Will your company be a victim of cyber crime in the future? Here’s how to protect your business

Cyber crime is not a new phenomenon.

But with more and more companies storing data, both on the premises and in the cloud, and the number of internet-connected devices rapidly increasing, the opportunities for cyber attack continue to escalate. UK based digital market specialist Juniper Research has predicted that, due to the rapid digitisation of both enterprise records and consumers’ lives in general, the cost of data breaches will reach a staggering USD 2.1 trillion globally by the end of 2019, increasing to almost four times the estimated cost of cyber crime back in 2015.

The situation is looking particularly bad in the Middle East. A survey carried out by PwC in 2016 gathered data from 300 businesses in 20 countries in the region. An alarming 85% said they had suffered a cyber crime attack (compared to the global average of 79%) and 56% reported losing more than USD 500,000 due to cyber crime, compared to 33% globally. The cost is not only financial either: it was found that 13% lost three working days as a result of a digital breach, compared to a global average of 9%.

It’s not just large corporations that are being targeted. One in five SMEs have been victims of cyber crime too, according to Microsoft. Hackers prey on the knowledge that smaller companies tend to have less robust defences, usually due to lack of financial and human resources. This puts them at a greater risk from would-be saboteurs, who are interested in customer data and intellectual property.

If businesses don’t act now to protect their data, they run the risk of suffering major service failures and possibly worse, with new and more advanced forms of cyber attack being developed all the time. It’s imperative, therefore, that businesses, particularly in the Middle East, become aware of the threats facing them from cyber saboteurs and take appropriate action to protect themselves.

Cyber crime trends

Know your enemy. That’s the golden rule when it comes to protecting yourself against cyber crime. The following developments are all forecast for the coming year.

Cyber attacks will become more sophisticated: The expertise of cyber criminals is increasing year on year and this year will be no exception. Individuals and small outfits with criminal intentions will be able to apply the sort of threats formerly limited to larger organisations with nation state-level expertise. Attackers will have access to more sophisticated software, bots, viruses, trojans and phishing techniques to help them infiltrate networks.

Whether it’s stored on the premises or in the cloud, your data will be vulnerable. Advanced cyber criminals will reach new heights of sophistication by using advanced persistent threat techniques. This can involve lengthy surveillance of a business, gaining an initial foothold and then maintaining a presence for several months on a target’s computer system before stealing data.

Off-the-peg malware will increase attacks: Malware – software that is specifically designed to disrupt, damage or gain access to a computer system – will become more easily and cheaply available through the Dark Web. This in turn will lead to an increase in attacks using ransomware – software that seizes control of a target’s computer and issues ransom demands for the release of the system. Such ‘ransomware as a service’ packages are becoming increasingly available on the Dark Web, often on a commission payment basis. These packages often offer cyber saboteurs everything they need to make an attack, including rental of the malware, server capacity through which to launch the campaign and even an administrative interface through which to monitor and control it.

As organisations strengthen their defences against the growing sophistications of cyber crime, there will also be a significant rise in social engineering attacks, focused on social networks, professional sites and other publicly available sources.

Hardware will be targeted: Up until recently, most malicious malware has targeted the software of a system, attacking the applications and operating systems. However, since most malware detection products are unable to detect when malware has got into the hardware (any physical device used in or within the computer), cyber criminals will be looking to exploit this weakness. Experts anticipate an increase in malware attacks on the firmware (the programme package that controls the hardware) and memory of hardware devices, requiring a new line of defence to protect hardware as well as software.

The attack surface will continue to increase: The more connected you are as a business, the greater your ‘attack surface’ (points of potential vulnerability) increases. As businesses progress towards an increasingly mobile workforce, greater digitalisation and connectivity with their customers and suppliers, the number of entry points at which they could be open to cyber attack will increase.

With the growth of the Internet of Things (IoT) – a network of connected hardware devices, including everything from smartphones to washing machines to traffic signals – the attack surface has never been greater. Industry experts estimate that there will be up to 75 billion connected devices by 2020, meaning an unprecedented level of opportunity for cyber crime.

The diversification of operating systems offers another entry point for criminals. This year saw Google’s Android overtake Microsoft Windows based systems and applications to become the world’s most popular operating system. This has given would-be hackers greater scope to expand their number of attack points, while forcing businesses to divide their defensive resources.

What can you do to protect your business from cyber attack?

With the increased threat from cyber crime comes an increased level of defence from antivirus software designed to detect and nullify potential attacks. But don’t rely on the software; for maximum protection of your business you need to put in place a set of practices and processes that will close the gaps in your defences.

More intelligent analytics: With the increasing numbers of cyber attacks happening every day and the limited resources to fight them, companies will be looking to automate as many of their cyber security functions as possible. The use of Artificial Intelligence (AI) and Machine Learning (ML) technologies will prove invaluable. Organisations that are already deploying such tools are reporting significant improvements in their cyber security.

AI and ML can be used to both detect cyber security threats and respond to them. Together the two technologies can be used to look for indicators of compromise across a firm’s network, both on premises and in the cloud. AI can be programmed to identify events and take defensive action. It is also particularly good at recognising patterns and anomalies, which makes it an excellent tool for detecting cyber threats.

Machine learning is often used with AI. It is software that can ‘learn’ on its own, based on human input and results of actions taken. Together with AI, machine learning can become a tool to predict outcomes based on past events. Instead of highly skilled employees spending time on repetitive and mundane IT duties, the machine takes away this burden and allows them to get on with the more challenging tasks that can’t be automated, such as finding new and complex high-risk threats.

Organisations typically face millions of threats every day. As each threat is analysed by the machine, it learns and improves. This not only helps to protect a business there and then but also stores valuable data for use in predictive analytics. This information gives security teams the insight needed to be able to stop threats before they become an issue, as opposed to dealing with a problem once it has already happened.

A new generation of security analytics solutions has emerged in recent years, which are able to collect, store and analyse huge amounts of security data across a whole enterprise. This data is then scrutinised for anomalies and to identify possible malicious activities. Such tools operate in near real time and generate a small number of security alerts ranked by severity according to a risk model. These alerts enable quick detection and mitigation of cyber attacks.

Built-in security strategies: More and more companies will acknowledge the fact that cyber threats are unavoidable and, as well as employing prevention programmes, will focus increasingly on strategies for data containment, damage control and rapid recovery. By acknowledging the threats and ensuring the right policies, procedures and processes are in place, companies will be able to develop their own cyber resilience to detect breaches, isolate infected assets and network segments and restore damaged data and systems in order to mitigate the risk to their business.

Data insurance: If the worst should happen, you can make sure there is a safety net in the shape of an insurance policy that covers you for financial loss through extortion, systems sabotage, downtime and penalties for breaching data protection laws. Policies will also cover the cost of crisis management and reputation management. 

Taking the lead

Increasingly cyber security will be led from the top and not just considered an IT concern. Eliminating all kinds of threat is impossible, so protecting against them without disrupting business innovation and growth is a top management issue and will be owned and addressed at board level. Companies will need to be scrupulous in assessing risks, raising awareness and educating employees about the importance of security. Cyber crime will be managed in the same way as any other threat to business continuity.

As the years go on, cyber security, in addition to being a defensive strategy, will enable better enterprise performance. Those organisations that prioritise their cyber defences will not only be in a far better position to minimise their risk but will also be well placed to drive tangible business value.

About the author: Alniz Popat; CEO, Lifecare International

Alniz founded Lifecare International 20 years ago in his native country Kenya to address the growing need for individual and corporate health insurance solutions. Soon thereafter Alniz expanded into Dubai, and in recent years he added yet another office with the establishment of Lifecare’s presence in Qatar. As CEO of Lifecare Alniz is responsible for the strategic direction of the business, and it is his drive and passion to help people get the right healthcare through affordable insurance that has resulted in Lifecare’s strong growth over the years. Today Alniz proudly oversees 100 caring and passionate employees who work tirelessly to deliver an excellent service to the 1,200 businesses and 25,000 members who are part of the Lifecare client portfolio. Alniz is a graduate of the University of Western Ontario, Canada in Finance and Economics, and is an active member of the Young Presidents’ Organisation in Kenya, and the World Presidents’ Organisation in the United Arab Emirates.