Our recent podcast interview with Gene Yu, the CEO of the cyber security firm Blackpanda confirmed our hunch that cyber attacks have been on the rise over the past 9 months or so. He mentioned that there has been an increase is lower-level cyber attacks with the shift to everyone working from home as a result of Covid-19. Cyber criminals are using ‘spray and pray’ tactics, meaning they are targeting a multitude of companies at once. They are no longer just targeting the big fish companies with lots of personal identifiable data like those in financial services or healthcare. They are going big and reaching out to everyone. Gene said that they are seeing a whopping 667% increase in phishing emails! That’s just incredible. I’m personally definitely seeing quite a bit coming through my inbox. Apparently, users are three times more likely to click on pandemic-related phishing emails, as they are using the buzz words “Covid”, “coronavirus”, “pandemic”, “quarantine” etc. Not to mention, tens of thousands of new coronavirus related domains are being created daily, used mostly for malware distribution. Also, I can personally count on one hand the number of people within my personal network that have had their WhatsApp accounts hacked in the last month.
Gene also mentioned that ransomware has been the forefront incident that they have been responding to the most in Asia in the last nine months. They have seen the average ransom increase from 6,000 USD last year to 84,000 USD. That’s another whopping 14-fold increase! What else was interesting to learn is that Ransomware-as-a-Service is a thing. That’s right, cyber criminals can pay to get ransomware as a service, meaning that it is now much easier to become a cyber criminal and there are therefore a lot more low-level cyber criminals targeting companies and individuals.
I don’t mean to scare you (or maybe I do), but the realities of the cyber world we live in are quite scary. There are various things all companies should be doing as a no brainer.
· Encrypt data to make it useless for the hackers if they were to get their hands on it.
· Backup your data in case the hackers get into your network and try to encrypt your data with ransomware. If you already have a backup copy, you won’t need to submit to their ransom demands.
· The human factor accounts for up to 55% of all cyber incidents, so make sure your teams are up to date with the latest in the cyber landscape, so they can be on guard to mitigate the risks.
The next level of resiliency would be to engage with a cyber security firm directly. They can provide assessments and diagnostics to gauge the threat level to your company, as well as assist in addressing the issues to make your company more resilient. You could also engage with them on a retainer basis for incident response services for when you incur cyber incidents.
Companies can also consider taking out a Cyber Liability insurance policy where you get the benefits of incident response services including forensic investigation from a cyber security firm. The insurance is designed to indemnify the company, meaning to pay for the financial costs incurred when an insured cyber event occurs. This extends further than just the financial cost of paying for incident response service. For example, it also includes the financial loss a company may sustain as a result of having to close business for a few days whilst the cyber attack is resolved. Insurance pays out for this loss of revenue during this period.
All in all, the cyber threats are extremely high right now and all businesses should be alert and prepared. The last stat I want to leave with you is that 60% of small businesses go out of business within 6 months of a cyber incident. Cyber attacks can be extremely draining not only on your balance sheet, but also the reputation of your company. Make sure your company is not one of these stats and that you are prepared!