Rethink Cyber Security: Where Technology meets Behavior

Cyber Security needs to be reshaped as a multitude of tools, processes and methods to act swiftly and proactively secure weak spots on all devices, channels and in all environments.

Tl;dr: Cyber attacks come in many different forms and with the increasing digitalization of processes, workplaces and devices, organizations need a 360°-view on all of their security measures and activities. Furthermore, the human component both in security weaknesses and strengths needs to be recognized which is why training and education as well as a culture that enables careful handling of information and suspicious activities, are crucial.

Content

1. The state of cyber security & risks

2. Common types of cyber attacks

3. Holistic Cyber Security for your organization

Viruses and malware have existed since the invention of computers. In fact, in 1971, Bob Thomas wrote an experimental computer program for BBN that acted like malware by replicating itself between computers. Even before that, machines were used to crack encrypted messages during wartime that were equally generated by machines. In a way, hacking and malware has always been part of the digitalization.

the state of cyber security in organizations

Back to top

However, back then it was mainly computer experts dealing with other computer experts. Nowadays, cyber attacks can come from everywhere and they can affect everyone. The more systems are connected with each other, the more entries they offer for attacks. The answer to these problems, of course, is not to decentralize everything and go back to the 19th century before the age of the computers.

No, organizations need to be aware that cyber attacks come in different shapes and channels with different goals from receiving sensitive information to disrupting infrastructures for ransom or to simply hurt an organization. Attackers use technology but also information they can easily gain from social media, public profiles or conversations. In fact, the human component often plays a big part in an attack and often is due to lack of knowledge how to recognize and deal with suspicious emails, documents, websites, etc.

Our awareness checklist is a great way for employees, teams, and your IT to identify gaps in your security training and strategy and it helps educate by giving best practices. Download it now. 

Train your organization (yes, that includes C-level management)

'Wait, why do I need to know about this? I am a professional, this won't happen to me", you might think reading this.

Well, according to a study from Stanford University Professor Jeff Hancock and security firm Tessian, 88% of all cyber attacks are caused by human error. We might think that we are digital natives who know how to act responsibly but many of us still use unsafe passwords, read confidential documents in public spaces or don't update their software so it's safer against threats. Especially the growing complexity of numerous log-ins on different apps, devices and browsers, two-factor-authentification as well as increasingly difficult passwords can be seen as a nuisance for your daily worklife.

But human error was responsible for the hack of Twitter profiles of Elon Musk, Jeff Bezos and Bill Gates when teenage hackers actually tricked Twitter employees with simple phishing techniques to get the sought-after passwords of 130 accounts. These were the accounts of some of the most influential people in the world and the hackers didn't even need complex technologies but just made Twitter employees click on a phishing link on their mobile phones.

That's why companies need to train, educate and enable their employees (and other stakeholders in their network) to act responsibly. Knowing what to look out for when it comes to spam and phishing emails, for example, can already be a significant step towards cyber security. Enforcing two-factor-authentification can meet more acceptance, if employees know why it's needed and if there are ways to simplify the process.

Create a healthy error culture  

A hierarchy-free security culture is important to ensure that everyone feels responsible to train, educate themselves and adhere to compliance rules, whether as a student or the CEO. Addtionally, a healthy error culture needs to be implimented to allow employees to admit to mistakes, so attacks can be identified early on.

According to the Stanford/Tessian study, employees are less likely to admit to a mistake if they are scared of the consequences. If an organization threatens draconian punishment for security errors, it creates an environment that makes it all the harder to identify entry points and weaknesses because no one is willing to admit to anything.

By the way, the study also showed that especially experienced employees are less likely to admit to mistakes because they are scared to lose their standing within the organisation. This adds "discretion" to the must-haves of a healthy error culture.

In the end, an efficient, transparent and swift security strategy is not about punishment. It needs to be about transparency which minimizes risks and helps prevent further mistakes.

We talked with Cyber Security expert Deniz Tourgout about current trends, solutions as well as first steps to secure your business or organization. 

Common types of cyber attacks

Back to top

Phishing Attacks

One of the most common type of cyber attacks - phishing - is used as email, website, sms or even a chat. Usually, phishing includes the copying of a known sender, e.g. your web admin, your bank or your app itself which asks you to re-enter your login for security measures. However, the data will then be send to the hackers and can be used to gain access to your accounts.

(Results of a LinkedIn survey on the DIGITALL account)

Malware

Malware, equally, often looks official, such as an email from a colleague or a prospect, and tricks you into clicking a link or opening an attachment only to activate a software on your system that then executes different malicious actions. Just like phishing, malware comes in different forms which makes it all the more difficult to always detect it.

Ransomware

Ransomware has become one of the biggest threats for organization's in the last years. This usually precludes phishing or malware and will then hold a system "hostage" until the organization pays the titular ransom. Unfortunately, since many organizations want to 1.) keep quiet about the attack as to not hurt their brand and 2.) pick up business as soon as possible, nearly one third (32%) of attacks are successful which in turn increases their number. In fact, according to Cloudwards, 37% of businesses were hit by ransomware in 2021 and it costs a business circa 1.85 Million US-Dollars to recover from an attack.

All of which is to say: there's not one way to secure your organization against malicious threats. The answer to the sheer endless numbers and ways of hurting your organization lies in protection that is just as adaptable as the cyber attacks.

Holistic cyber security for organizations

Back to top

The digital transformation is irreversible and as we will move along, more and more people will work remotely, data will be stored in the cloud and systems, hardware and people will be connected through technology. This means that there is an endless amount of interfaces to attack, data storages to hack and communications to gain information from. To counter attacks, security technology needs to be aware of all activities at all times and identify weaknesses as well as suspicious activities to react with appropriate measures.

Keeping an eye on endpoints

With remote work, mobile devices and numerous internal and external communication channels, companies need to reasses the thinking that a simple firewall is all it takes to secure its data and infrastructure. Especially remote workers and mobile devices can increase the risk of attacks if they are not protected and observed.

With endpoint control, companies can keep an eye on all their business devices without spying on their employees. They can enforce secure two-factor-authentication and control / limit risky actions such as downloading unapproved apps or remove security software. Yes, this means that the days of BYOD (Bring your own device) are very likely to be over. On the other hand, you can assure that every employee has the right devices and the right software to work not just efficiently but also securely.

Automation & Artificial Intelligence

Automation can be used to monitor, analyze and alert as well as self-repair and react to suspicious activities. Coupled with artificial intelligence, modern security technologies are able to detect vulnerabilities before an attack can even happen. Furthermore, the system can grow stronger with every incident and learn to react swifter.

This enables organizations to have 24/7 protection, since the systems don't need to sleep.

Security Operations Centers for the 360° view

A common trend in security is the centralization and analysis of all hardware and software used to manage at a glance (and with automation). But technology - as helpful as it is - is not the only answer and should always be combined with human skills and services.

SOC, short for "security operations center" is basically a service center for all things security in an organization. It offers 24/7 365 days a year (366 during a leap year) of services enabled by automation and artificial intelligence as well as data such as current information on threats and malware. The SOC is basically overseeing security measurements, analyzing them, researching both risks and solutions and it offers pro-active and fast solutions in case of emergencies.

Training & Enablement for employees

Make sure to train and enable your employees with mandatory trainings (during onboarding, quarterly, etc.) and give them examples, tests and information, so they know different types of attacks. You can also test your company's reflexes by letting an external service provider test how easy (or hard) it is to "hack" into your systems via phishing mails or weak passwords.

Additionally, you need to have a positive error-culture where it's ok to admit to making a mistake without losing face. Aside from continuous trainings, it can be of big help to have communication channels where employees can ask about suspicious emails, links and websites and get swift feedback.

Find out how DIGITALL can help you implement the right technology as well as offer trainings and assessments to secure your organization.