Building a slide deck, pitch, or presentation? Here are the big takeaways:
- Cyber incidents targeting businesses nearly doubled from 82,000 in 2016 to 159,700 in 2017, driven by ransomware and new attack methods. — Online Trust Alliance, 2018
- 93% of all breaches in 2017 could have been avoided with simple cyber hygiene practices, such as regularly updating software, blocking fake email messages, and training employees to recognize phishing attacks. — Online Trust Alliance, 2018
Businesses beware: Cyberattacks targeting businesses nearly doubled in the past year, from 82,000 in 2016 to 159,700 in 2017, according to a Thursday report from the Online Trust Alliance (OTA).
And since the majority of cyberattacks are never reported, the actual number of incidents in 2017 could in fact be over 350,000, the report noted. This further highlights the need for enterprises to implement proper cyber hygiene practices and employee training to keep critical business systems and data secure.
“Surprising no one, 2017 marked another ‘worst year ever’ in data breaches and cyber incidents around the world,” Jeff Wilbur, director of the OTA initiative at the Internet Society, said in a press release. “This year’s big increase in cyberattacks can be attributed to the skyrocketing instances of ransomware and the bold new methods of criminals using this attack.”
SEE: Incident response policy (Tech Pro Research)
OTA tracked and analyzed threat intelligence data from multiple sources to create their report, including the FBI, Malwarebytes, the Ponemon Institute, Proofpoint, Risk Based Security, Symantec, and Verizon.
Perhaps the worst part is that an estimated 93% of all breaches in 2017 could have been avoided with simple cyber hygiene practices, such as regularly updating software, blocking fake email messages, and training employees to recognize phishing attacks, the report stated. Some 52% of the reported breaches that year were the result of actual hacks, while 15% were due to a lack of proper security software, 11% were due to credit card skimming, 11% were due to a lack of controls preventing employee negligence or malice, and 8% were due to phishing attacks.
SEE: How confident are you in your company’s cybersecurity strategy? Take this quick survey and tell us. (Tech Pro Research)
“Regular patching has always been a best practice and neglecting it is a known cause of many breaches, but this received special attention in 2017 in light of the Equifax breach,” said Wilbur. “In 2018 we expect patches to play an even more integral role due to the recently discovered Spectre and Meltdown vulnerabilities where nearly every computer chip manufactured in the last 20 years was found to contain fundamental security flaws.”
The rise of ransom denial-of-service attacks (RDoS) in the middle of the year also impacted businesses in 2017, as this method allows cybercriminals to extort money from their victims. In these attacks, the criminal will usually send a message to the victim demanding a ransom, often ranging from five to 200 bitcoins. If the victim refuses to pay, the attackers threaten to organize a DDoS attack on one of the victim’s important online resources. In June, hacker group Armada Collective carried out a large-scale RDoS attack and demanded $315,000 from seven banks in South Korea.
OTA recommends that businesses plan proactively for crisis management, and even set up a Bitcoin wallet in the event that they choose to pay a ransom to unlock their systems. However, other groups, including Kaspersky Lab, warn companies not to pay the ransom, because if they do, it may brand them in hacker communities as a “payer,” and cause them to become victims of future attacks.
For more tips on how to avoid ransomware attacks, click here.
