To succeed in business, it has been said, you need sharp elbows and a hard head. But as well as the need to fend off competitors, vigilance for cyber attacks – and knowing how to sidestep them – is now high on the agenda of all business leaders.
Cybercriminals might be quick to devise new and increasingly sophisticated scams, hacks and fraud schemes but there are recognisable patterns. Experts reveal the top five most common types of cyber attacks.
Phishing
Phishing is an email or a text message spoofing an organisation or person. The aim is to trick the would-be victim into clicking on a link and entering their bank details. HMRC is commonly used in phishing attempts while for individuals, it’s holiday companies.“All organisations need to deal with the threat of phishing because it’s used in most cyber attacks,” says Jessica Barker, co-founder and co-CEO of Cygenta, a cybersecurity consultancy. “Since technical defences have improved, cybercriminals have realised that attacks on organisations are easier, faster, cheaper, less risky and more likely to succeed when they include phishing.”Action Fraud highlights and tracks cybercrime in England, Wales and Northern Ireland. It recently highlighted an increase in phishing attacks on individuals by criminals pretending to be holiday companies with too good to be true offers. “When demand for holidays soars, so does the number of scams,” says Pauline Smith, head of Action Fraud.
Business email compromise (BEC)
Phishing is a fundamental but small part of a set of fraud-launching platforms that target businesses. “The biggest business crime is BEC, business email compromise,” says Alan Woodward, professor of cybersecurity at the University of Surrey. “It’s the move from simple phishing through spear phishing to whaling, which draws in C-suite levels.”Spear phishing is a targeted version of phishing: hackers select a company or individual to attack. Whaling is a step further than spear phishing. The target here is the individual believed to hold the keys to the kingdom when it comes to a company’s secrets. A successful BEC tends to stem from social engineering or convincing someone that a hacker is whom they claim to be. Businesses need to give digital literacy training to staff at all levels. For Woodward, that means understanding the likelihood of being targeted and the ability to recognise suspicious emails. That could include checking whether the URLs in emails or text messages match the official websites. Or, if the payroll department emails a request for the company’s bank account password, confirming the request offline by picking up the phone and speaking to the alleged sender. It could make all the difference between avoiding the worst or falling foul of a hack.
Ransomware
“Ransomware is the crime most organisations need to prepare for and is the most difficult to recover from,” warns Woodward. “Businesses have to assume it’s a case of when – not if – it’ll happen and have a business continuity plan that allows the business to continue to operate and to reinstate a trusted version of the systems and network.”Ransomware isn’t new, but it is increasingly sophisticated as cybercriminals change their methods to infiltrate networks and databases. “Ransomware has evolved,” says Barker. “In many cases, cybercriminals don’t just encrypt their victims’ data. They also threaten to publicly leak it if the ransom isn’t paid.”The potential lucre that criminals can gain from ransomware is so great that it has spawned its own mini-economy. Ransomware as a service is a niche but growing area in which criminals sell ransomware ‘packages’ on the dark web. This allows other criminals to launch ransomware attacks without needing any technical skill. It also means businesses can be bombarded with ransomware attempts, sent through email attachments and getting people to click on compromised websites that secretly download a virus that locks all files.Prevention is the best cure, with good training to ensure people don’t fall victim to such ploys. But the scale of ransomware attacks makes them almost an inevitability. That poses its own problems. “Many businesses have relied on insurers paying up the ransom, but that has two issues,” explains Woodward. “Criminals’ decryption tools are often terrible, and it’s quicker to rebuild – as the Irish Health Service discovered when it was attacked in May 2021. Insurers will stop paying out – certainly if you haven’t taken reasonable measures to mitigate losses.”
Remote access tools (RAT)
Nobody likes rats, especially in cybercrime. Remote access tools (RATs) were responsible for £57m in losses in 2021, according to Action Fraud. It’s a simple scheme, but fraudulent at its core. The scam often begins with someone calling a company, perhaps claiming to be a representative of a trusted supplier or business partner. They could also pretend to be calling from the victim’s bank to investigate a suspicious transaction on the account. They’ll be deliberately confusing about the trail of actions required, before offering the victim a simple solution: to do it for them, if only the victim gives them access to their computer remotely.Once in, the criminal siphons off vital data and often drains any bank accounts open on the victim’s computer. It’s a crime often used to target individuals but can offer even bigger payloads when it targets businesses. “Only install software or grant remote access to your computer if you’re asked by someone you know and trust,” warns detective chief inspector Craig Mullish from the City of London Police.
Insider threats
Some of the biggest risks are from hackers trying to access a company’s IT systems. But not every attack is launched from outside a company. “Organisations must be aware that incidents and breaches often come from internal as well as external sources,” cautions Barker. And insider attacks are severely effective. “They know the information to target and if they’re successful, it can shake confidence in the organisation and damage its reputation,” she says. Keeping your workers happy is vital – and keeping track of them could prevent headaches down the line.
