Special Report – From the Mind of a Cybercriminal: Reasons Why YOU are a Target
Cybercrime has been a rising trend in the past 10+ years, and it only seems to be getting worse as the criminals continually become smarter and more organized. The scariest aspect of cybercrime is that it has truly evolved into a bona fide industry. From malware-as-a-service to security breaches and inside jobs, it continues to grow and flourish. In 2015, cybercrime on average cost US companies $15.42 million in damages per company attack alone. You more than likely have heard about some attacks in the past few years on large companies such as Target in 2014 or most recently, Ashley Madison in 2015, and you may be thinking that a firm of your size would be of no interest to cybercriminals. You would be wrong to think so, and a deeper look into your internal environment as well as the external environment of cybercrime will provide you not only a better general understanding but also the tools that you need in order to protect yourself.
Some shocking Cybercrime statistics:
- The United States was the most attacked in 2015 than ANY OTHER COUNTRY
- 60% of the time, cyberattacks are an INSIDE JOB, 44.5% of which are from malicious insiders
- In the past 10 years, large-scale data breaches have compromised the data of some 918 million users in the US alone
External Problems: The Cybercrime Environment Today
With a country as technologically advanced and focused on protection and security as the US is, it may have come as a surprise that we are so heavily targeted. The US however, has become such a target due to not only how relatively cheap it is to infect in respect to other countries, but also the size of the return that these criminals see on these highly inexpensive attacks. It costs less to infect in the US than any other country or region. On average it costs Cybercriminals about $0.07 per infection in the US; it costs twice as much to infect in Asia and Australia, $0.14 per infection, and $0.11 in Europe. While the average cybercrime costs companies $15.42 million in the US, they cost Japan $6.81 million and the UK $6.32 million; a significant correlation when the cost is taken into consideration. US entities affected by large scale data breaches in the past 10 years include Adobe, eBay, the US Military, Target, and Ashley Madison.
The bottom line is that cybercriminals spend less to make more in the US, and it’s not helpful that we have seen decreased media coverage of high-profile breaches. The media does not take these breaches as seriously as they should, which has caused many top executives to retain the belief that their organization will not be targeted. It is important to understand that these companies have teams committed to their IT security and yet cybercriminals were still strong and strategic enough to get into their systems. If these criminals were able to victimize these large countries, then your firm is more than likely a piece of cake for them to infect. You are never 100% guaranteed safety from attacks; there is always a chance that you will fall victim to cybercrime but you can lessen your chances with awareness and implementation of online security policies in your firm.
Cybercriminals are highly effective due to the way they have adapted to the digital environment. They no longer work individually on small scale projects; they have learned to work together and help one another, thus becoming stronger. Their incredible sense of synergy is a major factor in their newfound strength as they tend to collaborate across various groups to combine a wide variety of intelligence and attack methods, utilizing multiple strategies, or blended attacks. They do their research, assess your physical vulnerabilities, look at what you are working on, utilize technical exploits, and look at open source intelligence opportunities. They essentially engineer themselves into a position in which they can cause you the most harm. Furthermore, the concept of malware-as-a-service has become a trend, essentially putting highly sophisticated cyber tools in the hands of criminals with no cyber expertise. The ability to organize cybercrime has taken malware infections to a whole new level, and likely one of the reasons a new strand of malware is popping up consistently.
It is vital to stay educated about the rapidly changing external environment to understand why your firm should be so diligent about protection against cybercrime. That being said, it is important to know what you do in your business that makes you a target, and to accept that some of these apply to the nature of your business; they usually cannot be changed. Being aware of these vulnerabilities will give you the necessary knowledge to look into ways to better protect your firm.
Internal Problems: Your Company’s Environment and How it Makes You Vulnerable
Aspects of your business as a law firm that expose you to the risk of cybercrime:
- You are connected to the internet – protect yourself with a secure network that is up to date, firewalls with threat protections, and regularly-changed passwords
- You maintain client data – regular backups and encryption will help protect your data in the case that you are hit with malware
- You work with data that contains sensitive and confidential information: the more detailed and complete your datasets are, the more likely you are to be a target; top data targets include intellectual property and databases of personal information about employees, partners, suppliers and customers which can be used for identity theft and fraud – stay compliant and protect your data
- You are a firm in the highly targeted realm of professional services – there is nothing you can change about this unless you wish to change your business altogether, so heed warnings, stay up to date on the latest ransomware, and continue to protect yourself to the best of your abilities
- You have employees: studies show that 60% of cyber-attacks are an inside job with 44.5% of those attacks being from malicious insiders. – be aware of who you are hiring, train your employees well on all processes including security procedures, and implement security policies company-wide with no exceptions.
You may still be wondering why a cybercriminal would waste their time attacking your small firm when they could attack larger entities. From the mind of a cybercriminal, your small firm is the ideal target. It is likely that a firm of your size does not have the same security budget that a larger company or firm would have; smaller companies and firms tend to have a less sophisticated cyber security in place and do not enforce the same level of data protection protocols as their larger firm counterparts. They will exploit vulnerabilities and weaknesses or gaps in your policies and procedures, such as the failure to check something more than once. Small targets also can mean big rewards; although you are a small firm, gaining illegal access to your data can assist a cybercriminal to later hack into a larger entity that you may have done business with. When you are doing business with a large company or firm, you may have passwords and other electronic access to their systems that will be far easier for a cybercriminal to attain through your entity. They will also masquerade as company officials to divert payments, aka “spoofing”; not just as officials inside of your company but officials of large companies and firms that you do business with.
To reiterate, a few of the best lessons and tips we can provide you include the following:
– Keep in mind that businesses and firms are being tricked by email notifications into sending payments to criminals before you act on an invoice
– Remember that blended attacks are becoming increasingly common using any and all opportunities
– Good data governance policies and procedures are key to limiting harm in a breach
– Keeping all software up to date provides criminals with fewer weaknesses to exploit
The cybercrime environment has become a frightening one, all things considered. It shouldn’t stop you from operating your business, but you need to be aware of threats to your business so that you can be proactive in fighting them. When WAMS is your IT partner, we assess your network and work diligently to ensure that you are protected and have the tools that you need to safely run your firm’s business. Please, always feel free to contact us with any questions at (800)421-7151 or email khaight@wamsinc.com.
