Fortifying defences

What is it? ‘Malware’ is malicious software with intent to disrupt, damage or access computer systems. According to the ICO Report, malware attacks are growing year on year with the most common employing ransomware – a form of malware used by criminals that involves encrypting an organisation’s files to prevent access by anyone within the organisation. Malware is most prevalent via phishing emails or through the exploitation of vulnerabilities in remote desktop software.

How best to protect against it? Multi-factor authentication; frequent security training for staff; regular testing of response and recovery plans.

What is it? Phishing involves attackers deceiving individuals into carrying out an action that benefits the attacker (to the detriment of the individual and/or organisation in question). This includes sending sensitive information or money to the attacker, or clicking a link from the attacker that adds a virus to a computer which could then potentially infect an organisation’s entire network infrastructure. This is done commonly via email, text or phone call – relying on the individual believing the attacker’s message is genuine. The Department for Science, Innovation & Technology, as part of its 2024 cybersecurity breaches survey, stated that 56% of businesses that reported breaches in the past year identified phishing attacks as the most disruptive for organisations. This survey also showed that phishing attacks are on the rise (79% in 2023-24, compared with 72% in 2017).

How best to protect against it? Train staff to be wary of opening or clicking on content in emails from unfamiliar senders; anti-spoofing controls to prevent attackers from imitating your organisation’s network domain.

What is it? Attackers will attempt to guess usernames and passwords through trial and error of different combination attempts. A wide range of techniques are used by attackers, including using artificial intelligence (AI) to try many combinations in a short period of time, or using common phrases or known passwords to systematically gain unauthorised access. A recent digital defence report by Microsoft indicated that it experienced 11,000 brute force attacks per second in April 2023 alone.

How best to protect against it? Avoid passwords containing relevant or personal information; unique passwords for different accounts; CAPTCHA to mitigate against automated password guessing attempts; disable unused accounts.

What is it? A DoS attack will look to prevent a website or network from working as intended, overloading the system to create extreme levels of network traffic. This can also take the form of a distributed denial of service (DDoS) attack, which still overloads the system but from multiple connected devices, making the attack much harder to stop and/or maintain. Usually, an attacker will carry out a DoS attack for monetary gain or social or political reasons. Indications of a DoS attack include exceptionally slow network speeds, website pages not loading, or loss of connectivity. The Financial Conduct Authority (FCA) has reported that DDoS attacks accounted for 25% of hacking incidents reported to the FCA in the first 6 months of 2022, compared to just 4% in the same timeframe in 2021.

How best to protect against it? Implement services that can recognise legitimate increases in network traffic versus irregularities from possible attacks; regularly check firewalls and routers to ensure they are properly configured; frequently test business continuity and disaster plans.

What is it? An organisation is attacked via compromised products or services provided to them by a supplier – leading to a potential breach of an organisations systems. It shows the dangers of trusting third party suppliers without appropriate due diligence.

How best to protect against it? Implement a supply chain risk management programme to review, monitor, and manage systems and processes throughout an organisations supply chain; be fully aware of what information is shared with suppliers and how it is processed; carry out proper due diligence on potential new suppliers to ensure they have appropriate security measures; regularly review/audit existing suppliers.

How likely is this? The ICO Report reinforces the role humans themselves play in facilitating an attack or breach through failing to act or carrying out an action incorrectly. A 2023 Verizon data breach report indicated that 74% of all beaches involve a human element (including for all types of attacks we have already outlined above). The ICO Report also identifies how misconfigurations by humans are some of the most damaging errors causing data breaches. This includes security configurations that are poorly maintained or setup inaccurately (for example, leaving security controls on default as opposed to adapting the settings to the organisation’s needs). Misconfigurations can give attackers the opportunity to access systems and servers, disable poorly kept security controls and exfiltrate data with little resistance. 

How best to protect against it? Adopt a security by design approach; test security procedures before they are added to live environments; educate staff on why mistakes happen and how best to manage controls; multiple quality control checks and security approval systems involving at least two people; act on system warnings or required updates and fixes as soon as possible.