Blog / The Three Biggest Cybersecurity Threats You Need To Know

Not all cybersecurity threats are made equal.

We live in an age of relative plenty, at least as far as computer technology goes. With each new generation of hardware, software, and smart devices, our ability to leverage technology has never been more powerful. Unfortunately, that’s a double-edged sword, because despite all the useful applications out there, there are also plenty of ways for attackers to get inside your network and cause trouble. The different cybersecurity threats out there are almost inummerable.

For example there are flood attacks where attackers overwhelm a target with traffic. There’s a slew of different malware options for hackers to use that can do everything from install a missing Windows patch to installing remote access software, to straight up destroying system resources. (Yes, some Malware was created with the intent to accomplish something “good” but just followed some poor coding choices, like 2003’s Welchia Worm which actually removed a different, nastier worm called Blaster, and even tried to patch the machine it infected to keep it from being infected again, but causing massive network congestion and CPU slowdowns in the process).

Three different cybersecurity threats

This all begs the question: how should you design your defenses? What should you be actively defending against? The idea of focusing on attacks that will cause the most damage is great and all, but it doesn’t actually answer the question. The correct response actually has three answers:

• Malware
• Ransomware
• Phishing

Malware

The first thing to defend against is easy to identify; it’s malware. Malware can cause massive damage to your organization but defending against it is straightforward and relatively cheap. Make sure to install–and we cannot stress this enough–and monitor, anti-malware software on every device capable of running it. Also, you network should be properly segregated, with anything that can’t run malware separated out and limited in how it can be communicated with. Also. make sure your Firewall has malware detection features and that the firewall is setup to inspect all the traffic it can.

Ransomware

Next, make sure you’re well-defended against ransomware. Ransomware attacks have proven to be extremely lucrative for attackers, so even though it’s technically still malware, it deserves it’s own category at least when it comes to defending against it. Ransomware attacks often cause massive disruption and are incredibly costly and time consuming to recover from. Backups need to be taken often, tested routinely, and stored securely. The investment in developing a plan and procedures to protect yourself and recover from ransomware will more than pay for itself after even one attempted attack.

Phishing

Lots of things come in threes and cybersecurity threats aren’t different on that score, so the third type of attack you should be sure to consider in your cybersecurity posture is phishing, an attack that is grossly underestimated by most organizations. Having malware and ransomware defenses setup is fairly common, but it seems like most people think phishing attacks are detected by spam filters for some reason. Phishing attacks are incredibly easy to perform and while they are not generally disruptive they can be incredibly costly. And yet, phishing is almost universally ignored by organizations. Having active and ongoing phishing training for all your employees is crucial to having a strong cybersecurity posture.

And if you don’t think phishing is can cause much damage, consider the case of the educational organization being sued by the FTC in the US for suffering four data breaches over only three years. That already sounds bad but it gets even worse, because three of those breaches were caused by phishing. The article doesn’t describe the policies or procedures they implemented after each breach, but it’s clear they were not enough.

When it comes to defending against are malware, ransomware, phishing and other cybersecurity threats, adding not just technological defenses but also effective policies and procedures is crucial to having comprehensive defenses. When human error is involved in an attack, your defenses cannot be 100% technical in nature. Ransomware is often underestimated and phishing even more so, yet despite how common these attacks are and how damaging they can be, organizations tend not to do anything about them until they become a victim.

That’s why this Shakespearian quotation, from Henry VIII, is so relevant here: “Talking isn’t doing. It is a kind of good deed to say well; and yet words are not deeds.”

If you’d like to discuss cybersecurity threats to your organization, both technical and policy-driven, please feel free to contact one of our cybersecurity experts and we’ll be happy to discuss your situation and help plan your defenses.

Be kind, courtesy your friendly neighbourhood cyber-man.