Noel O’Reilly, Virgin Media Business. Image: Corporate Photographers Dublin
Virgin Media Business’s Noel O’Reilly examines the biggest trends in cybersecurity right now, including the evolution of DDoS attacks.
While a solid security strategy has been an important part of business for some time, cybersecurity has gotten more attention in recent years, with many leaders putting it higher on their radar than ever before.
PwC’s Global Digital Trust Insights Survey 2021, which surveyed more than 3,000 global executives, found 96pc of organisations had evolved their cybersecurity strategy due to the pandemic.
But while businesses are focusing more on their security, the threats they are facing are evolving at an exponential rate.
Noel O’Reilly, business products and solutions manager at Virgin Media Business, says continued uptake of ransomware and DDOS attacks are some of the biggest trends in the infosec space right now.
“Ransomware groups still enjoy ample freedom from risk of prosecution in their home countries and can easily monetise from the attacks with companies often ceding to the ransom requests to resume or safeguard business activities,” he said
‘When smaller means poorly protected, limited size companies become an attractive target for malicious actors’
– NOEL O’REILLY
A cyber insurance report published last year found the number of ransomware attacks worldwide between the first quarter of 2019 and the last quarter of 2020 increased by 170pc, making it the predominant cyber threat to businesses of all sizes.
Another report from Palo Alto Networks found that the average ransomware payment increased by 82pc to $570,000 in the first half of 2021.
But O’Reilly named other security threats facing leaders beyond ransomware attacks. “Phishing remains the prominent vector to gain access to target systems. We saw plenty of Covid-related scams still in 2021 and these are expected to continue,” he said.
“Supply chain attacks gained mainstream attention with the SolarWinds hack and continued to make the news ever since. In this case, attackers target a widely used software which allows them to infect anyone who uses it.”
The growth of IoT and cloud
O’Reilly also said that attacks on mobile and IoT devices are expected to increase, especially since IoT security is “still in its infancy,” with many devices being poorly protected.
“With the constant rise of connected devices and the ever-increasing reliance on them for production, logistics, security, mobility, collaboration and a wide range of other business and consumer domains, IoT devices already represent critical infrastructure on which much relies.”
This could cause problems when considered along with “the level of security of IoT devices, which is sub-optimal at best,” added O’Reilly. “In the last couple of years, some governments have proposed initiatives to increase [original equipment manufacturers’] focus on IoT security, but there’s a long way to go still.”
O’Reilly also said the new normal brought on by Covid has increased businesses’ exposure to security risks with an increased reliance on cloud applications.
While the move to cloud is broadly seen as a good thing from a security point of view, many experts have warned about the importance of cloud security, especially for those who migrated in haste.
O’Reilly warned that leaders need to ensure there is secure access and monitoring mechanisms in place with cloud applications, but that “a remote workforce using unprotected networks for business purposes” may also pose a security threat.
DDoS attacks
Distributed denial-of-service (DDoS) attacks are also continuing to grow and evolve. This type of attack involves a malicious party sending so much data over the internet to a particular server that it essentially becomes overloaded and fails or cannot be reached by regular users.
The attacker may do this using a botnet, or a large set of devices that have been infected and programmed to start sending traffic at the same time to the server.
O’Reilly said some of the trends within the DDoS attack sphere include DDoS for hire, where anyone can order an attack; DDoS attack vectors, where attackers use multiple techniques in a single attack; and extortion campaigns, which involves the threat of an attack in order to extract money from the victim or a DDoS attack can be used as a distraction to allow hackers to get into the victim’s network.
Advice for leaders
O’Reilly said it’s vital that leaders think of the wider impact of a single successful cyberattack against their business, rather than just the direct financial damage.
“Industry professionals agree that it is not a matter of ‘if’, but ‘when’. So, it is not only paramount to properly protect your IT infrastructure and train your workforce, but also to devise a plan to quickly react to and recover from a successful attack,” he said.
“For businesses that don’t have the resources to build and enforce these plans alone, there are many specialised security companies that can support across the whole process, from assessing the level of security exposure upfront all the way to defining and implementing a detailed incident recovery plan.”
He added that SMEs in particular need to think about security, especially if they believe they are “too small to be an attractive target” for cybercriminals.
“This is not reflected in the data, which shows a strong increase in attacks on SMEs in the past years with financial repercussions in the order of millions, sometimes shutting down the whole SME operation. When smaller means poorly protected, limited size companies become an attractive target for malicious actors.”
In terms of data security, O’Reilly said this should be addressed as a parallel but separate topic to cybersecurity.
“Poor data security and governance practices can lead to substantial damages for businesses even in the absence of a successful hack from threat actors, while at the same time heavily increasing the success rate of a potential attack.”
Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.
