Cyber security breaches: Examining cyber security risks in a turbulent landscape

Phishing

The DSIT Report shows that the most common cyber security breach affecting 84% of businesses is caused by phishing attacks ^[6], which are increasing in volume annually. We have seen attacks become more sophisticated as a consequence of technological advancements. Phishing is significantly higher than the other reported causes and should pose a concern to businesses as it is a breach which can be easily prevented as many phishing attacks arise as a consequence of human error caused by a member of staff clicking on a link or opening an attachment.

The DSIT Report stated that during the last 12 months UK businesses experienced in the region of 7.78 million cyber crimes categorised as all types and approximately 116,000 of those were non-phishing cyber crimes. ^[7] When comparing the latest report with the inaugural study published in 2016 ^[8] viruses, spyware or malware was the highest cause of cyber security breach at 68%. Phishing was not yet categorised as a common cause of breach.

Phishing attacks if successful can have serious consequences such as business interruption and reputational damage and once cyber threat actors have access to an organisation’s IT system, they will seek to exploit any vulnerabilities in that system in order to gain access to highly sensitive and valuable information. An effective way to reduce risk from phishing attacks is for organisations to reduce their digital footprint and review the information that is placed in the public domain such as on their websites and across social media channels as this can limit the information that cyber threat actors can use to target organisations in phishing campaigns.

Business email compromise (BEC)

The next common cause of breach arises from business email compromise. 35% of businesses reported having experienced BEC breaches which is also a form of phishing attack. BECs are social engineering attacks which are tailored to certain individuals within an organisation, often impersonating senior management which can add an air of urgency and legitimacy to the email.

Ransomware

Interestingly, the DSIT Report identified ransomware as one of the least commonly identified types of cyber crime (2% of businesses experienced a ransomware attack), yet the ICO Report states that ransomware continues to be the “most persistent and significant online threat to the UK economy and people”^[9]. The ICO Report adds that most ransomware incidents arise as a consequence of poor cyber hygiene rather than sophisticated attacks.

The paying of ransoms

There has been concern by regulatory bodies and law enforcement about organisations paying ransoms. The National Cyber Security Centre (NCSC) considers the threat from ransomware attacks to be the key threat facing organisations in the UK with victims facing an extortion threat that their data will published or sold unless a ransom is paid.

The NCSC has partnered with insurance industry bodies ABI, BIBA, IUA to publish guidance for organisations experiencing a ransomware attack in efforts to reduce disruption and costs to businesses, minimise the impact and limit the number of ransoms paid. ^[10] The guidance can be found here. The NCSC Guidance ^[11] recommends considering the following key points: -

• Don’t panic
• Review alternatives, including not paying
• Where possible, consult experts
• Involve the right people across the organisation in decisions, including technical staff
• Assess the impact
• Be aware that payment does not guarantee access to your devices or data
• Consider the correct legal and regulatory practice around payment
• Know that paying a ransom does not fulfil your regulatory obligations
• Report the incident to UK authorities

Organisations are urged to consider the correct legal and regulatory practice before paying any ransom and know that paying the ransom does not fulfil any regulatory obligations and will not reduce any penalty imposed by the ICO. Making a payment does not guarantee access to devices or data impacted by the attack and it may result in further attacks as the criminal groups will know that the organisation is willing to pay the ransom. Furthermore, there are legal and ethical issues to consider such as if a ransom payment is made to an entity or area sanctioned by the UK, or the payment may be used to fund further criminal activity.

Other factors

Another common cause arising from the DSIT Report related to the challenging economic environment. Some of the participants who were interviewed as part of the survey considered the difficult economic conditions to be a contributory factor to the increase in cyber attacks, driving opportunistic cyber criminals to take advantage of the current conditions. It was recognised that in harder economic conditions, greater vigilance and investment by organisations was needed as social engineering attacks were increasing in both number and sophistication.