Unless you’ve been living under a rock, you probably know that cyber-attacks are on the rise and hitting businesses hard. Over the past few years, swathes of high-profile attacks have dominated media headlines with eye-watering data-breach and lost revenue figures.
With global corporations, including Yahoo, Equifax and the NHS suffering devastating attacks, defending your organization might seem like a monumental task, especially if multimillion-dollar companies are struggling to defend against the sea of online threats. However, understanding where the threats are coming from and how incidents occur will give you the ability to protect your organization against them.
Our latest research reveals that the extended enterprise (employees, customers, suppliers, and ex-employees) is responsible for 74% of cyber incidents. The research, which surveyed 600 business decision makers and 1,200 employees across the UK, US, Germany, and Australia, found that an organization’s employees alone – whether through malicious or accidental actions – made up 42% of incidents, providing organizations with a clear starting point in addressing their cyber security.
Know thy enemy
Sun Tzu’s frequently quoted sentiment is as applicable to cyber security as it is to the art of war. Understanding the threat means being able to defeat it, and when it comes to defending your organization in the digital age, internal threats pose the biggest problem. In 2015, unknown parties, such as hackers and criminal cells carried out 33% of attacks on organizations – a figure that is now down to just 26%. The internal threat, however, is on the rise.
65% of these incidents are accidental or inadvertent rather than deliberate and make up the majority of internal threats. As most businesses believe their critical data predominantly lies in non-technical departments, such as finance (55%), HR (45%) and legal or compliance (43%), addressing employee use and education around data handling is the first of many steps to addressing the insider threat:
- Know where your data is and educate your employees
Every department in a business holds personally identifiable data to a greater or lesser extent, whether it’s the payroll records handled by finance officers or the target audience data used by marketing executives. Employees in these departments must recognize the potential security dangers associated with the data they use. Regular training seminars and tailored data security workshops might seem like overkill but will help educate employees about how to safeguard the data they handle and motivate them to care about the ramifications of a breach. With GDPR fast approaching, these will become a necessity that organizations avoid at their peril.
- Build remote working into the data protection plan
A significant contributor to the insider threat lies in the blurring lines between personal and work-based technologies. Flexible working coupled with mobile work technologies such as laptops and smart phones means that critical data is being taken outside of the bounds of the workplace and, therefore, must be secured both remotely and locally. Remote working security training should be incorporated into the data security workshops and seminars as the two invariably overlap. What’s more, a remote working policy should be developed within the overall data handling policy.
- Invest in data protection and breach prevention technologies
Whilst the risk factor around employee handling of data can be reduced, human error is inevitable. To avoid this and comprehensively secure your organization, investment in Data Loss Prevention (DLP) tools, content inspection software and document sanitization and redaction are the biggest priorities in preventing data loss and can also be used to demonstrate compliance with GDPR legislation. With these technologies, businesses can ensure that critical information isn’t being sent inadvertently or maliciously by staff. What’s more, redaction and content inspection only remove the information that breaks policy, offering a flexible approach to efficient business operations.
- Clearswift SECURITY+: augmenting existing security infrastructure to combat today's information borne threats
- Adaptive Data Loss Prevention (A-DLP)
- A Quick Video Guide to Data Loss Prevention (DLP)
The media landscape today continues to share stories of the increased cyber vulnerabilities in mobile applications. While banks have had many years to develop and tailor their apps to respond to various security issues, with increased security around detecting fraudulent use, trading apps from smaller businesses have flown under the radar and missed out on improved security.
Although cyber criminals do continue to invest their time and effort into targeting mainstream banking apps, the less frequently deployed trading apps are providing an easier opportunity for criminals looking for a bigger prize. In the past, it made sense for the cyber-criminal to target the mainstream app - more targets, more opportunity; it was a scattergun approach. However, as app security has improved and as methods of targeting have become more sophisticated, the cyber-criminal is now able to aim for the high value trading app. This is compounded by the fact that there is no official best practice for general app security, and the technology for such platforms is constantly changing.
With this in mind, we’ve outlined a few simple tips that app vendors, including trading app vendors, can take to safeguard themselves:
1. Think like a cyber-criminal. What would a criminal do first to determine vulnerabilities? Ask yourself questions like: “If the phone is unlocked, can I get to the app and make a trade? – or is there another level of security?” “What Platform is the app built on – are there vulnerabilities that a cyber-criminal could take advantage of?”
List out your concerns and address them one at a time.
2. Challenge your colleagues to find issues. Discovering and resolving vulnerabilities in your app today could be the difference between experiencing an issue or breach tomorrow. Trust and reliability will the key to ensuring the success of your app.
Offer an incentive to a group of colleagues inside and outside of the office and challenge them to find weaknesses.
3. Stay abreast of evolving cyber threats. As cyber-attacks are ever increasing in sophistication, it is important to be aware of new attack methods as well as new technology and working practices that can be used to mitigate the impact.
Subscribe to industry newsletters, join LinkedIn groups and follow security bloggers to gain knowledge and insight into the latest cyber threats and how to combat them.
4. Protect the back-end systems. While time and effort are put into protecting the app, the systems at the back end are also critical to protect, especially if there is a web interface where users can log on. If a cyber-criminal could access the back end system and change the passwords of the users, they may be able to make a trade without even seeing the app.
Review the security of your back-end systems – make sure they’re up to date and the latest threat protection and data loss prevention technology is deployed.
5. Become a member of CiSP (Cyber Security Information Sharing Partnership). CiSP is a UK government initiative to share cyber threat information, particularly for small to mid-size businesses. Other countries have similar schemes. Peer sharing of information ensures new attack vectors are rapidly disseminated, enabling companies to take immediate action to mitigate the risk.
Grow your network with security experts, tech partners and other businesses – share knowledge, discover new defences, keep evolving and improving your business.
Vendors need to try and find the balance between giving easy access to the right person to use the app, while making it impossible for an unauthorised user, and securing the platform the app is built on at the same time. Protecting against data loss and the integrity of back-end systems needs to be a top priority for all vendors, especially with the new EU GDPR legislation just around the corner where a breach could result in a fine so hefty, it could put a business out of business.
Consumers or prosumers in the case of many trading apps, are only one click away from the competition. Effective security is a differentiator and a necessity to maintain customer trust and grow the business.
By Dr. Guy Bunker, SVP Products & Marketing at Clearswift
- Solutions for GDPR Compliance
- Watch our Securing Social Media video
- Prevent advanced Malware and Ransomware attacks from striking