Cyber Threat Trends
Why can’t my information technology staff or security consultants just handle the problem?
Cyber risk is like any other major corporate risk; it must be managed from the top. With the frequency and severity of cybersecurity incidents involving business on the rise, it is an especially critical time for CEOs and Boards to focus on understanding and proactively managing cyber risk.
Consider some examples of cyber incidents:
As highlighted by the examples above, consequences of a cyber incident can include:
Internal Cybersecurity Threat
Quite often, we think of a cybersecurity threat as a hacker or adversary attempting to penetrate our computer systems from outside our network; these threats do exist, but what about the internal cybersecurity threat?
In many data breach instances, the breach of data happens inside the network and inside the company’s four walls. For example, say an employee unknowingly brings in a USB memory stick that has malware on it. When the employee plugs the USB stick into their corporate computer, the malware is transferred, resulting in data being gathered and then being sent outside the corporate network. Many employees’ home networks are not secure. This increases the possibility of malware being transferred from home network to corporate network via laptops, tablets and other electronic devices.
Another example could be an employee losing his or her laptop during the security screening process at the airport. Most laptops do not have full-disk encryption enabled or remote wipe configured, so an enormous amount sensitive data is lost every day as hundreds of computers are stolen.
Many companies are now using cloud-based services such as Dropbox to store sensitive data. Unfortunately, these consumer-based services typically do not have the kind of security controls and protocols that a corporate environment would have.
Whether users have weak passwords or the settings aren’t configured properly, corporate data can be at risk with these types of services.
Another potential internal cyber risk is a disgruntled employee. It is not uncommon for someone who is disgruntled with an organization to transfer sensitive information to a USB memory stick and walk out the front door.
Another potential risk is if an employee sets up his or her own WiFi router on the corporate network for convenience. With a weak password or no password enabled, this type of device can have serious security consequences.
Finally, security experts are seeing a rapid increase of extremely sophisticated socially-engineered attacks in which hackers gain access by using other methods of intelligence. For example, there have been many cases in which hackers have called IT help desks and impersonated employees. With social media and the resources available on the Internet, it is not difficult to gain enough knowledge on an individual to be able to convince an IT department to reset a password over the phone.
There is no question that the external cybersecurity threat is of great magnitude. But we also must pay attention to the internal threat. Good, solid technology, training, policies and procedures can greatly reduce businesses' internal threats. (see the section on Creating a Culture of Cybersecurity Awareness)
For more information on threat trends and data on cybercrime and espionage, please see: