Cyber threats continue to rise, top risks for seven industries

23 August 2016 Consultancy.uk

Cyber criminals are becoming more sophisticated even while more and more of the world’s transactions and intellectual property are being created and stored in the digital space. The result is an increase in threats to companies as well as the tangible and non-tangible consequences that follow. A new report considers the top threats to various sectors, as well as the most common consequences, and concludes that cyber-threats are a manageable problem after considering three key attributes.

The increasing expansion of technology into everyday life may come with a price. Cyber criminals are becoming more sophisticated in, among others, penetrating hosts that store vast amounts of information collected from those who use their services, from e-commerce website to apps. The companies targeted by cyber criminals are varied, with criminals themselves often randomly testing the defences of organisations of any size, to identify weaknesses, and strike once having identified (through automated scripts) a weak fence.

The effects of a penetration into a company can produce a range of negative consequences for the company, as well as for its customers. Consequences range from tangible losses, including access to back accounts, damage to systems, legal proceedings and compensating third parties, to intangible losses, such as intellectual property, customer trust, business partners, and reputational as well as brand damage. For a company, a major incident may see its share price fall, or in some instance, be the downfall of the whole company.

According to the research, different company types are open to different attack vectors, although, across types, a broad range of vectors are being used. In 2013, Web App Attacks were the most common form of attack, making up 35% of the sample of 1367 breaches, this was followed by Cyber-espionage, which accounted for 22% of incidents. Point of Sale System Intrusions accounted for 14% of incidents, while Insider Misuse accounted for 8%. The total number of attacks are on the rise, with a recent report citing 500,000 attacks per day, while the total costs are estimated to be around $400 billion per year.

Cyberthreats

A new report from Deloitte, titled ‘Global Cyber Executive Briefing: Lessons from the front lines’, considers the specific battle lines for seven different industries, as well as a range of case studies of incidents within the industry. The aim of the report is to highlight the threats as well as spark collaboration as a mean of closing potential vectors through which companies may become compromised – even if, in many instance, compromise is inevitable.

High-technology: According to the report, this sector is particularly open to attacks from hacktivists, state actors, insiders and competitors. Attackers are predominantly after personal data, intellectual property as well as leverage on critical systems. The impact on this sector includes loss of reputation, competitive advantage and financial losses. Cases include the hacking, and eventual bankruptcy, of a certificate authority, loss of source code and customer data for a software company, and the virtual shutdown of an online platform.

Online media: These organisations, according to the report, are most vulnerable to hacktivists, cybercriminals and script kiddies. The targets include manipulating information, such as new reports, leveraging high-volume websites for malware injections, as well as theft of personal information. The consequences include reputational damage, the spread of propaganda and the manipulation of public opinion.

Telecommunications: Threats are predominantly from script kiddies, state actors and criminal groups. Targets include customer data, communications data and network access and intellectual property. Top threats to companies include damage to reputation, undermined customer trust and loss of confidential network traffic.

Top risks for seven industries

E-commerce and online payments: This sector is most predominantly targeted by cybercriminals, hacktivists and script kiddies. Targets include customer data, money and credit card information. As a consequence, considerable reputation damage may ensue, as well as costs related to the identity theft of customers – and problems for the customers themselves. Regulatory bodies may also level fines for non-compliance.

Insurance: This sector is opening itself increasingly to attack, largely due to the sectors efforts to digitalise much of its operation, from payments through to risk assessments. Attackers are predominantly cybercriminals seeking financial information to commit fraudulent transactions. The costs to compromised companies ranges from loss of reputation and customer trust, to financial losses from non-compliance suits, legal fees, monitoring costs and customer compensation.

Manufacturing: The sector is predominantly targeted by state actors, hacktivists and competitors. The target of the hacks includes market advantage, intellectual property as well as access to critical utility networks. Consequences include loss of competitive advantage, reputational damage, and, in the case of cyber warfare, the loss of key strategic assets.

Retail: This sector is open to exploitation from cybercriminals, insiders and contractors. The sector holds a lot of credit card details, making it a juicy target. Threats include loss of cardholder data, personal data and intellectual property. Brand damage, loss of revenues and fines are all potential consequences of hacks. Cases are relatively well reported on by news agencies, which compounds brand damage.

According to the report, there are three key attributes to protecting critical information and systems, security, vigilance, and resilience. “The good news is that cyber-threats are a manageable problem. As noted earlier, a well-balanced cyber-defence needs to be secure, vigilant, and resilient. Although it isn’t possible for any organisation to be 100 percent secure, by focusing on these three key attributes, it is entirely possible to manage and mitigate cyber-threats in a way that reduces their impact and minimises the potential for business disruption.”

Profile

More news on

×

Boards of top UK firms must do more on cyber-awareness

06 March 2019 Consultancy.uk

A new report released by the UK Government has found that UK businesses need to do more to build awareness in their firms, if they are to fend off cyber-attackers. The study found that an all-time high of 72% of businesses now see cyber-threats as a top risk, but just less than half of UK boards do not have a comprehensive understanding of the critical assets at risk from cyber-attacks.

Digital technology has revolutionised modern business, with a rate of innovation present in many companies that arguably eclipses that of the industrial revolution. The huge opportunities presented by technology mean that many firms have rushed to digitalise their offerings; but while this means they are able to take advantage  of the latest trends, it has also opened innumerable doors for cyber-criminals looking to use technology to loot corporations from across the globe.

Illustrating the extent to which cyber-crime has boomed in the last decade, in the final quarter of 2018, a study commissioned by Bromium and presented by Dr. Michael McGuire at RSA found that the cyber-crime economy has grown to an estimated $1.5 trillion dollars annually. That is only a conservative estimate – but that conservative figure alone is so large that if it constituted a national GDP, instead of a collection of digital frauds, it would be the world’s 13th largest economy.

Amid this state of play, it is easy to see why cyber-security has become one of the key watchwords of any board room in the 21st century. The cyber-security consulting segment has boomed, with the world’s 10 largest operators in the segment bringing in more than $11 billion in related fees, as businesses tap external expertise to help find areas where they can improve their defences. As noted by a new UK Government report, the legacy of this spike in consulting activity is that almost all UK businesses now have a cyber-security strategy, with only 4% admitting otherwise. 

Cyber threats are increasingly seen as high risk in comparison to other risks that businesses face

This comes at the end of a sea-change in attitudes toward cyber-security over the last five years. According to the 2018 FTSE 350 Cyber Governance Health Check, in 2013, the largest minority of businesses felt cyber-threats represented a low operational risk, at 38%, compared to just 25% who saw it as a very high group risk. Now, the two opinions have seen a dramatic reversal, with only 6% seeing cyber-security as a low threat, compared to a huge 72% of businesses which see it as a very high risk. Considering the high profile hacks that occurred in the interim, this is perhaps not that surprising.

However, while cyber-awareness in general is at an all-time high, this is where the positive news ends. According to the study, while the vast majority of firms in the UK have a cyber-security plan in place, only 46% have a dedicated budget to enact that strategy. Should their financial positions change rapidly in the near future – something increasingly likely with the prospect of a No Deal Brexit still looming over the horizon – then that plan could fall by the wayside, with the funding shortfall exposing firms to even greater financial damage in the near future.

The study, released by the Department for Digital, Culture, Media & Sport (DCMS) in March 2019, was undertaken in partnership with Winning Moves and support from EY, KPMGPwC and Deloitte, working with their FTSE 350 clients to participate in the survey. The study also found that while most businesses have incident response plans, most are not testing them: 95% of FTSE 350 businesses have an incident response, but a mere 57% test their crisis incident response plans regularly. With companies facing the consistently evolving threat of cyber-attacks, that could leave major chinks in their armour undiscovered until it is too late.

Board understanding of business-critical assets

Similarly, many firms also seem oblivious to the threat posed by their wider supply chains, which if left unchecked, provide hackers with a blank cheque to access company data. A majority of boards do not recognise supply chain risks beyond the first tier, as 77% of FTSE 350 businesses told researchers they did not recognise the risks associated with businesses in the supply chain with whom they have no direct contact.

Meanwhile, almost half of UK boards do not understand the critical assets at risk from cyber-attacks. 54% of businesses in 2018 rated the board’s understanding of critical information, data assets and systems as comprehensive, while of that, only 12% said understanding was the best it could be. This compares to 43% of boards in 2017 and 32% in 2015/16 stating they had a clear understanding, suggesting that key progress is being made, but also that there is a great deal of room for improvement.

Commenting on the findings, Digital Minister Margot James said, “We know that companies are well aware of the risks, but more needs to be done by boards to make sure that they don’t fall victim to a cyber-attack. This report shows that we still have a long way to go but I am also encouraged to see that some improvements are being made. Cyber-security should never be an add-on for businesses and I would urge all executives to work with the National Cyber Security Centre and take up the government’s advice and training that’s available.”