Daisy Pomeroy

Compliance & Infosec Manager

Thoughts

Top 5 Threats to Information Security in 2020

In a year which has seen cyber attacks impact global giants from Toyota, Walmart and even Dunkin' Donuts  we all need to be on the ball!

With cyber criminals increasing their attacks and evolving their techniques year after year, business leaders and information security managers need to plan for the inevitable. As we go into the Christmas break here are the top 5 threats to information security in 2020 that you should prepare for.

1. Social Engineering

Social engineering, in the context of information security, is the psychological manipulation of people into performing actions or divulging confidential information.

Cyber criminals will use different techniques to try and mislead and trick individuals to give them their confidential information such as passwords and bank details as well as accessing the victim’s computer.

Social media is often used for this. Not only do social profiles make it easier than ever for criminals to find personal data on key individuals and companies to get them past gatekeepers on reception but it's features can be exploited to capture sensitive information.

Ever seen those nostalgia posts your mum shares on Facebook asking people to comment with the name of their first pet, childhood best friend or primary school? Not only deeply tedious but also common memorable questions used to unlock online accounts – including internet banking.

Social-Engineering-1030x687

2. Third Party Exposure

Attackers will use malware and other malicious software to steal your data through third party vendors.

Even if the attack originated with a third party, the business that contracted the third party is still liable and legally required to notify the people affected and regulators with the details of the data breach.

Therefore, when you share data with a third party, you are potentially placing your company’s reputation in their hands and the risk of exposure to a significant financial penalty. Third parties are often the weakest link in a company’s data security so it’s important that you ensure the company you are sharing your data with have comprehensive and compliant GDPR policies and procedures.

You can – and should - request to see these before engaging in any business.

Third-Party-Exposure-1030x687

3. Patch Management

Outdated software is one of the main reasons for a cyber-attack.

It is so important to stay up to date with software patches as not updating in time can leave a company vulnerable to a number of information security breaches. Remember the WannaCry ransomware attack that crippled the NHS in England and Scotland in 2017? That exploited organisations using unsupported versions of Microsoft Windows operating systems or those who hadn’t downloaded the April 2017 security update.

It is good practice and even required by some standards to have a patch management policy in place as well as a schedule for checking the necessary updates have been made.

Patch-Management-1030x687

4. Phishing Emails

Phishing emails are getting more and more sophisticated.

Some of the key ways to spot a phishing email is to double check the sender’s email address, as this can help identify if the person is truly who they claim to be. Often, the criminal will use a public email address such as gmail.com or it will look similar to the official email address just with spelling mistakes.

Phishing emails usually create a sense of urgency by asking recipients to verify personal information, such as bank details, a password or ask you to make a payment. The email may ask you to click a link within the email. If you are ever unsure, don’t click anything and report to your IT Team or Information Security Manager.

You can help your company and team avoid falling victim to phishing attacks by beefing up your payments authorisation process to require additional verification for payment requests made via email over a certain value.

Phishing-Emails-1030x687

5. Ransomware attacks

If ransomware attacks and infects your network, it can hold your data and computer systems hostage.

Ransomware can be spread to your computers through attachments or links in phishing emails, infected websites, downloads or via USB sticks. The money and data loss are the most destructive and can cause a company to go out of business.

Targets for ransomware often extend beyond corporations to public sector organisations such as councils, schools and hospitals and even legislative branches of government. In the US this year more than 70 state and local governments suffered ransomware attacks and research shows that ransomware attacks are increasing globally.

Ransomware-1030x687

Top Tips

So what can you do to prepare?

Because there is such a wide variety of threats, there is not a single solution when it comes to protecting yourself from a data breach or attack. A comprehensive security strategy is required, complete with multiple layers of protection and detection. If you don't have an in-house specialist or subject matter expert owning this there are plenty of consultancies out there who can help.

However, as with most things, forewarned is forearmed so make sure not only you but your whole team is aware of potential issues and invest time in some basic training of the risks.

At Wirehive we use this great Lego based table top game called Decisions and Disruptions that was created by the University of Lancaster and then open sourced. It’s now being further developed by the University of Bristol and is a really engaging way of educating your team. It proves that Information Security basics can be learned by anyone and that it it anything but dry and dull.