to detect that data packet as it travels and 'read' its contents. This is why end-to-end encryption is so vital for business mobile apps.
Known Loophole Infiltration
Another cybersecurity issue that has appeared in the news recently and will continue throughout 2019 is hackers taking advantage of known loopholes in software. You may remember the Eternal Blue fiasco recently, or have heard about the controversy involving WordPress hacks. The problem is that when really great business software becomes popular, any known and unpatched security flaw with that software exposes thousands, maybe millions of businesses to hacker attacks.
Hackers who know or have discovered a security flaw in business software, possibly by buying and cracking it themselves, can then attack every single business that also uses the same software.
Hijacking is when a hacker infiltrates a provider in order to take over something that belongs to a person or business. There are three types of common hijacking attack, and all are incredibly damaging when done to a business: Account hijacking, phone hijacking, and website hijacking.
Account hijacking, for example, might involve gaining access to the target's email, then using that to redirect all accounts to a new email address and password. This would make it impossible for the target to access their accounts and give the hacker full seemingly authorized access to everything they had. This is devastating for a business that secures all information through authorized logins, one of which has now been effectively stolen without raising red flags.
Also known as sim card hijacking, this is when a hacker manages to get a clone of your sim card for one of your business phones or the phone of an employee. They have done this to individuals simply by impersonating the phone owner and requesting a replacement for a 'lost' sim card.
But what this does is the real problem. Phone jacking allows a hacker to put a clone of your sim card in their phone and activate it. This gives them full control of your number to receive and redirect customer calls or to make calls from that will show up as your employee or company on the records.
Then there is website hijacking. Your website remains yours because you bought a domain name (ex: superawesomebiz.com) which is directed through DNS to the server with your website on it. All a hacker has to do to steal all your website traffic and have the domain name point to their website instead is to hack the DNS that determines which server is connected to which address.
And with one awful attack, a hacker has managed to completely steal your website. Not the files full of CSS stylesheets, but the actual traffic and name you have built for your business online.
Even wifi is a risk to modern businesses, and moreso as we move toward the dream of a fully mobile workforce. Wifi networks are an incredibly important part of business today as we do so much work on phones, tablets, and laptops. But as attacks on hotels in the last five years have shown, wifi isn't always safe.
The first thing you should worry about his protecting your own internal wifi network. Though this, theoretically a stranger could connect directly to your business network using proximity or a hacked wifi-enabled device in the building. It is possible to infect your network just with a mobile device that connects momentarily. So secure your network and double-secure your guest network if you have one.
Additionally, warn employees who work on-the-go to be incredibly wary about public wifi networks. Network spoofing is an increasingly popular form of attack in which hackers actually provide a network as a honey trap for unsuspecting people with mobile devices. These networks are usually disguised as belonging to local shops, named harmless things like 'Joes Bagel Wifi'. Particularly appealing when otherwise, Joe doesn't have any wifi to offer.
But if your employees connect to these networks, their devices might become compromised by injected malware or worse.
Mobile is the closest place cybersecurity touches the physical world. Because our mobile devices are little networked computers that we carry with us at all times. As we just talked about, they can connect to strange wifi networks, pick up malware from browsing or experimental apps, and hijacked with sim card duplication. The mobile workforce is an incredible thing, but always remember that convenience and security are at opposite ends of a spectrum.
Most businesses encourage employees to use their own mobile devices for work tasks. Also known as BYOD or Bring Your Own Device. This works well for everyone except for the fact that you're dealing with dozens of different device models and zero security protocols. Employees using their devices for personal reasons are much more likely to pick up malware that will then spread into the company network when they come in and connect to the wifi in the morning.
If your employees handle work documents through authorized apps or website logins on their mobile devices, you have one additional worry: stolen devices. When an employee's mobile device is stolen, all the work access they have can be assumed to be stolen as well. Especially in the age where apps oh-so-helpfully leave the users automatically logged in. Giving the thief complete -officially authorized- access to all of that employee's work documents and permissions.
2019 is looking like a busy year for cybersecurity. Fortunately, the hackers aren't the only ones with a lot of tricks up their sleeves. Cybersecurity experts haven't been asleep on the job. There are more tools and solutions than ever to help you combat the constant onslaught of hackers and their desire for your data, money, and peace of mind. Let Nexxtep help you build the levees to keep them at bay. Believe it or not, there are solutions to every single one of the hacker attacks we have listed and expect to face in 2019. And you, too, can be optimally prepared for the cybersecurity battle ahead.