Venus flytrap. Image: Natalia Ramirez Roman/Shutterstock
The dawn of Petya, WannaCry and everything in between has spooked industries all over the world. BT and KPMG have words of warning.
In May, a worrying piece of ransomware called WannaCry spread from east to west. Soon after, another crushing attack emerged, going by the name of Petya.
Within just two months, global industries knew that this modern, connected world was awash with risk.
BT and KPMG have this week warned businesses all over the world to beware of a series of crucial traps that could expose them to further attacks.
The duo highlight areas such as ‘denial’, ‘worry’, ‘false confidence’ and ‘hard lessons’ as fields that require added focus.
While they stress that investment in technology such as firewalls and antivirus protection is essential ‘good housekeeping’ practice initially, a broad look at defence and attack is also needed.
Priority areas
Businesses must first assess their current controls against best practice, to help identify any gaps and prioritise essential areas in which to invest.
Furthermore, everyone in the organisation, from the board down, must take responsibility for maintaining high standards of cyber hygiene, while businesses must invest in training and raise awareness amongst staff.
Evidence of how important this is came as recently as this week, when a simple case of human error led to a major breach at US telecoms giant Verizon, with around 6m customers’ data exposed – though the company got lucky on this occasion, as ransomware wasn’t involved.
“The global scale of the recent ransomware attacks showed the astonishing speed at which even the most unsophisticated of attacks can spread around the world,” said Mark Hughes, CEO of BT security.
“Many organisations could have avoided these attacks by maintaining better standards of cyber hygiene and getting the basics right.
“These global incidents remind us that every business today – from the smallest sole trader through to SMEs and large multinational corporations – needs to get to grips with managing the security of their IT estate, as well as their people and processes.”
Want to cry?
WannaCry kick-started the ransomware worry this summer, emerging on 12 May and quickly seeing the number of victims grow from 45,000 to 200,000 within hours.
It crippled large organisations from the NHS in the UK to Renault factories in France, Telefónica in Spain, as well as Russia’s second largest mobile operator, MegaFon.
By June, the fallout was already being forgotten as Petya emerged, appearing to strike first in Ukraine and then Russia before reaching the rest of Europe and beyond.
The virus spread to Denmark, Norway and the Netherlands, via shipping giant Maersk’s Russian subsidiaries. It hit ad agency WPP in London, French construction company Saint Gobain and Spanish food giant Mondelez, as well as the Asia Pacific region, including India’s largest shipping container port.
“Cyber threats are evolving and businesses face ruthless criminal entrepreneurs,” said David Ferbrache, KPMG’s technical director of its cybersecurity practice.
“The solution isn’t jargon-ridden technology silver bullets, but one that involves a community effort in a world where business boundaries are vanishing.
“With criminals getting increasingly creative about finding the weakest link, the CISOs of the future need to care about digital risk, help the business seize opportunities and build cyber resilience.”
