What cyber security threats do modern-day businesses face?
As businesses have adapted to the modern world, so have the threats that they face. Whilst we’ve seen huge leaps forward in technology and cyber security over the years, we’ve also seen vast developments in the methods used by malicious agents, leaving many businesses vulnerable to cyberattacks. A large amount of these attacks come from email sources. In fact, 52% of worldwide email traffic is spam, with social engineering attacks becoming ever-more prevalent over the past two decades.
What are the most common cyber security threats?
The vast majority of cyberattacks originate via an email and they’re becoming increasingly complex. From spam, malware and phishing to brand and domain impersonation, businesses face more threats than ever before. Here are some of the most common cyber threats you might encounter whilst trying to protect your business:
How can I strengthen my systems against these cyber security threats?
Spam
When it comes to defending yourself and your employees from spam, gateways play a key role. Modern gateways have become very effective at blocking incoming spam before it even has a chance to reach your inboxes. Barracuda has multiple products designed to stop spam and quarantine dangerous emails; find out more about our Barracuda offering…
Much like spam, one of the best ways to defend against phishing is by implementing a gateway. These are especially effective against large scale URL phishing attacks. Using URL filtering and URL re-write, gateways can defend from and block access to malicious website links sent via email. They also block access to known dangerous websites.
Malware
Ensuring that malware never reaches your inboxes is the best method of prevention. Signature matching is an important tool that your email gateway uses to identify and block malware variants. More advanced tools, such as Sandboxing, can also be implemented to further protect your environment. This is the process of testing suspicious links and files in an isolated environment before they are delivered to your inboxes.
Data Exfiltration
Data loss prevention (DLP) is a collection of policies and technology that detects and prevents data breaches, exfiltration and other risks to your confidential or sensitive data. This is usually deployed in line with outbound and inbound mail flow. With DLP, you can scan email for sensitive data and encrypt them as an additional security measure.
Impersonation
There are two types of impersonation attack, domain impersonation and brand impersonation.
Where does social engineering play a part in modern cyber security threats?
Social engineering is a growing threat that most people (and businesses) don’t take seriously until it affects them.
What is social engineering?
Social engineering is a term used for a wide variety of psychological manipulation techniques that cybercriminals use to break through the security of your business. The dangerous thing about social engineering is that it’s focusses on manipulating human beings rather than your IT systems, meaning there is very little you can do to combat it. After all, it’s easier to convince a human that you’re not malicious than it is to convince a computer.
Social engineering is a confidence trick that cybercriminals use to gain access to systems or locations, gather confidential information, or commit fraud. The most common types of social engineering take place via email or over the phone, but in-person social engineering is also a threat businesses need to be aware of. A good example of in-person social engineering would be somebody posing as an engineer or service worker to gain access to a restricted location.
The principles of social engineering
The principles of social engineering are based on fundamental psychological principles about human behaviour. They have existed for a long time and are used by criminals to manipulate unsuspecting victims.
The three forms of social engineering
Quid Pro Quo
Attackers often target multiple people at a company, claiming that they’re contacting for a legitimate reason. The attacker will eventually find an employee who is searching for help and is grateful for the extra input. Information will then be extracted from the victim whilst they’re being ‘helped’.
Phishing
Phishing is used by criminals to gain private or confidential information about an individual. Typically, the phishing email will be made to look like it has come from a familiar person or company and is designed to entice the recipient into logging in via a malicious link that captures their sensitive data.
Water Holing
Cybercriminals use watering hole attacks to identify websites that are frequently visited by their targeted users, businesses or even sectors. These websites are then compromised and infected with malware to catch their target off guard. This cyber security threat relies on their targets’ trust in the watering hole site.
How can I protect against socially engineered cyber security threats?
There are several ways that you can protect not only yourself, but your business and employees from social engineering attacks. It’s important to revisit these systems often and make sure that they’re up to date and being used by employees.
